Extracting prog: 1h45m20.402194775s Minimizing prog: 1h19m18.249272155s Simplifying prog options: 19m18.52191315s Extracting C: 5m8.546601241s Simplifying C: 0s extracting reproducer from 24 programs testing a last program of every proc single: executing 8 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$tipc-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-ioctl$BINDER_WRITE_READ detailed listing: executing program 0: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$tipc-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-ioctl$BINDER_WRITE_READ detailed listing: executing program 0: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_usb_control_io-syz_usb_control_io$uac3-sendmsg$nl_generic-syz_usb_control_io$uac3-syz_usb_control_io$uac3-recvmmsg$unix-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000001b00)={0x26, &(0x7f0000001700)=ANY=[@ANYBLOB="001800000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-writev-socket$inet6_tcp-setsockopt$inet6_tcp_int-connect$inet6-setsockopt$inet6_IPV6_ADDRFORM-setsockopt$inet6_tcp_TCP_ULP-getsockname$inet6-syz_usb_connect detailed listing: executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="747d8d5b079413e134", 0x9}], 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) getsockname$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000140)=0x1c) syz_usb_connect(0x0, 0x51, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000cc2e3f2063072110c08e0000000109023f0001000000000904880005ffb717000905adda0000020154090501000004007f070905020c200009027e09050f042000410f04090505"], 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$bt_hci-syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-setsockopt$inet_tcp_int detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 64) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x1c37, 0x4) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$uac3-syz_usb_control_io$uac3-syz_usb_control_io-syz_usb_control_io$uac3-sendmsg$nl_generic-syz_usb_control_io$uac3-syz_usb_control_io$uac3-recvmmsg$unix-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000001b00)={0x26, &(0x7f0000001700)=ANY=[@ANYBLOB="001800000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-writev-socket$inet6_tcp-setsockopt$inet6_tcp_int-connect$inet6-setsockopt$inet6_IPV6_ADDRFORM-setsockopt$inet6_tcp_TCP_ULP-getsockname$inet6-syz_usb_connect detailed listing: executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="747d8d5b079413e134", 0x9}], 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) getsockname$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000140)=0x1c) syz_usb_connect(0x0, 0x51, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000cc2e3f2063072110c08e0000000109023f0001000000000904880005ffb717000905adda0000020154090501000004007f070905020c200009027e09050f042000410f04090505"], 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$bt_hci-syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-setsockopt$inet_tcp_int detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 64) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x1c37, 0x4) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 6m0s testing program (duration=6m6s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 9, 29, 30, 7, 6, 30, 18, 8, 6, 8, 18, 6, 9, 9, 26, 6, 9, 9, 26, 23, 10, 7, 7] detailed listing: executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e21}, 0x6e) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') pread64(r3, &(0x7f0000000480)=""/177, 0xb1, 0x2) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f00000000c0)={@private=0xa010101, @broadcast}, 0x8) ppoll(&(0x7f0000000040)=[{r0, 0x5008}], 0x1, 0x0, 0x0, 0x0) executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x400000, 0xffffffff}}, 0xffffffffffffff56) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r6, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$sock_linger(r6, 0x1, 0x3d, &(0x7f00000001c0)={0x0, 0x8}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) bind$tipc(r5, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r8, &(0x7f0000000380)={&(0x7f0000000240)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r9 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r9, &(0x7f0000000240)={0xa, 0x4e20, 0x1000, @local}, 0x1c) r10 = accept(r6, &(0x7f0000000480)=@in={0x2, 0x0, @dev}, &(0x7f0000000300)=0x80) writev(r10, &(0x7f0000001840)=[{&(0x7f0000000680)="c8ce0d2f7d199f23f44bd2dd89f3f5d43b5d74439bfb9d837ffd9f2d1d8f70438aa17bf7890caa57252f0e0bd3e59fc1ed9a5cdcda06c1c6204b53154abd1066645beaf3be157729057ddaaab48ab49d18aeb9bee8a4642fe46efc1be3ce806f93ef0976e32032d5ae5f89c46f6d5e82589661f6d7e89010580804b0d7d6b7b9ffc3d8372dc7f16a8da2e8c311392acea050f3fa3a2f1fa03f19122071a9a084d95ad128db948e43345eec149169d4abafd381995e33be74fe343295937cf9d1a1637ecb7c10357fa7b46cb26dce5a6f7dc0fbf361745bb6b46ddb7e785aafa70b2b7742604f1fdc9ad80ee658a63e482a5ca9a0203a9b832231f9a9977da77173586f622488e2477baf3264dca137ad8c071a9bff0c1a7b70335a179ec76ed2d0e3802e0757d91b595597a78ffb7b5af1174a7c477b247f5c3857a6f145d5d95263c7bba9c2bf82a32aa48171aefa1c77176718d1033b0d1c6844d52bf895508f5a1e281b7a38184d0b037f3fc2149010db8d3f4bd9e0834e029d484a92ee84b7881388ce65d9bfe874c248c11e469cdbde79f422dedd5a1c64c656c58c49403567b5bd8b57f0470b31b01720770fd95269eb79910514a4f3d9e1ed855da8e5cfc31648a8caf150589e19123252019f3ff4513e18f3f706870b37f3a2072d9d42d980ef5bbf8473fa3ff95bb9d4623054b4481360d8f05407cc432a55348a64f9808201bee019f99d92188e153be439bb5d0b0b49bdc2a1d4b9639ccc3b2efcc0f323445a41864895aa356c6705557b7a7fcc6e969d367bbb5b8b5a8686ab02f7bff23fd467b0097e3076d81fad9fc05b6aec91fb74f146718a738eac4ba4c3ea8447e43271263059ef46cdc920ccd1ae049eba24b8fdb715ec39210fb0069e328cd3164cf63106b25c0e702eea54dc1e1365ed8e902bf90b3b890c06d284aaf7c6d1370a9a08e2d8f70e7ae07a2961eeee259d61f086d4b5084d93e5a0e7a3c95be0cf9ac3dac3047c9d505ae3e0007c31b9ee3038db4a595c4ef0e9e90b0163182c7f050a5d84a86fcf492ccdd6cded36d4bb1e7a5fc48c0c606a045a583b8a25dd24a8ef1c24b2f4e1d59329e03a387b1ae1357c55182ed028ac0a0e0d859d3929871b7f3d6a56416bd06a27ababbdbce685b8b6f73bb67128aec716ad60a7f1c22dbeb67ad053c941e401c4ced65fa060137a70ead33a77d90e55c71e1219cbcc1019ddbc6df5a4ee4f2fe3f930ca052046f14dec9763b307e49537f39db52e32a611fed4570cad94c81c8b0bf7b67c091a9270758e3e0903ffb603c3a63fe5cf0eb04e12cf24b0bdfbbb01eefbc25fdfa33b45a7244b1ccc3a7376cbb9bc0d1740179908d3e0b9888d56fa30f87e569a2ba97a4628c6a1c4e7e3496797888fb987530af8c4be1ba5100e2f86e7dfdc0d4f5ee3647ae96ec694d6750e0b34a3f35f120ec16bf63c2480e21433aaa5769e6e29bd930ffe93e167323c0faffd4ec3c2ac27cdadb647e35aff0bae4d7aef78427a1385c4768e340ed897c5ed853eab42443c29f17bafcce28229470115ef052205ae0a819d97f497198b29c856e1a11ef4936a87665305ef493a01d97024d716cddc7f90265840bb8b5de0ba24ee497a877796824199206eeaeab36d1c829cc943487990b298071a4ec88e02b6a9bcde81437af3beb5e223ac55c41f102b77ca83a2958459973e6a475fc4d980094312146276001491ea965a404879be5ac73cf815501ec019da973d5c996284516de721db81f985d411f2d2372586aaed7c48187f0404004828ace393d97daeb01417e967c53d71f8e9a70effd7fcfa5940544f98e3767443d00920c9b7fd05854538310380978b9be43c4b133c8be0b63cf4fb8871270a0538cc440a0c1165a66e7e4cd7982d3445d860dcaf65b32459f9c9bca401b6fedc1ad13cdb65d227f213ad1121d3bd767f6c87c0fac5614371c3d69b49ab98578eff10fe57bf9f1399abf3950b46d5d29229abe336099d760b7401307fb34cf46a47e785974a5a5fdfaf5a7fbe19cd59f37d08df1d9eeda216bc364e6b16b46b98c337ebcb68ddebdd3b90a73f108b2847e76d4e40908fdea050346001fadab41b7580ce4dddfea7f001d93acd6c5dcb54e2f62348534fdf8e6cff579669c00389d3c8f695dd646c7afc2d962a4e29b4be43e4aed28f9cdc8d53505d918c115a3e325c1ed9b99309129957ee586cc32ffdd0270451c13554a0b1eeb3782c46395083c885b3aac51a9a3e90fef34d2f42b01647fbcaf2ebee72f6cd61b052819cfbd9aed6eabb995618b90bd87d10f7f3225cfde570860b48c6603c6aa531d15058e79fc3cfa9c2b007336ffd68f762e03ae9fe1baca43a8e8bdb26061acfbc6406a10243a8248fdb214db93e5a702efcc14cca11cc99604a6401b5098940b7644d8b969309e6f5cf4335b0cab9f37d0770870c71eda5d802c2f4096c26d037e3680372cb2efbb57d281bd8acf6833b73d4895f6a82bbfa8044b94522b35d1ef6d36f31beb14a0af89b6ced42d18a2775e5ad801dbbb4ee8fe3447fd02caea8c1f2288b4473ab10a520a068b3d392a0a244d48c9c675377eed14e926d3f772cdd09950d839db34687c188d3ca3571b21b4a4355ffaa3955b397e2561002f74d786b5df9dbd548a09c028adf3427eec37985a2e8aeade6b5f3966d08a4bcf3853bc42c7dc69d6e8c918eff9140eb3dbc6d359432b3005a8a79ecfb2ef86e8f016719072d0928be09e1fc0927fd9e4804013c677db1a85c48e8d5eb0a5d3f116e0a179288a5769ec0525e1213d7dc46b636d1d54b90596a2966921ad0fa76514a0b07808664318cb871adb58914b3fca3ca0d13e7a9d5cc71c1f1294c575f4377a5bbbc0ef7b5dd1ad9309f39033b80b71273dc4f4e5d9eed21b4d1bb595986f5c0391d994b86989fcccb74ecbfe0b7d7f0a86076cbd5028ab1f5550069adad46bb18c4a2da7a65fb68efab8960d99c4281bf00b856d7ec92d4f3c1df6933f6743bef133aebdd0ea6cfafc479815f2cac0cbc4f0bcb6a71252ef052e770c0384802ace2c1c26740f0c88dee5b61108023820beb30cf88d3c22c427db20a6d32760df1fd19e55dc57525b87dfa22459ed2b27d6003f8fc14ad7cd7c96bd85020e4ffdbea3d686c41b260a2e0c4876e370591671477f82c81e686b29b7cb908ae970e1d71991b3a1b1a3199021839f1d83285f4059c33086b1a444cd3bca3e46f60a96b0f578fcd64a8930faa68a7c88e3f39f285cdda9115277edbe6a8c243f2e5059e0a705834526d3056659b744cd68d6648468e86f05e9a62c0d4e01290179b3ff31b2ca5c78b80b2cccd02f6ece8211b45782f249574e63f2134cd3dbdf89316f1f1bf69a1e2e42d41e103b1f45a6c59e86f31f5a0cb9e89142f94a53007ed9f3447937f777a1745ce5805bb0360da8cd6387f2815df2fc217205b9ad83d5d2d17196fcd82ce5a84b51547e87b1f4dc15047fdc41fb3780c070f8dfd1993173e0f773cd8409cb0af07b7fe92c6139a6aa2c398ea4f223449cdab85807bf372c9bde5db1467b812758544dc67f6c51bcda250249a76c595072cc8fa87c9f3404b8d220fc5f2124d174d74d15aece8719c10e9c0ffec154d7d7f1908a8b8379957cb7a2b447951688691eebd8509f929b7dbea9bc9c25eb9004b266011c697e195e7ceaac013a8cf481749e9940f33e1a853dac50172394c72dc1925623a648edcd8536fe401af4d17df5a3808be740b06f240401c088e0399fffc3a5c38ea1ba57682bab78e3f9869fd00ee745d07f796ffab136981012b0c9bcec1b269491cf2517912f98e10471e6ea08035371bbe1d2ecf7046ba15a34e45947f7adeef5a3cd48a32dad2c58328d08190ec29c59fd38e1b42a64a65caa002ef28beca0e16464d6386002b40eac237290c95009e757eb5edb463e729e555f2384e499a6dd20dcbbc35825febea4d8427ea3f269ca6beac901a0bd99f8f24e1b94d217bd1e74c874e522d409e76ef5e44a177dfbdc8016b437357c560d81b220da8c634a10846297505d6e5dd8f5302636052eaf91cd69a8301b22c2eed1c1cd4edce036fdc4db8aa6a92661acd5c1d44c0edf07a9d8062a52e00fa292e29fd881d7bfaa47aa9106398746f76bf5aff9b718733c65063eb0509ab1529a2583ede137f8cf847ebb12c51daf402b3f8da9dc5ad9b8a65616a819ea76e745069533bdd3d2eca31af0eed3911299e42e430494674d54a4943ac0680d2a6714e97576526c1f31665d41b229ab92161ab99f808aa2b1fa59bed7ecd8c9cdf5a0201e293c4e4d35ecc8d9824ba373242ad9a6b3a21ca68e72f2354c8805435d8f8f25c122404d23ddab535e8685ba88a4f96dcdf4b1335153b89101f39a14f75e7449be3c41c6a528785e74758da0fd8d55e5ffe759f8b506eaa964d0f7c9b7ae5bc1bfcea29462a45a9f8aa49f4c579463a91ee2fdab6750ced3778a956a8b3984c7625ed79248ad169fa8ee9a75262b0bf18bb0e2775235b5593ac2c5bd328760a8160ac381e145b373195c61c54e572baa2287222b26ea19bc5762ec3134074901100ffff1229673db5da66a057bb8c30c48b449cb23ad124f04f09419f2d3842e16aa57e5ef0efbfc567bd0e123fdb4c9846da83c9ebac64802e8b1bbb4d6d4667b9bb13753c97ed6691c61aad277971a262c9fb00917bfa5d086b744cd591f32febb400b9c32403ad86a35319b901c973edfe4dca721168d0778fb2c0732a5185049e15224c5c89ed972065e13a381f6da779c5bbe0d03c729caa4004f52ec897ae480f0c5e5d3967ccd06f6886c869e3053c10c5ece8f13913b52293549e27f3de10aaab9ec2933c89a6eaf51ea3f790179ccd37ec8c3dac6ee6af072b7dd2cdc08142c87d6a84ca99821139637b786ee1b296313bebf6bb3348f24b41028e8e90f676928fbc5945300994dee09d91d5d2edf07ab0a9cae3e3db60c985e589b8e1073f402ce4e28789c378b85e8738dd53f1d945ae53dbc5ce12d337b4981a2babc5677c10d65e91d1097f1e6e4548e42d67569eda9d026e0539358ffd90cdac80a0f8c632418ae7961994138fbac13c755f8a4a0206d00a2d584ac46850582e9aaef2642f462c8a6b31b1136c0c235a2f2fbdbabe39db56793300c0e43c1ab2318c4c23876e68602dd3dd82b28f9902b879b0f73b81b102e72006486079247c080a0f4e9fa21ddaa26e5dace2eb7a073ff246c0e728d3b3752af560dc633eda5533071fbe7173840449f588dd89ddd1435f0d92362801d2d9161e8c1e209675590af8c176e5e4a004270d6c917c937dbd6aadeb9e7df3d1ef87b148762d13b7c24b127b4b19a458cc8b2dc37a45fd44c7087c639b81778eb4e597a12e6908988a8b10eea0e685708beb66b8a96f3a439ece77d51dab9cd5bf941cc092fe5749e32d7a80051853dcd4a590f11b2e5559f01c5332985632d9f1d8b9c14cd19c2ce2f4bd7a3ac2cc37c73c6b89a0b5e89e091e77dd1194c65b1687ecfe81b273dd1643a5f952ac9f6c1d94e0273955de7d7c2d8cde9f82cb71cba220b214a5be85b7b832741c3f2f38a63a3abf4929ed117b56d4815f0873956a552ed0d734707fa55514921c70166ad4db0c3098fbd0e6531aeee8f0fae40f2f444deab6a5208c19536b6cf0708fcea2487ea55488039cb16acfe4a9681ff75627bb620bb970718d67154cae32b97c77da7dd0eb6dbe2a538f82ff0788c5123e7b9358414c12bdc609d1face204c1110c61efa1ca7", 0x1000}, {&(0x7f0000001680)="20bd4bd996a2b9b97e36a8ba38fdcb391460079176f1ccde5372fd5d23d42936d4a72a29cffb36b7356e16d6a4e73660305c7f167adebb9d6a90184984aff01ebb396cce15879b4a9a74", 0x4a}, {&(0x7f0000001700)="e09464709a88b37025976495a55b44ca97a1446ce18097541aa5a65223deb807025f1d74f4be202a6a628b60b6af6dd6e234e44103357bec495d90f0ffa310a15887c06dba03c78c93dec71b689adcfa8fa0af6310d3cbf7c78f9dd49bf16cb3ae0272a03e7656595b12e30cc7007a50a7d905ca4aa7eda17276efa890df1e79040ca6c1b86f87c743c165b4d49e4d86c1af63d328fc7581e62fa76d3b59332a48145e5baf41717b0dca5c340470e21e1e551cd49c0722cff225", 0xba}, {&(0x7f00000017c0)="3d1ab31c30f443e23330bd36a7e1c6eac8244eb5bb35e700ff848448e154909ce92b70da9675494ff243cd27c7c2e5f8e95bd3e9ae3fdd93f8018e0892a0350bbf81511d397c2ea9da5354861386b1531e8f5c", 0x53}], 0x4) executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x8c800) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4011}, 0x8894) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000200)={0x43, 0x2, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc8045}, 0x40011) r4 = socket$inet(0x2, 0x2, 0x1) connect$inet(r4, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000000540)=[{{0x0, 0x2, &(0x7f0000000000)=[{&(0x7f00000000c0)="08001497733f5d3e", 0x6c6d}], 0x5}}, {{0x0, 0x0, &(0x7f0000000440), 0x56}}], 0x2, 0x2004000) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x10, r6}, 0x14) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000010c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x1e7d, 0x3232, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xb0, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x8, 0xc, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0xe, 0xff}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x6, 0x10, 0xf2}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000280)={0xffffffffffffff4c, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x9, {0x9, 0x21, 0x0, 0x1e, 0x1, {0x22, 0xc7b}}}}, &(0x7f00000002c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock2(&(0x7f0000381000/0x4000)=nil, 0x4000, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r8 = memfd_secret(0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r8, 0x8000000) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r8, 0x8000000) executing program 1: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f0000000000)={0x40, 0x1e, 0x11, {0x11, 0x5, "7c31a8501c7cae483acbb3a2e816f9"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x813}}}, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac2(0x6, 0x7b, &(0x7f0000000840)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x17cc, 0x1021, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x7c, 0xa0, 0x7, {0x8, 0xb, 0x1, 0x2, 0x1, 0x0, 0x20, 0xb}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x1, 0x9, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x0, 0x4, 0x1, {0x8, 0x25, 0x1, 0x80, 0x30, 0xa, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xfb, 0x6, 0x4, {0x8, 0x25, 0x1, 0x87, 0x3c, 0xba, 0x2}}}}}}}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8380, 0x1850, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xa, 0x3, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x10, 0x16, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f00000003c0)={0x4d, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fddbdf2501000000000000000b"], 0x30}}, 0x8040) syslog(0x4, &(0x7f00000001c0), 0x0) syslog(0x0, &(0x7f0000000000)=""/189, 0xbd) r2 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1100000000000000000000000100000009080000000000001100000000000000000000000100000066000000000000001400000000000000000f0000010000000000000000000000800000000000000000000000070000000094040000940d2d1c43cc0ca0e3fc210e8f442c8db00000000900000001000000090000000100000003000000030003000000000005000000060000000086320000000200053b0f9d010537e4e6001157baa9e1e7cdd042b885e449df815b01118585a5695aa2806de62b5ea462c7ed1c000000000000000000000008"], 0xe8}, 0x400c804) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x2c, &(0x7f0000000140)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r5, &(0x7f0000016440)={0x2020}, 0x2020) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x2}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETSNDBUF(r10, 0x400454d4, &(0x7f0000000380)=0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) pselect6(0x40, &(0x7f0000000800)={0x2, 0x9, 0xa, 0x7fff, 0x0, 0xbea, 0x1, 0x8000000000000000}, &(0x7f0000000840)={0x9, 0xec15, 0x0, 0x4, 0xe, 0x200, 0x9, 0xffc7}, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) splice(r8, 0x0, r7, 0x0, 0x1, 0x0) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000600)="06", 0x1}], 0x1, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r7, &(0x7f0000000100)={0x28, 0x2, 0x0, {0x1, 0x0, 0x54c1}}, 0x28) write$binfmt_script(r9, &(0x7f0000000240)={'#! ', './file0', [], 0xa, '9Kb_'}, 0xf) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000000)=0x20) syslog(0x2, 0x0, 0x0) truncate(&(0x7f0000000340)='./file1\x00', 0x9) setsockopt$sock_int(r3, 0x1, 0x1b, &(0x7f0000000000)=0x4, 0x1c) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x6c) fcntl$setlease(r0, 0x400, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000180), 0x8, &(0x7f0000000240)={[], [{@subj_role={'subj_role', 0x3d, 'security.capability\x00'}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_user={'obj_user', 0x3d, '/proc/tty/ldiscs\x00'}}, {@fsname={'fsname', 0x3d, '-++\xba][\x96{$b,&'}}, {@context={'context', 0x3d, 'root'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f00000002c0)={0x1, r2}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/tty/ldiscs\x00', 0x0, 0x0) lseek(r3, 0xfffffffffffffff5, 0x1) lsetxattr$security_capability(&(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0), &(0x7f0000000140)=@v2={0x2000000, [{0x6, 0x6}, {0xfffffff9, 0x101}]}, 0x14, 0x2) executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000c80)=[@ip_tos_u8={{0x11}}], 0x18}, 0x4000000) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000080)={0x4, 0x4, 0x2, 0x6b4}) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300000e000000000000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000400000020001000000000000000318ff00000005000500000000000a"], 0x70}}, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='smaps\x00') keyctl$set_reqkey_keyring(0xe, 0xffffffffffffffff) executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000028c0), 0x4001, &(0x7f00000000c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}}) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000040)={0x28, 0x4, 0x0, {0x1}}, 0x28) openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (async) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000028c0), 0x4001, &(0x7f00000000c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}}) (async) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000040)={0x28, 0x4, 0x0, {0x1}}, 0x28) (async) executing program 1: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) brk(0x55555ede6001) r1 = socket$unix(0x1, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1d) ioctl$KVM_TDX_CAPABILITIES(r2, 0xc008aeba, &(0x7f00000033c0)={0x0, 0x0, &(0x7f0000002ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/2000, {0x6, 0x0, [{}, {}, {}, {}, {}, {}]}}}) recvmsg$unix(r1, &(0x7f0000002a80)={&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000002980)=[{&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/210, 0xd2}, {&(0x7f00000018c0)=""/4096, 0x1000}, {&(0x7f00000028c0)=""/94, 0x5e}, {&(0x7f0000002940)=""/12, 0xc}], 0x5, &(0x7f0000002a00)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x80}, 0x40002002) ioctl$SIOCSIFMTU(r0, 0x8930, &(0x7f0000000140)={'vcan0\x00', 0x4e171e32}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000540)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r3, 0x5421, &(0x7f0000000140)=0x1) writev(r3, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) shutdown(r3, 0x1) syz_usb_connect$uac2(0x5, 0x92, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x3020, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x80, 0x3, 0x1, 0x9c, 0xa0, 0xf4, {0x8, 0xb, 0x1, 0x1, 0x1, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x0, 0xb, 0x20, 0x4}, [@feature_unit={0xb, 0x24, 0x6, 0x1, 0x1, [0xc, 0x0, 0xff]}, @output_terminal={0xc, 0x24, 0x3, 0x4, 0x401, 0x3, 0x1, 0x3, 0x0, 0x7}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x40, 0x9, 0xff, {0x8, 0x25, 0x1, 0x83, 0x3, 0xf6, 0x100}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x420, 0x5, 0x10, 0x2, {0x8, 0x25, 0x1, 0x83, 0x0, 0x8, 0x7}}}}}}}}]}}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 64) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x1c37, 0x4) executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="747d8d5b079413e134", 0x9}], 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) getsockname$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000140)=0x1c) syz_usb_connect(0x0, 0x51, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000cc2e3f2063072110c08e0000000109023f0001000000000904880005ffb717000905adda0000020154090501000004007f070905020c200009027e09050f042000410f04090505"], 0x0) executing program 1: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000001b00)={0x26, &(0x7f0000001700)=ANY=[@ANYBLOB="001800000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000dc0)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x2) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x2, 0x1, &(0x7f0000000800)=""/256, &(0x7f00000000c0)=""/73, &(0x7f00000002c0)=""/95}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000380)={0x0, 0xb3e7, 0x8, 0x1}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) mremap(&(0x7f00009d6000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000bb3000/0x1000)=nil) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mmap(&(0x7f000095f000/0x3000)=nil, 0x3000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f000061c000/0x13000)=nil, 0x13000, 0x4000, 0x3, &(0x7f0000fb0000/0x4000)=nil) mremap(&(0x7f00003f3000/0x3000)=nil, 0x3000, 0x3000, 0x4, &(0x7f0000ffc000/0x3000)=nil) mremap(&(0x7f000046b000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000769000/0x1000)=nil) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793f10d10501200002000008010902120001000000000904"], 0x0) executing program 32: r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 64) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x1c37, 0x4) executing program 33: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="747d8d5b079413e134", 0x9}], 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) getsockname$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000140)=0x1c) syz_usb_connect(0x0, 0x51, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000cc2e3f2063072110c08e0000000109023f0001000000000904880005ffb717000905adda0000020154090501000004007f070905020c200009027e09050f042000410f04090505"], 0x0) executing program 34: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000001b00)={0x26, &(0x7f0000001700)=ANY=[@ANYBLOB="001800000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) clock_settime(0xfffffffb, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x4, [{0x11}, {0x0, 0x100000000000000}]}, 0x68) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x2}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x44004) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0x2, 0x1, 0x0, 0x8}, 0x20) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8000000, 0x1, 0x2, 0x5, 0x0, 0x4005}, 0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r5, 0x29, 0x41, &(0x7f0000000080)=ANY=[], &(0x7f0000000180)=0x2c) (async) getsockopt$IP6T_SO_GET_ENTRIES(r5, 0x29, 0x41, &(0x7f0000000080)=ANY=[], &(0x7f0000000180)=0x2c) socket$inet6(0xa, 0x2, 0x0) (async) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r6, 0x29, 0x43, &(0x7f0000000180)=0xffffffff, 0x4) (async) setsockopt$inet6_int(r6, 0x29, 0x43, &(0x7f0000000180)=0xffffffff, 0x4) r7 = syz_clone(0x1a304200, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r7, 0x7, 0x0, &(0x7f0000000040)) (async) prlimit64(r7, 0x7, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) (async) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x14, r8, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) executing program 3: socket$inet(0x2, 0x3, 0x8) mkdir(&(0x7f0000000040)='./file0\x00', 0x109) r0 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f00004a4000/0x800000)=nil, 0x800000, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'veth1_virt_wifi\x00', &(0x7f00000002c0)=@ethtool_cmd={0x49, 0x100, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x8000001b}}) ftruncate(r0, 0x51a9497) futex(&(0x7f0000000340), 0xd, 0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) fadvise64(r2, 0x4, 0x4, 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000400)='ramfs\x00', 0x2800000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000000)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) setxattr$trusted_overlay_origin(&(0x7f0000000140)='./bus\x00', &(0x7f0000000180), &(0x7f0000000240), 0x2, 0x3) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) executing program 3: openat$tun(0xffffffffffffff9c, 0x0, 0x604040, 0x0) keyctl$set_reqkey_keyring(0xe, 0x7) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='.^$\'#{@\\\x00', 0x0) syz_usb_connect$uac2(0x0, 0xbd, &(0x7f0000000000)={{0x12, 0x1, 0x111, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x17a0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xab, 0x3, 0x1, 0x80, 0xc0, 0x8, {0x8, 0xb, 0x41, 0x1, 0x1, 0x6, 0x20, 0x2e}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x8, 0x42, 0x2}, [@sample_rate={0xd, 0x24, 0xd, 0x2, 0x1, 0x2, [0x3, 0x1, 0x1]}, @output_terminal={0xc, 0x24, 0x3, 0x3, 0x306, 0x8, 0x5, 0x12, 0x5, 0x1}, @effect_unit={0xf, 0x24, 0x7, 0x6, 0x1, 0x6, [0x3, 0x2, 0x0, 0x1]}, @processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x2, 0x1, 0x0, 0x1, 0x0, 0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x8a, 0x9, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0xc9, 0x5, {0x8, 0x25, 0x1, 0x181, 0x3f, 0x4, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x1, 0x1, 0xe, {0x8, 0x25, 0x1, 0x3, 0xf, 0x3, 0x7}}}}}}}}]}}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x604040, 0x0) (async) keyctl$set_reqkey_keyring(0xe, 0x7) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='.^$\'#{@\\\x00', 0x0) (async) syz_usb_connect$uac2(0x0, 0xbd, &(0x7f0000000000)={{0x12, 0x1, 0x111, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x17a0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xab, 0x3, 0x1, 0x80, 0xc0, 0x8, {0x8, 0xb, 0x41, 0x1, 0x1, 0x6, 0x20, 0x2e}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x8, 0x42, 0x2}, [@sample_rate={0xd, 0x24, 0xd, 0x2, 0x1, 0x2, [0x3, 0x1, 0x1]}, @output_terminal={0xc, 0x24, 0x3, 0x3, 0x306, 0x8, 0x5, 0x12, 0x5, 0x1}, @effect_unit={0xf, 0x24, 0x7, 0x6, 0x1, 0x6, [0x3, 0x2, 0x0, 0x1]}, @processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x2, 0x1, 0x0, 0x1, 0x0, 0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x8a, 0x9, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0xc9, 0x5, {0x8, 0x25, 0x1, 0x181, 0x3f, 0x4, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x1, 0x1, 0xe, {0x8, 0x25, 0x1, 0x3, 0xf, 0x3, 0x7}}}}}}}}]}}, 0x0) (async) executing program 3: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) executing program 35: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) program crashed: INFO: task hung in rtnl_lock bisect: bisecting 24 programs bisect: split chunks (needed=false): <24> bisect: split chunk #0 of len 24 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 6, 8, 18, 6, 9, 9, 26, 6, 9, 9, 26, 23, 10, 7, 7] detailed listing: executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000c80)=[@ip_tos_u8={{0x11}}], 0x18}, 0x4000000) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000080)={0x4, 0x4, 0x2, 0x6b4}) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300000e000000000000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000400000020001000000000000000318ff00000005000500000000000a"], 0x70}}, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='smaps\x00') keyctl$set_reqkey_keyring(0xe, 0xffffffffffffffff) executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000028c0), 0x4001, &(0x7f00000000c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}}) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000040)={0x28, 0x4, 0x0, {0x1}}, 0x28) openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (async) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000028c0), 0x4001, &(0x7f00000000c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}}) (async) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000040)={0x28, 0x4, 0x0, {0x1}}, 0x28) (async) executing program 1: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) brk(0x55555ede6001) r1 = socket$unix(0x1, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1d) ioctl$KVM_TDX_CAPABILITIES(r2, 0xc008aeba, &(0x7f00000033c0)={0x0, 0x0, &(0x7f0000002ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/2000, {0x6, 0x0, [{}, {}, {}, {}, {}, {}]}}}) recvmsg$unix(r1, &(0x7f0000002a80)={&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000002980)=[{&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/210, 0xd2}, {&(0x7f00000018c0)=""/4096, 0x1000}, {&(0x7f00000028c0)=""/94, 0x5e}, {&(0x7f0000002940)=""/12, 0xc}], 0x5, &(0x7f0000002a00)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x80}, 0x40002002) ioctl$SIOCSIFMTU(r0, 0x8930, &(0x7f0000000140)={'vcan0\x00', 0x4e171e32}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000540)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r3, 0x5421, &(0x7f0000000140)=0x1) writev(r3, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) shutdown(r3, 0x1) syz_usb_connect$uac2(0x5, 0x92, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x3020, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x80, 0x3, 0x1, 0x9c, 0xa0, 0xf4, {0x8, 0xb, 0x1, 0x1, 0x1, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x0, 0xb, 0x20, 0x4}, [@feature_unit={0xb, 0x24, 0x6, 0x1, 0x1, [0xc, 0x0, 0xff]}, @output_terminal={0xc, 0x24, 0x3, 0x4, 0x401, 0x3, 0x1, 0x3, 0x0, 0x7}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x40, 0x9, 0xff, {0x8, 0x25, 0x1, 0x83, 0x3, 0xf6, 0x100}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x420, 0x5, 0x10, 0x2, {0x8, 0x25, 0x1, 0x83, 0x0, 0x8, 0x7}}}}}}}}]}}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 64) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x1c37, 0x4) executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="747d8d5b079413e134", 0x9}], 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) getsockname$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000140)=0x1c) syz_usb_connect(0x0, 0x51, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000cc2e3f2063072110c08e0000000109023f0001000000000904880005ffb717000905adda0000020154090501000004007f070905020c200009027e09050f042000410f04090505"], 0x0) executing program 1: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000001b00)={0x26, &(0x7f0000001700)=ANY=[@ANYBLOB="001800000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000dc0)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x2) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x2, 0x1, &(0x7f0000000800)=""/256, &(0x7f00000000c0)=""/73, &(0x7f00000002c0)=""/95}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000380)={0x0, 0xb3e7, 0x8, 0x1}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) mremap(&(0x7f00009d6000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000bb3000/0x1000)=nil) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mmap(&(0x7f000095f000/0x3000)=nil, 0x3000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f000061c000/0x13000)=nil, 0x13000, 0x4000, 0x3, &(0x7f0000fb0000/0x4000)=nil) mremap(&(0x7f00003f3000/0x3000)=nil, 0x3000, 0x3000, 0x4, &(0x7f0000ffc000/0x3000)=nil) mremap(&(0x7f000046b000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000769000/0x1000)=nil) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793f10d10501200002000008010902120001000000000904"], 0x0) executing program 32: r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 64) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x1c37, 0x4) executing program 33: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="747d8d5b079413e134", 0x9}], 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) getsockname$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000140)=0x1c) syz_usb_connect(0x0, 0x51, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000cc2e3f2063072110c08e0000000109023f0001000000000904880005ffb717000905adda0000020154090501000004007f070905020c200009027e09050f042000410f04090505"], 0x0) executing program 34: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000001b00)={0x26, &(0x7f0000001700)=ANY=[@ANYBLOB="001800000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) clock_settime(0xfffffffb, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x4, [{0x11}, {0x0, 0x100000000000000}]}, 0x68) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x2}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x44004) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0x2, 0x1, 0x0, 0x8}, 0x20) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8000000, 0x1, 0x2, 0x5, 0x0, 0x4005}, 0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r5, 0x29, 0x41, &(0x7f0000000080)=ANY=[], &(0x7f0000000180)=0x2c) (async) getsockopt$IP6T_SO_GET_ENTRIES(r5, 0x29, 0x41, &(0x7f0000000080)=ANY=[], &(0x7f0000000180)=0x2c) socket$inet6(0xa, 0x2, 0x0) (async) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r6, 0x29, 0x43, &(0x7f0000000180)=0xffffffff, 0x4) (async) setsockopt$inet6_int(r6, 0x29, 0x43, &(0x7f0000000180)=0xffffffff, 0x4) r7 = syz_clone(0x1a304200, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r7, 0x7, 0x0, &(0x7f0000000040)) (async) prlimit64(r7, 0x7, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) (async) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x14, r8, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) executing program 3: socket$inet(0x2, 0x3, 0x8) mkdir(&(0x7f0000000040)='./file0\x00', 0x109) r0 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f00004a4000/0x800000)=nil, 0x800000, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'veth1_virt_wifi\x00', &(0x7f00000002c0)=@ethtool_cmd={0x49, 0x100, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x8000001b}}) ftruncate(r0, 0x51a9497) futex(&(0x7f0000000340), 0xd, 0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) fadvise64(r2, 0x4, 0x4, 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000400)='ramfs\x00', 0x2800000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000000)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) setxattr$trusted_overlay_origin(&(0x7f0000000140)='./bus\x00', &(0x7f0000000180), &(0x7f0000000240), 0x2, 0x3) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) executing program 3: openat$tun(0xffffffffffffff9c, 0x0, 0x604040, 0x0) keyctl$set_reqkey_keyring(0xe, 0x7) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='.^$\'#{@\\\x00', 0x0) syz_usb_connect$uac2(0x0, 0xbd, &(0x7f0000000000)={{0x12, 0x1, 0x111, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x17a0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xab, 0x3, 0x1, 0x80, 0xc0, 0x8, {0x8, 0xb, 0x41, 0x1, 0x1, 0x6, 0x20, 0x2e}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x8, 0x42, 0x2}, [@sample_rate={0xd, 0x24, 0xd, 0x2, 0x1, 0x2, [0x3, 0x1, 0x1]}, @output_terminal={0xc, 0x24, 0x3, 0x3, 0x306, 0x8, 0x5, 0x12, 0x5, 0x1}, @effect_unit={0xf, 0x24, 0x7, 0x6, 0x1, 0x6, [0x3, 0x2, 0x0, 0x1]}, @processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x2, 0x1, 0x0, 0x1, 0x0, 0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x8a, 0x9, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0xc9, 0x5, {0x8, 0x25, 0x1, 0x181, 0x3f, 0x4, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x1, 0x1, 0xe, {0x8, 0x25, 0x1, 0x3, 0xf, 0x3, 0x7}}}}}}}}]}}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x604040, 0x0) (async) keyctl$set_reqkey_keyring(0xe, 0x7) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='.^$\'#{@\\\x00', 0x0) (async) syz_usb_connect$uac2(0x0, 0xbd, &(0x7f0000000000)={{0x12, 0x1, 0x111, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x17a0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xab, 0x3, 0x1, 0x80, 0xc0, 0x8, {0x8, 0xb, 0x41, 0x1, 0x1, 0x6, 0x20, 0x2e}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x8, 0x42, 0x2}, [@sample_rate={0xd, 0x24, 0xd, 0x2, 0x1, 0x2, [0x3, 0x1, 0x1]}, @output_terminal={0xc, 0x24, 0x3, 0x3, 0x306, 0x8, 0x5, 0x12, 0x5, 0x1}, @effect_unit={0xf, 0x24, 0x7, 0x6, 0x1, 0x6, [0x3, 0x2, 0x0, 0x1]}, @processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x2, 0x1, 0x0, 0x1, 0x0, 0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x8a, 0x9, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0xc9, 0x5, {0x8, 0x25, 0x1, 0x181, 0x3f, 0x4, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x1, 0x1, 0xe, {0x8, 0x25, 0x1, 0x3, 0xf, 0x3, 0x7}}}}}}}}]}}, 0x0) (async) executing program 3: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) executing program 35: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 9, 29, 30, 7, 6, 30, 18, 6, 9, 9, 26, 23, 10, 7, 7] detailed listing: executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e21}, 0x6e) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') pread64(r3, &(0x7f0000000480)=""/177, 0xb1, 0x2) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f00000000c0)={@private=0xa010101, @broadcast}, 0x8) ppoll(&(0x7f0000000040)=[{r0, 0x5008}], 0x1, 0x0, 0x0, 0x0) executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x400000, 0xffffffff}}, 0xffffffffffffff56) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r6, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$sock_linger(r6, 0x1, 0x3d, &(0x7f00000001c0)={0x0, 0x8}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) bind$tipc(r5, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r8, &(0x7f0000000380)={&(0x7f0000000240)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r9 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r9, &(0x7f0000000240)={0xa, 0x4e20, 0x1000, @local}, 0x1c) r10 = accept(r6, &(0x7f0000000480)=@in={0x2, 0x0, @dev}, &(0x7f0000000300)=0x80) writev(r10, &(0x7f0000001840)=[{&(0x7f0000000680)="c8ce0d2f7d199f23f44bd2dd89f3f5d43b5d74439bfb9d837ffd9f2d1d8f70438aa17bf7890caa57252f0e0bd3e59fc1ed9a5cdcda06c1c6204b53154abd1066645beaf3be157729057ddaaab48ab49d18aeb9bee8a4642fe46efc1be3ce806f93ef0976e32032d5ae5f89c46f6d5e82589661f6d7e89010580804b0d7d6b7b9ffc3d8372dc7f16a8da2e8c311392acea050f3fa3a2f1fa03f19122071a9a084d95ad128db948e43345eec149169d4abafd381995e33be74fe343295937cf9d1a1637ecb7c10357fa7b46cb26dce5a6f7dc0fbf361745bb6b46ddb7e785aafa70b2b7742604f1fdc9ad80ee658a63e482a5ca9a0203a9b832231f9a9977da77173586f622488e2477baf3264dca137ad8c071a9bff0c1a7b70335a179ec76ed2d0e3802e0757d91b595597a78ffb7b5af1174a7c477b247f5c3857a6f145d5d95263c7bba9c2bf82a32aa48171aefa1c77176718d1033b0d1c6844d52bf895508f5a1e281b7a38184d0b037f3fc2149010db8d3f4bd9e0834e029d484a92ee84b7881388ce65d9bfe874c248c11e469cdbde79f422dedd5a1c64c656c58c49403567b5bd8b57f0470b31b01720770fd95269eb79910514a4f3d9e1ed855da8e5cfc31648a8caf150589e19123252019f3ff4513e18f3f706870b37f3a2072d9d42d980ef5bbf8473fa3ff95bb9d4623054b4481360d8f05407cc432a55348a64f9808201bee019f99d92188e153be439bb5d0b0b49bdc2a1d4b9639ccc3b2efcc0f323445a41864895aa356c6705557b7a7fcc6e969d367bbb5b8b5a8686ab02f7bff23fd467b0097e3076d81fad9fc05b6aec91fb74f146718a738eac4ba4c3ea8447e43271263059ef46cdc920ccd1ae049eba24b8fdb715ec39210fb0069e328cd3164cf63106b25c0e702eea54dc1e1365ed8e902bf90b3b890c06d284aaf7c6d1370a9a08e2d8f70e7ae07a2961eeee259d61f086d4b5084d93e5a0e7a3c95be0cf9ac3dac3047c9d505ae3e0007c31b9ee3038db4a595c4ef0e9e90b0163182c7f050a5d84a86fcf492ccdd6cded36d4bb1e7a5fc48c0c606a045a583b8a25dd24a8ef1c24b2f4e1d59329e03a387b1ae1357c55182ed028ac0a0e0d859d3929871b7f3d6a56416bd06a27ababbdbce685b8b6f73bb67128aec716ad60a7f1c22dbeb67ad053c941e401c4ced65fa060137a70ead33a77d90e55c71e1219cbcc1019ddbc6df5a4ee4f2fe3f930ca052046f14dec9763b307e49537f39db52e32a611fed4570cad94c81c8b0bf7b67c091a9270758e3e0903ffb603c3a63fe5cf0eb04e12cf24b0bdfbbb01eefbc25fdfa33b45a7244b1ccc3a7376cbb9bc0d1740179908d3e0b9888d56fa30f87e569a2ba97a4628c6a1c4e7e3496797888fb987530af8c4be1ba5100e2f86e7dfdc0d4f5ee3647ae96ec694d6750e0b34a3f35f120ec16bf63c2480e21433aaa5769e6e29bd930ffe93e167323c0faffd4ec3c2ac27cdadb647e35aff0bae4d7aef78427a1385c4768e340ed897c5ed853eab42443c29f17bafcce28229470115ef052205ae0a819d97f497198b29c856e1a11ef4936a87665305ef493a01d97024d716cddc7f90265840bb8b5de0ba24ee497a877796824199206eeaeab36d1c829cc943487990b298071a4ec88e02b6a9bcde81437af3beb5e223ac55c41f102b77ca83a2958459973e6a475fc4d980094312146276001491ea965a404879be5ac73cf815501ec019da973d5c996284516de721db81f985d411f2d2372586aaed7c48187f0404004828ace393d97daeb01417e967c53d71f8e9a70effd7fcfa5940544f98e3767443d00920c9b7fd05854538310380978b9be43c4b133c8be0b63cf4fb8871270a0538cc440a0c1165a66e7e4cd7982d3445d860dcaf65b32459f9c9bca401b6fedc1ad13cdb65d227f213ad1121d3bd767f6c87c0fac5614371c3d69b49ab98578eff10fe57bf9f1399abf3950b46d5d29229abe336099d760b7401307fb34cf46a47e785974a5a5fdfaf5a7fbe19cd59f37d08df1d9eeda216bc364e6b16b46b98c337ebcb68ddebdd3b90a73f108b2847e76d4e40908fdea050346001fadab41b7580ce4dddfea7f001d93acd6c5dcb54e2f62348534fdf8e6cff579669c00389d3c8f695dd646c7afc2d962a4e29b4be43e4aed28f9cdc8d53505d918c115a3e325c1ed9b99309129957ee586cc32ffdd0270451c13554a0b1eeb3782c46395083c885b3aac51a9a3e90fef34d2f42b01647fbcaf2ebee72f6cd61b052819cfbd9aed6eabb995618b90bd87d10f7f3225cfde570860b48c6603c6aa531d15058e79fc3cfa9c2b007336ffd68f762e03ae9fe1baca43a8e8bdb26061acfbc6406a10243a8248fdb214db93e5a702efcc14cca11cc99604a6401b5098940b7644d8b969309e6f5cf4335b0cab9f37d0770870c71eda5d802c2f4096c26d037e3680372cb2efbb57d281bd8acf6833b73d4895f6a82bbfa8044b94522b35d1ef6d36f31beb14a0af89b6ced42d18a2775e5ad801dbbb4ee8fe3447fd02caea8c1f2288b4473ab10a520a068b3d392a0a244d48c9c675377eed14e926d3f772cdd09950d839db34687c188d3ca3571b21b4a4355ffaa3955b397e2561002f74d786b5df9dbd548a09c028adf3427eec37985a2e8aeade6b5f3966d08a4bcf3853bc42c7dc69d6e8c918eff9140eb3dbc6d359432b3005a8a79ecfb2ef86e8f016719072d0928be09e1fc0927fd9e4804013c677db1a85c48e8d5eb0a5d3f116e0a179288a5769ec0525e1213d7dc46b636d1d54b90596a2966921ad0fa76514a0b07808664318cb871adb58914b3fca3ca0d13e7a9d5cc71c1f1294c575f4377a5bbbc0ef7b5dd1ad9309f39033b80b71273dc4f4e5d9eed21b4d1bb595986f5c0391d994b86989fcccb74ecbfe0b7d7f0a86076cbd5028ab1f5550069adad46bb18c4a2da7a65fb68efab8960d99c4281bf00b856d7ec92d4f3c1df6933f6743bef133aebdd0ea6cfafc479815f2cac0cbc4f0bcb6a71252ef052e770c0384802ace2c1c26740f0c88dee5b61108023820beb30cf88d3c22c427db20a6d32760df1fd19e55dc57525b87dfa22459ed2b27d6003f8fc14ad7cd7c96bd85020e4ffdbea3d686c41b260a2e0c4876e370591671477f82c81e686b29b7cb908ae970e1d71991b3a1b1a3199021839f1d83285f4059c33086b1a444cd3bca3e46f60a96b0f578fcd64a8930faa68a7c88e3f39f285cdda9115277edbe6a8c243f2e5059e0a705834526d3056659b744cd68d6648468e86f05e9a62c0d4e01290179b3ff31b2ca5c78b80b2cccd02f6ece8211b45782f249574e63f2134cd3dbdf89316f1f1bf69a1e2e42d41e103b1f45a6c59e86f31f5a0cb9e89142f94a53007ed9f3447937f777a1745ce5805bb0360da8cd6387f2815df2fc217205b9ad83d5d2d17196fcd82ce5a84b51547e87b1f4dc15047fdc41fb3780c070f8dfd1993173e0f773cd8409cb0af07b7fe92c6139a6aa2c398ea4f223449cdab85807bf372c9bde5db1467b812758544dc67f6c51bcda250249a76c595072cc8fa87c9f3404b8d220fc5f2124d174d74d15aece8719c10e9c0ffec154d7d7f1908a8b8379957cb7a2b447951688691eebd8509f929b7dbea9bc9c25eb9004b266011c697e195e7ceaac013a8cf481749e9940f33e1a853dac50172394c72dc1925623a648edcd8536fe401af4d17df5a3808be740b06f240401c088e0399fffc3a5c38ea1ba57682bab78e3f9869fd00ee745d07f796ffab136981012b0c9bcec1b269491cf2517912f98e10471e6ea08035371bbe1d2ecf7046ba15a34e45947f7adeef5a3cd48a32dad2c58328d08190ec29c59fd38e1b42a64a65caa002ef28beca0e16464d6386002b40eac237290c95009e757eb5edb463e729e555f2384e499a6dd20dcbbc35825febea4d8427ea3f269ca6beac901a0bd99f8f24e1b94d217bd1e74c874e522d409e76ef5e44a177dfbdc8016b437357c560d81b220da8c634a10846297505d6e5dd8f5302636052eaf91cd69a8301b22c2eed1c1cd4edce036fdc4db8aa6a92661acd5c1d44c0edf07a9d8062a52e00fa292e29fd881d7bfaa47aa9106398746f76bf5aff9b718733c65063eb0509ab1529a2583ede137f8cf847ebb12c51daf402b3f8da9dc5ad9b8a65616a819ea76e745069533bdd3d2eca31af0eed3911299e42e430494674d54a4943ac0680d2a6714e97576526c1f31665d41b229ab92161ab99f808aa2b1fa59bed7ecd8c9cdf5a0201e293c4e4d35ecc8d9824ba373242ad9a6b3a21ca68e72f2354c8805435d8f8f25c122404d23ddab535e8685ba88a4f96dcdf4b1335153b89101f39a14f75e7449be3c41c6a528785e74758da0fd8d55e5ffe759f8b506eaa964d0f7c9b7ae5bc1bfcea29462a45a9f8aa49f4c579463a91ee2fdab6750ced3778a956a8b3984c7625ed79248ad169fa8ee9a75262b0bf18bb0e2775235b5593ac2c5bd328760a8160ac381e145b373195c61c54e572baa2287222b26ea19bc5762ec3134074901100ffff1229673db5da66a057bb8c30c48b449cb23ad124f04f09419f2d3842e16aa57e5ef0efbfc567bd0e123fdb4c9846da83c9ebac64802e8b1bbb4d6d4667b9bb13753c97ed6691c61aad277971a262c9fb00917bfa5d086b744cd591f32febb400b9c32403ad86a35319b901c973edfe4dca721168d0778fb2c0732a5185049e15224c5c89ed972065e13a381f6da779c5bbe0d03c729caa4004f52ec897ae480f0c5e5d3967ccd06f6886c869e3053c10c5ece8f13913b52293549e27f3de10aaab9ec2933c89a6eaf51ea3f790179ccd37ec8c3dac6ee6af072b7dd2cdc08142c87d6a84ca99821139637b786ee1b296313bebf6bb3348f24b41028e8e90f676928fbc5945300994dee09d91d5d2edf07ab0a9cae3e3db60c985e589b8e1073f402ce4e28789c378b85e8738dd53f1d945ae53dbc5ce12d337b4981a2babc5677c10d65e91d1097f1e6e4548e42d67569eda9d026e0539358ffd90cdac80a0f8c632418ae7961994138fbac13c755f8a4a0206d00a2d584ac46850582e9aaef2642f462c8a6b31b1136c0c235a2f2fbdbabe39db56793300c0e43c1ab2318c4c23876e68602dd3dd82b28f9902b879b0f73b81b102e72006486079247c080a0f4e9fa21ddaa26e5dace2eb7a073ff246c0e728d3b3752af560dc633eda5533071fbe7173840449f588dd89ddd1435f0d92362801d2d9161e8c1e209675590af8c176e5e4a004270d6c917c937dbd6aadeb9e7df3d1ef87b148762d13b7c24b127b4b19a458cc8b2dc37a45fd44c7087c639b81778eb4e597a12e6908988a8b10eea0e685708beb66b8a96f3a439ece77d51dab9cd5bf941cc092fe5749e32d7a80051853dcd4a590f11b2e5559f01c5332985632d9f1d8b9c14cd19c2ce2f4bd7a3ac2cc37c73c6b89a0b5e89e091e77dd1194c65b1687ecfe81b273dd1643a5f952ac9f6c1d94e0273955de7d7c2d8cde9f82cb71cba220b214a5be85b7b832741c3f2f38a63a3abf4929ed117b56d4815f0873956a552ed0d734707fa55514921c70166ad4db0c3098fbd0e6531aeee8f0fae40f2f444deab6a5208c19536b6cf0708fcea2487ea55488039cb16acfe4a9681ff75627bb620bb970718d67154cae32b97c77da7dd0eb6dbe2a538f82ff0788c5123e7b9358414c12bdc609d1face204c1110c61efa1ca7", 0x1000}, {&(0x7f0000001680)="20bd4bd996a2b9b97e36a8ba38fdcb391460079176f1ccde5372fd5d23d42936d4a72a29cffb36b7356e16d6a4e73660305c7f167adebb9d6a90184984aff01ebb396cce15879b4a9a74", 0x4a}, {&(0x7f0000001700)="e09464709a88b37025976495a55b44ca97a1446ce18097541aa5a65223deb807025f1d74f4be202a6a628b60b6af6dd6e234e44103357bec495d90f0ffa310a15887c06dba03c78c93dec71b689adcfa8fa0af6310d3cbf7c78f9dd49bf16cb3ae0272a03e7656595b12e30cc7007a50a7d905ca4aa7eda17276efa890df1e79040ca6c1b86f87c743c165b4d49e4d86c1af63d328fc7581e62fa76d3b59332a48145e5baf41717b0dca5c340470e21e1e551cd49c0722cff225", 0xba}, {&(0x7f00000017c0)="3d1ab31c30f443e23330bd36a7e1c6eac8244eb5bb35e700ff848448e154909ce92b70da9675494ff243cd27c7c2e5f8e95bd3e9ae3fdd93f8018e0892a0350bbf81511d397c2ea9da5354861386b1531e8f5c", 0x53}], 0x4) executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x8c800) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4011}, 0x8894) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000200)={0x43, 0x2, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc8045}, 0x40011) r4 = socket$inet(0x2, 0x2, 0x1) connect$inet(r4, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000000540)=[{{0x0, 0x2, &(0x7f0000000000)=[{&(0x7f00000000c0)="08001497733f5d3e", 0x6c6d}], 0x5}}, {{0x0, 0x0, &(0x7f0000000440), 0x56}}], 0x2, 0x2004000) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x10, r6}, 0x14) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000010c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x1e7d, 0x3232, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xb0, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x8, 0xc, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0xe, 0xff}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x6, 0x10, 0xf2}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000280)={0xffffffffffffff4c, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x9, {0x9, 0x21, 0x0, 0x1e, 0x1, {0x22, 0xc7b}}}}, &(0x7f00000002c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock2(&(0x7f0000381000/0x4000)=nil, 0x4000, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r8 = memfd_secret(0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r8, 0x8000000) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r8, 0x8000000) executing program 1: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f0000000000)={0x40, 0x1e, 0x11, {0x11, 0x5, "7c31a8501c7cae483acbb3a2e816f9"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x813}}}, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac2(0x6, 0x7b, &(0x7f0000000840)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x17cc, 0x1021, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x7c, 0xa0, 0x7, {0x8, 0xb, 0x1, 0x2, 0x1, 0x0, 0x20, 0xb}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x1, 0x9, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x0, 0x4, 0x1, {0x8, 0x25, 0x1, 0x80, 0x30, 0xa, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xfb, 0x6, 0x4, {0x8, 0x25, 0x1, 0x87, 0x3c, 0xba, 0x2}}}}}}}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8380, 0x1850, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xa, 0x3, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x10, 0x16, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f00000003c0)={0x4d, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fddbdf2501000000000000000b"], 0x30}}, 0x8040) syslog(0x4, &(0x7f00000001c0), 0x0) syslog(0x0, &(0x7f0000000000)=""/189, 0xbd) r2 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1100000000000000000000000100000009080000000000001100000000000000000000000100000066000000000000001400000000000000000f0000010000000000000000000000800000000000000000000000070000000094040000940d2d1c43cc0ca0e3fc210e8f442c8db00000000900000001000000090000000100000003000000030003000000000005000000060000000086320000000200053b0f9d010537e4e6001157baa9e1e7cdd042b885e449df815b01118585a5695aa2806de62b5ea462c7ed1c000000000000000000000008"], 0xe8}, 0x400c804) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x2c, &(0x7f0000000140)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r5, &(0x7f0000016440)={0x2020}, 0x2020) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x2}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETSNDBUF(r10, 0x400454d4, &(0x7f0000000380)=0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) pselect6(0x40, &(0x7f0000000800)={0x2, 0x9, 0xa, 0x7fff, 0x0, 0xbea, 0x1, 0x8000000000000000}, &(0x7f0000000840)={0x9, 0xec15, 0x0, 0x4, 0xe, 0x200, 0x9, 0xffc7}, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) splice(r8, 0x0, r7, 0x0, 0x1, 0x0) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000600)="06", 0x1}], 0x1, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r7, &(0x7f0000000100)={0x28, 0x2, 0x0, {0x1, 0x0, 0x54c1}}, 0x28) write$binfmt_script(r9, &(0x7f0000000240)={'#! ', './file0', [], 0xa, '9Kb_'}, 0xf) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000000)=0x20) syslog(0x2, 0x0, 0x0) truncate(&(0x7f0000000340)='./file1\x00', 0x9) setsockopt$sock_int(r3, 0x1, 0x1b, &(0x7f0000000000)=0x4, 0x1c) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x6c) fcntl$setlease(r0, 0x400, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000180), 0x8, &(0x7f0000000240)={[], [{@subj_role={'subj_role', 0x3d, 'security.capability\x00'}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_user={'obj_user', 0x3d, '/proc/tty/ldiscs\x00'}}, {@fsname={'fsname', 0x3d, '-++\xba][\x96{$b,&'}}, {@context={'context', 0x3d, 'root'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f00000002c0)={0x1, r2}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/tty/ldiscs\x00', 0x0, 0x0) lseek(r3, 0xfffffffffffffff5, 0x1) lsetxattr$security_capability(&(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0), &(0x7f0000000140)=@v2={0x2000000, [{0x6, 0x6}, {0xfffffff9, 0x101}]}, 0x14, 0x2) executing program 32: r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 64) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x1c37, 0x4) executing program 33: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="747d8d5b079413e134", 0x9}], 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) getsockname$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000140)=0x1c) syz_usb_connect(0x0, 0x51, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000cc2e3f2063072110c08e0000000109023f0001000000000904880005ffb717000905adda0000020154090501000004007f070905020c200009027e09050f042000410f04090505"], 0x0) executing program 34: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000001b00)={0x26, &(0x7f0000001700)=ANY=[@ANYBLOB="001800000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0) (async) syz_usb_control_io$uac3(r0, 0x0, 0x0) executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) clock_settime(0xfffffffb, &(0x7f0000000140)) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x4, [{0x11}, {0x0, 0x100000000000000}]}, 0x68) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x2}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x44004) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0x2, 0x1, 0x0, 0x8}, 0x20) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8000000, 0x1, 0x2, 0x5, 0x0, 0x4005}, 0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r5, 0x29, 0x41, &(0x7f0000000080)=ANY=[], &(0x7f0000000180)=0x2c) (async) getsockopt$IP6T_SO_GET_ENTRIES(r5, 0x29, 0x41, &(0x7f0000000080)=ANY=[], &(0x7f0000000180)=0x2c) socket$inet6(0xa, 0x2, 0x0) (async) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r6, 0x29, 0x43, &(0x7f0000000180)=0xffffffff, 0x4) (async) setsockopt$inet6_int(r6, 0x29, 0x43, &(0x7f0000000180)=0xffffffff, 0x4) r7 = syz_clone(0x1a304200, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r7, 0x7, 0x0, &(0x7f0000000040)) (async) prlimit64(r7, 0x7, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) (async) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x14, r8, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) executing program 3: socket$inet(0x2, 0x3, 0x8) mkdir(&(0x7f0000000040)='./file0\x00', 0x109) r0 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f00004a4000/0x800000)=nil, 0x800000, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'veth1_virt_wifi\x00', &(0x7f00000002c0)=@ethtool_cmd={0x49, 0x100, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x8000001b}}) ftruncate(r0, 0x51a9497) futex(&(0x7f0000000340), 0xd, 0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) fadvise64(r2, 0x4, 0x4, 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000400)='ramfs\x00', 0x2800000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000000)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) setxattr$trusted_overlay_origin(&(0x7f0000000140)='./bus\x00', &(0x7f0000000180), &(0x7f0000000240), 0x2, 0x3) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) executing program 3: openat$tun(0xffffffffffffff9c, 0x0, 0x604040, 0x0) keyctl$set_reqkey_keyring(0xe, 0x7) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='.^$\'#{@\\\x00', 0x0) syz_usb_connect$uac2(0x0, 0xbd, &(0x7f0000000000)={{0x12, 0x1, 0x111, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x17a0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xab, 0x3, 0x1, 0x80, 0xc0, 0x8, {0x8, 0xb, 0x41, 0x1, 0x1, 0x6, 0x20, 0x2e}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x8, 0x42, 0x2}, [@sample_rate={0xd, 0x24, 0xd, 0x2, 0x1, 0x2, [0x3, 0x1, 0x1]}, @output_terminal={0xc, 0x24, 0x3, 0x3, 0x306, 0x8, 0x5, 0x12, 0x5, 0x1}, @effect_unit={0xf, 0x24, 0x7, 0x6, 0x1, 0x6, [0x3, 0x2, 0x0, 0x1]}, @processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x2, 0x1, 0x0, 0x1, 0x0, 0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x8a, 0x9, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0xc9, 0x5, {0x8, 0x25, 0x1, 0x181, 0x3f, 0x4, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x1, 0x1, 0xe, {0x8, 0x25, 0x1, 0x3, 0xf, 0x3, 0x7}}}}}}}}]}}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x604040, 0x0) (async) keyctl$set_reqkey_keyring(0xe, 0x7) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f00000000c0)='.^$\'#{@\\\x00', 0x0) (async) syz_usb_connect$uac2(0x0, 0xbd, &(0x7f0000000000)={{0x12, 0x1, 0x111, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x17a0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xab, 0x3, 0x1, 0x80, 0xc0, 0x8, {0x8, 0xb, 0x41, 0x1, 0x1, 0x6, 0x20, 0x2e}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x8, 0x42, 0x2}, [@sample_rate={0xd, 0x24, 0xd, 0x2, 0x1, 0x2, [0x3, 0x1, 0x1]}, @output_terminal={0xc, 0x24, 0x3, 0x3, 0x306, 0x8, 0x5, 0x12, 0x5, 0x1}, @effect_unit={0xf, 0x24, 0x7, 0x6, 0x1, 0x6, [0x3, 0x2, 0x0, 0x1]}, @processing_unit={0x11, 0x24, 0x8, 0x3, 0x6, [0x2, 0x1, 0x0, 0x1, 0x0, 0x2]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x8a, 0x9, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0xc9, 0x5, {0x8, 0x25, 0x1, 0x181, 0x3f, 0x4, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x1, 0x1, 0xe, {0x8, 0x25, 0x1, 0x3, 0xf, 0x3, 0x7}}}}}}}}]}}, 0x0) (async) executing program 3: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) executing program 35: socket$tipc(0x1e, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) program crashed: INFO: task hung in rtnl_lock bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 9, 29, 30, 7, 6, 30, 18] detailed listing: executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e21}, 0x6e) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') pread64(r3, &(0x7f0000000480)=""/177, 0xb1, 0x2) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f00000000c0)={@private=0xa010101, @broadcast}, 0x8) ppoll(&(0x7f0000000040)=[{r0, 0x5008}], 0x1, 0x0, 0x0, 0x0) executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x400000, 0xffffffff}}, 0xffffffffffffff56) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r6, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$sock_linger(r6, 0x1, 0x3d, &(0x7f00000001c0)={0x0, 0x8}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) bind$tipc(r5, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r8, &(0x7f0000000380)={&(0x7f0000000240)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r9 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r9, &(0x7f0000000240)={0xa, 0x4e20, 0x1000, @local}, 0x1c) r10 = accept(r6, &(0x7f0000000480)=@in={0x2, 0x0, @dev}, &(0x7f0000000300)=0x80) writev(r10, &(0x7f0000001840)=[{&(0x7f0000000680)="c8ce0d2f7d199f23f44bd2dd89f3f5d43b5d74439bfb9d837ffd9f2d1d8f70438aa17bf7890caa57252f0e0bd3e59fc1ed9a5cdcda06c1c6204b53154abd1066645beaf3be157729057ddaaab48ab49d18aeb9bee8a4642fe46efc1be3ce806f93ef0976e32032d5ae5f89c46f6d5e82589661f6d7e89010580804b0d7d6b7b9ffc3d8372dc7f16a8da2e8c311392acea050f3fa3a2f1fa03f19122071a9a084d95ad128db948e43345eec149169d4abafd381995e33be74fe343295937cf9d1a1637ecb7c10357fa7b46cb26dce5a6f7dc0fbf361745bb6b46ddb7e785aafa70b2b7742604f1fdc9ad80ee658a63e482a5ca9a0203a9b832231f9a9977da77173586f622488e2477baf3264dca137ad8c071a9bff0c1a7b70335a179ec76ed2d0e3802e0757d91b595597a78ffb7b5af1174a7c477b247f5c3857a6f145d5d95263c7bba9c2bf82a32aa48171aefa1c77176718d1033b0d1c6844d52bf895508f5a1e281b7a38184d0b037f3fc2149010db8d3f4bd9e0834e029d484a92ee84b7881388ce65d9bfe874c248c11e469cdbde79f422dedd5a1c64c656c58c49403567b5bd8b57f0470b31b01720770fd95269eb79910514a4f3d9e1ed855da8e5cfc31648a8caf150589e19123252019f3ff4513e18f3f706870b37f3a2072d9d42d980ef5bbf8473fa3ff95bb9d4623054b4481360d8f05407cc432a55348a64f9808201bee019f99d92188e153be439bb5d0b0b49bdc2a1d4b9639ccc3b2efcc0f323445a41864895aa356c6705557b7a7fcc6e969d367bbb5b8b5a8686ab02f7bff23fd467b0097e3076d81fad9fc05b6aec91fb74f146718a738eac4ba4c3ea8447e43271263059ef46cdc920ccd1ae049eba24b8fdb715ec39210fb0069e328cd3164cf63106b25c0e702eea54dc1e1365ed8e902bf90b3b890c06d284aaf7c6d1370a9a08e2d8f70e7ae07a2961eeee259d61f086d4b5084d93e5a0e7a3c95be0cf9ac3dac3047c9d505ae3e0007c31b9ee3038db4a595c4ef0e9e90b0163182c7f050a5d84a86fcf492ccdd6cded36d4bb1e7a5fc48c0c606a045a583b8a25dd24a8ef1c24b2f4e1d59329e03a387b1ae1357c55182ed028ac0a0e0d859d3929871b7f3d6a56416bd06a27ababbdbce685b8b6f73bb67128aec716ad60a7f1c22dbeb67ad053c941e401c4ced65fa060137a70ead33a77d90e55c71e1219cbcc1019ddbc6df5a4ee4f2fe3f930ca052046f14dec9763b307e49537f39db52e32a611fed4570cad94c81c8b0bf7b67c091a9270758e3e0903ffb603c3a63fe5cf0eb04e12cf24b0bdfbbb01eefbc25fdfa33b45a7244b1ccc3a7376cbb9bc0d1740179908d3e0b9888d56fa30f87e569a2ba97a4628c6a1c4e7e3496797888fb987530af8c4be1ba5100e2f86e7dfdc0d4f5ee3647ae96ec694d6750e0b34a3f35f120ec16bf63c2480e21433aaa5769e6e29bd930ffe93e167323c0faffd4ec3c2ac27cdadb647e35aff0bae4d7aef78427a1385c4768e340ed897c5ed853eab42443c29f17bafcce28229470115ef052205ae0a819d97f497198b29c856e1a11ef4936a87665305ef493a01d97024d716cddc7f90265840bb8b5de0ba24ee497a877796824199206eeaeab36d1c829cc943487990b298071a4ec88e02b6a9bcde81437af3beb5e223ac55c41f102b77ca83a2958459973e6a475fc4d980094312146276001491ea965a404879be5ac73cf815501ec019da973d5c996284516de721db81f985d411f2d2372586aaed7c48187f0404004828ace393d97daeb01417e967c53d71f8e9a70effd7fcfa5940544f98e3767443d00920c9b7fd05854538310380978b9be43c4b133c8be0b63cf4fb8871270a0538cc440a0c1165a66e7e4cd7982d3445d860dcaf65b32459f9c9bca401b6fedc1ad13cdb65d227f213ad1121d3bd767f6c87c0fac5614371c3d69b49ab98578eff10fe57bf9f1399abf3950b46d5d29229abe336099d760b7401307fb34cf46a47e785974a5a5fdfaf5a7fbe19cd59f37d08df1d9eeda216bc364e6b16b46b98c337ebcb68ddebdd3b90a73f108b2847e76d4e40908fdea050346001fadab41b7580ce4dddfea7f001d93acd6c5dcb54e2f62348534fdf8e6cff579669c00389d3c8f695dd646c7afc2d962a4e29b4be43e4aed28f9cdc8d53505d918c115a3e325c1ed9b99309129957ee586cc32ffdd0270451c13554a0b1eeb3782c46395083c885b3aac51a9a3e90fef34d2f42b01647fbcaf2ebee72f6cd61b052819cfbd9aed6eabb995618b90bd87d10f7f3225cfde570860b48c6603c6aa531d15058e79fc3cfa9c2b007336ffd68f762e03ae9fe1baca43a8e8bdb26061acfbc6406a10243a8248fdb214db93e5a702efcc14cca11cc99604a6401b5098940b7644d8b969309e6f5cf4335b0cab9f37d0770870c71eda5d802c2f4096c26d037e3680372cb2efbb57d281bd8acf6833b73d4895f6a82bbfa8044b94522b35d1ef6d36f31beb14a0af89b6ced42d18a2775e5ad801dbbb4ee8fe3447fd02caea8c1f2288b4473ab10a520a068b3d392a0a244d48c9c675377eed14e926d3f772cdd09950d839db34687c188d3ca3571b21b4a4355ffaa3955b397e2561002f74d786b5df9dbd548a09c028adf3427eec37985a2e8aeade6b5f3966d08a4bcf3853bc42c7dc69d6e8c918eff9140eb3dbc6d359432b3005a8a79ecfb2ef86e8f016719072d0928be09e1fc0927fd9e4804013c677db1a85c48e8d5eb0a5d3f116e0a179288a5769ec0525e1213d7dc46b636d1d54b90596a2966921ad0fa76514a0b07808664318cb871adb58914b3fca3ca0d13e7a9d5cc71c1f1294c575f4377a5bbbc0ef7b5dd1ad9309f39033b80b71273dc4f4e5d9eed21b4d1bb595986f5c0391d994b86989fcccb74ecbfe0b7d7f0a86076cbd5028ab1f5550069adad46bb18c4a2da7a65fb68efab8960d99c4281bf00b856d7ec92d4f3c1df6933f6743bef133aebdd0ea6cfafc479815f2cac0cbc4f0bcb6a71252ef052e770c0384802ace2c1c26740f0c88dee5b61108023820beb30cf88d3c22c427db20a6d32760df1fd19e55dc57525b87dfa22459ed2b27d6003f8fc14ad7cd7c96bd85020e4ffdbea3d686c41b260a2e0c4876e370591671477f82c81e686b29b7cb908ae970e1d71991b3a1b1a3199021839f1d83285f4059c33086b1a444cd3bca3e46f60a96b0f578fcd64a8930faa68a7c88e3f39f285cdda9115277edbe6a8c243f2e5059e0a705834526d3056659b744cd68d6648468e86f05e9a62c0d4e01290179b3ff31b2ca5c78b80b2cccd02f6ece8211b45782f249574e63f2134cd3dbdf89316f1f1bf69a1e2e42d41e103b1f45a6c59e86f31f5a0cb9e89142f94a53007ed9f3447937f777a1745ce5805bb0360da8cd6387f2815df2fc217205b9ad83d5d2d17196fcd82ce5a84b51547e87b1f4dc15047fdc41fb3780c070f8dfd1993173e0f773cd8409cb0af07b7fe92c6139a6aa2c398ea4f223449cdab85807bf372c9bde5db1467b812758544dc67f6c51bcda250249a76c595072cc8fa87c9f3404b8d220fc5f2124d174d74d15aece8719c10e9c0ffec154d7d7f1908a8b8379957cb7a2b447951688691eebd8509f929b7dbea9bc9c25eb9004b266011c697e195e7ceaac013a8cf481749e9940f33e1a853dac50172394c72dc1925623a648edcd8536fe401af4d17df5a3808be740b06f240401c088e0399fffc3a5c38ea1ba57682bab78e3f9869fd00ee745d07f796ffab136981012b0c9bcec1b269491cf2517912f98e10471e6ea08035371bbe1d2ecf7046ba15a34e45947f7adeef5a3cd48a32dad2c58328d08190ec29c59fd38e1b42a64a65caa002ef28beca0e16464d6386002b40eac237290c95009e757eb5edb463e729e555f2384e499a6dd20dcbbc35825febea4d8427ea3f269ca6beac901a0bd99f8f24e1b94d217bd1e74c874e522d409e76ef5e44a177dfbdc8016b437357c560d81b220da8c634a10846297505d6e5dd8f5302636052eaf91cd69a8301b22c2eed1c1cd4edce036fdc4db8aa6a92661acd5c1d44c0edf07a9d8062a52e00fa292e29fd881d7bfaa47aa9106398746f76bf5aff9b718733c65063eb0509ab1529a2583ede137f8cf847ebb12c51daf402b3f8da9dc5ad9b8a65616a819ea76e745069533bdd3d2eca31af0eed3911299e42e430494674d54a4943ac0680d2a6714e97576526c1f31665d41b229ab92161ab99f808aa2b1fa59bed7ecd8c9cdf5a0201e293c4e4d35ecc8d9824ba373242ad9a6b3a21ca68e72f2354c8805435d8f8f25c122404d23ddab535e8685ba88a4f96dcdf4b1335153b89101f39a14f75e7449be3c41c6a528785e74758da0fd8d55e5ffe759f8b506eaa964d0f7c9b7ae5bc1bfcea29462a45a9f8aa49f4c579463a91ee2fdab6750ced3778a956a8b3984c7625ed79248ad169fa8ee9a75262b0bf18bb0e2775235b5593ac2c5bd328760a8160ac381e145b373195c61c54e572baa2287222b26ea19bc5762ec3134074901100ffff1229673db5da66a057bb8c30c48b449cb23ad124f04f09419f2d3842e16aa57e5ef0efbfc567bd0e123fdb4c9846da83c9ebac64802e8b1bbb4d6d4667b9bb13753c97ed6691c61aad277971a262c9fb00917bfa5d086b744cd591f32febb400b9c32403ad86a35319b901c973edfe4dca721168d0778fb2c0732a5185049e15224c5c89ed972065e13a381f6da779c5bbe0d03c729caa4004f52ec897ae480f0c5e5d3967ccd06f6886c869e3053c10c5ece8f13913b52293549e27f3de10aaab9ec2933c89a6eaf51ea3f790179ccd37ec8c3dac6ee6af072b7dd2cdc08142c87d6a84ca99821139637b786ee1b296313bebf6bb3348f24b41028e8e90f676928fbc5945300994dee09d91d5d2edf07ab0a9cae3e3db60c985e589b8e1073f402ce4e28789c378b85e8738dd53f1d945ae53dbc5ce12d337b4981a2babc5677c10d65e91d1097f1e6e4548e42d67569eda9d026e0539358ffd90cdac80a0f8c632418ae7961994138fbac13c755f8a4a0206d00a2d584ac46850582e9aaef2642f462c8a6b31b1136c0c235a2f2fbdbabe39db56793300c0e43c1ab2318c4c23876e68602dd3dd82b28f9902b879b0f73b81b102e72006486079247c080a0f4e9fa21ddaa26e5dace2eb7a073ff246c0e728d3b3752af560dc633eda5533071fbe7173840449f588dd89ddd1435f0d92362801d2d9161e8c1e209675590af8c176e5e4a004270d6c917c937dbd6aadeb9e7df3d1ef87b148762d13b7c24b127b4b19a458cc8b2dc37a45fd44c7087c639b81778eb4e597a12e6908988a8b10eea0e685708beb66b8a96f3a439ece77d51dab9cd5bf941cc092fe5749e32d7a80051853dcd4a590f11b2e5559f01c5332985632d9f1d8b9c14cd19c2ce2f4bd7a3ac2cc37c73c6b89a0b5e89e091e77dd1194c65b1687ecfe81b273dd1643a5f952ac9f6c1d94e0273955de7d7c2d8cde9f82cb71cba220b214a5be85b7b832741c3f2f38a63a3abf4929ed117b56d4815f0873956a552ed0d734707fa55514921c70166ad4db0c3098fbd0e6531aeee8f0fae40f2f444deab6a5208c19536b6cf0708fcea2487ea55488039cb16acfe4a9681ff75627bb620bb970718d67154cae32b97c77da7dd0eb6dbe2a538f82ff0788c5123e7b9358414c12bdc609d1face204c1110c61efa1ca7", 0x1000}, {&(0x7f0000001680)="20bd4bd996a2b9b97e36a8ba38fdcb391460079176f1ccde5372fd5d23d42936d4a72a29cffb36b7356e16d6a4e73660305c7f167adebb9d6a90184984aff01ebb396cce15879b4a9a74", 0x4a}, {&(0x7f0000001700)="e09464709a88b37025976495a55b44ca97a1446ce18097541aa5a65223deb807025f1d74f4be202a6a628b60b6af6dd6e234e44103357bec495d90f0ffa310a15887c06dba03c78c93dec71b689adcfa8fa0af6310d3cbf7c78f9dd49bf16cb3ae0272a03e7656595b12e30cc7007a50a7d905ca4aa7eda17276efa890df1e79040ca6c1b86f87c743c165b4d49e4d86c1af63d328fc7581e62fa76d3b59332a48145e5baf41717b0dca5c340470e21e1e551cd49c0722cff225", 0xba}, {&(0x7f00000017c0)="3d1ab31c30f443e23330bd36a7e1c6eac8244eb5bb35e700ff848448e154909ce92b70da9675494ff243cd27c7c2e5f8e95bd3e9ae3fdd93f8018e0892a0350bbf81511d397c2ea9da5354861386b1531e8f5c", 0x53}], 0x4) executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x8c800) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4011}, 0x8894) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000200)={0x43, 0x2, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc8045}, 0x40011) r4 = socket$inet(0x2, 0x2, 0x1) connect$inet(r4, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000000540)=[{{0x0, 0x2, &(0x7f0000000000)=[{&(0x7f00000000c0)="08001497733f5d3e", 0x6c6d}], 0x5}}, {{0x0, 0x0, &(0x7f0000000440), 0x56}}], 0x2, 0x2004000) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x10, r6}, 0x14) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000010c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x1e7d, 0x3232, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xb0, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x8, 0xc, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0xe, 0xff}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x6, 0x10, 0xf2}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000280)={0xffffffffffffff4c, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x9, {0x9, 0x21, 0x0, 0x1e, 0x1, {0x22, 0xc7b}}}}, &(0x7f00000002c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock2(&(0x7f0000381000/0x4000)=nil, 0x4000, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r8 = memfd_secret(0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r8, 0x8000000) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r8, 0x8000000) executing program 1: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f0000000000)={0x40, 0x1e, 0x11, {0x11, 0x5, "7c31a8501c7cae483acbb3a2e816f9"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x813}}}, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac2(0x6, 0x7b, &(0x7f0000000840)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x17cc, 0x1021, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x7c, 0xa0, 0x7, {0x8, 0xb, 0x1, 0x2, 0x1, 0x0, 0x20, 0xb}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x1, 0x9, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x0, 0x4, 0x1, {0x8, 0x25, 0x1, 0x80, 0x30, 0xa, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xfb, 0x6, 0x4, {0x8, 0x25, 0x1, 0x87, 0x3c, 0xba, 0x2}}}}}}}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8380, 0x1850, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xa, 0x3, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x10, 0x16, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f00000003c0)={0x4d, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fddbdf2501000000000000000b"], 0x30}}, 0x8040) syslog(0x4, &(0x7f00000001c0), 0x0) syslog(0x0, &(0x7f0000000000)=""/189, 0xbd) r2 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1100000000000000000000000100000009080000000000001100000000000000000000000100000066000000000000001400000000000000000f0000010000000000000000000000800000000000000000000000070000000094040000940d2d1c43cc0ca0e3fc210e8f442c8db00000000900000001000000090000000100000003000000030003000000000005000000060000000086320000000200053b0f9d010537e4e6001157baa9e1e7cdd042b885e449df815b01118585a5695aa2806de62b5ea462c7ed1c000000000000000000000008"], 0xe8}, 0x400c804) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x2c, &(0x7f0000000140)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r5, &(0x7f0000016440)={0x2020}, 0x2020) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x2}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETSNDBUF(r10, 0x400454d4, &(0x7f0000000380)=0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) pselect6(0x40, &(0x7f0000000800)={0x2, 0x9, 0xa, 0x7fff, 0x0, 0xbea, 0x1, 0x8000000000000000}, &(0x7f0000000840)={0x9, 0xec15, 0x0, 0x4, 0xe, 0x200, 0x9, 0xffc7}, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) splice(r8, 0x0, r7, 0x0, 0x1, 0x0) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000600)="06", 0x1}], 0x1, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r7, &(0x7f0000000100)={0x28, 0x2, 0x0, {0x1, 0x0, 0x54c1}}, 0x28) write$binfmt_script(r9, &(0x7f0000000240)={'#! ', './file0', [], 0xa, '9Kb_'}, 0xf) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000000)=0x20) syslog(0x2, 0x0, 0x0) truncate(&(0x7f0000000340)='./file1\x00', 0x9) setsockopt$sock_int(r3, 0x1, 0x1b, &(0x7f0000000000)=0x4, 0x1c) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x6c) fcntl$setlease(r0, 0x400, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000180), 0x8, &(0x7f0000000240)={[], [{@subj_role={'subj_role', 0x3d, 'security.capability\x00'}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_user={'obj_user', 0x3d, '/proc/tty/ldiscs\x00'}}, {@fsname={'fsname', 0x3d, '-++\xba][\x96{$b,&'}}, {@context={'context', 0x3d, 'root'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f00000002c0)={0x1, r2}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/tty/ldiscs\x00', 0x0, 0x0) lseek(r3, 0xfffffffffffffff5, 0x1) lsetxattr$security_capability(&(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0), &(0x7f0000000140)=@v2={0x2000000, [{0x6, 0x6}, {0xfffffff9, 0x101}]}, 0x14, 0x2) program crashed: INFO: task hung in rtnl_lock bisect: the chunk can be dropped bisect: split chunks (needed=true): <8> bisect: split chunk #0 of len 8 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 6, 30, 18] detailed listing: executing program 1: r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f0000000000)={0x40, 0x1e, 0x11, {0x11, 0x5, "7c31a8501c7cae483acbb3a2e816f9"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x813}}}, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac2(0x6, 0x7b, &(0x7f0000000840)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x17cc, 0x1021, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x7c, 0xa0, 0x7, {0x8, 0xb, 0x1, 0x2, 0x1, 0x0, 0x20, 0xb}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x3, 0x1, 0x9, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x0, 0x4, 0x1, {0x8, 0x25, 0x1, 0x80, 0x30, 0xa, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xfb, 0x6, 0x4, {0x8, 0x25, 0x1, 0x87, 0x3c, 0xba, 0x2}}}}}}}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8380, 0x1850, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xa, 0x3, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x10, 0x16, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f00000003c0)={0x4d, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fddbdf2501000000000000000b"], 0x30}}, 0x8040) syslog(0x4, &(0x7f00000001c0), 0x0) syslog(0x0, &(0x7f0000000000)=""/189, 0xbd) r2 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1100000000000000000000000100000009080000000000001100000000000000000000000100000066000000000000001400000000000000000f0000010000000000000000000000800000000000000000000000070000000094040000940d2d1c43cc0ca0e3fc210e8f442c8db00000000900000001000000090000000100000003000000030003000000000005000000060000000086320000000200053b0f9d010537e4e6001157baa9e1e7cdd042b885e449df815b01118585a5695aa2806de62b5ea462c7ed1c000000000000000000000008"], 0xe8}, 0x400c804) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x2c, &(0x7f0000000140)=0x1, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r5, &(0x7f0000016440)={0x2020}, 0x2020) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x2}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETSNDBUF(r10, 0x400454d4, &(0x7f0000000380)=0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) pselect6(0x40, &(0x7f0000000800)={0x2, 0x9, 0xa, 0x7fff, 0x0, 0xbea, 0x1, 0x8000000000000000}, &(0x7f0000000840)={0x9, 0xec15, 0x0, 0x4, 0xe, 0x200, 0x9, 0xffc7}, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) splice(r8, 0x0, r7, 0x0, 0x1, 0x0) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000600)="06", 0x1}], 0x1, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r7, &(0x7f0000000100)={0x28, 0x2, 0x0, {0x1, 0x0, 0x54c1}}, 0x28) write$binfmt_script(r9, &(0x7f0000000240)={'#! ', './file0', [], 0xa, '9Kb_'}, 0xf) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000000)=0x20) syslog(0x2, 0x0, 0x0) truncate(&(0x7f0000000340)='./file1\x00', 0x9) setsockopt$sock_int(r3, 0x1, 0x1b, &(0x7f0000000000)=0x4, 0x1c) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x6c) fcntl$setlease(r0, 0x400, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000180), 0x8, &(0x7f0000000240)={[], [{@subj_role={'subj_role', 0x3d, 'security.capability\x00'}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_user={'obj_user', 0x3d, '/proc/tty/ldiscs\x00'}}, {@fsname={'fsname', 0x3d, '-++\xba][\x96{$b,&'}}, {@context={'context', 0x3d, 'root'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f00000002c0)={0x1, r2}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/tty/ldiscs\x00', 0x0, 0x0) lseek(r3, 0xfffffffffffffff5, 0x1) lsetxattr$security_capability(&(0x7f0000000000)='./cgroup\x00', &(0x7f00000000c0), &(0x7f0000000140)=@v2={0x2000000, [{0x6, 0x6}, {0xfffffff9, 0x101}]}, 0x14, 0x2) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 9, 29, 30] detailed listing: executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e21}, 0x6e) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') pread64(r3, &(0x7f0000000480)=""/177, 0xb1, 0x2) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f00000000c0)={@private=0xa010101, @broadcast}, 0x8) ppoll(&(0x7f0000000040)=[{r0, 0x5008}], 0x1, 0x0, 0x0, 0x0) executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x400000, 0xffffffff}}, 0xffffffffffffff56) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r6, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$sock_linger(r6, 0x1, 0x3d, &(0x7f00000001c0)={0x0, 0x8}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) bind$tipc(r5, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r8, &(0x7f0000000380)={&(0x7f0000000240)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r9 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r9, &(0x7f0000000240)={0xa, 0x4e20, 0x1000, @local}, 0x1c) r10 = accept(r6, &(0x7f0000000480)=@in={0x2, 0x0, @dev}, &(0x7f0000000300)=0x80) writev(r10, &(0x7f0000001840)=[{&(0x7f0000000680)="c8ce0d2f7d199f23f44bd2dd89f3f5d43b5d74439bfb9d837ffd9f2d1d8f70438aa17bf7890caa57252f0e0bd3e59fc1ed9a5cdcda06c1c6204b53154abd1066645beaf3be157729057ddaaab48ab49d18aeb9bee8a4642fe46efc1be3ce806f93ef0976e32032d5ae5f89c46f6d5e82589661f6d7e89010580804b0d7d6b7b9ffc3d8372dc7f16a8da2e8c311392acea050f3fa3a2f1fa03f19122071a9a084d95ad128db948e43345eec149169d4abafd381995e33be74fe343295937cf9d1a1637ecb7c10357fa7b46cb26dce5a6f7dc0fbf361745bb6b46ddb7e785aafa70b2b7742604f1fdc9ad80ee658a63e482a5ca9a0203a9b832231f9a9977da77173586f622488e2477baf3264dca137ad8c071a9bff0c1a7b70335a179ec76ed2d0e3802e0757d91b595597a78ffb7b5af1174a7c477b247f5c3857a6f145d5d95263c7bba9c2bf82a32aa48171aefa1c77176718d1033b0d1c6844d52bf895508f5a1e281b7a38184d0b037f3fc2149010db8d3f4bd9e0834e029d484a92ee84b7881388ce65d9bfe874c248c11e469cdbde79f422dedd5a1c64c656c58c49403567b5bd8b57f0470b31b01720770fd95269eb79910514a4f3d9e1ed855da8e5cfc31648a8caf150589e19123252019f3ff4513e18f3f706870b37f3a2072d9d42d980ef5bbf8473fa3ff95bb9d4623054b4481360d8f05407cc432a55348a64f9808201bee019f99d92188e153be439bb5d0b0b49bdc2a1d4b9639ccc3b2efcc0f323445a41864895aa356c6705557b7a7fcc6e969d367bbb5b8b5a8686ab02f7bff23fd467b0097e3076d81fad9fc05b6aec91fb74f146718a738eac4ba4c3ea8447e43271263059ef46cdc920ccd1ae049eba24b8fdb715ec39210fb0069e328cd3164cf63106b25c0e702eea54dc1e1365ed8e902bf90b3b890c06d284aaf7c6d1370a9a08e2d8f70e7ae07a2961eeee259d61f086d4b5084d93e5a0e7a3c95be0cf9ac3dac3047c9d505ae3e0007c31b9ee3038db4a595c4ef0e9e90b0163182c7f050a5d84a86fcf492ccdd6cded36d4bb1e7a5fc48c0c606a045a583b8a25dd24a8ef1c24b2f4e1d59329e03a387b1ae1357c55182ed028ac0a0e0d859d3929871b7f3d6a56416bd06a27ababbdbce685b8b6f73bb67128aec716ad60a7f1c22dbeb67ad053c941e401c4ced65fa060137a70ead33a77d90e55c71e1219cbcc1019ddbc6df5a4ee4f2fe3f930ca052046f14dec9763b307e49537f39db52e32a611fed4570cad94c81c8b0bf7b67c091a9270758e3e0903ffb603c3a63fe5cf0eb04e12cf24b0bdfbbb01eefbc25fdfa33b45a7244b1ccc3a7376cbb9bc0d1740179908d3e0b9888d56fa30f87e569a2ba97a4628c6a1c4e7e3496797888fb987530af8c4be1ba5100e2f86e7dfdc0d4f5ee3647ae96ec694d6750e0b34a3f35f120ec16bf63c2480e21433aaa5769e6e29bd930ffe93e167323c0faffd4ec3c2ac27cdadb647e35aff0bae4d7aef78427a1385c4768e340ed897c5ed853eab42443c29f17bafcce28229470115ef052205ae0a819d97f497198b29c856e1a11ef4936a87665305ef493a01d97024d716cddc7f90265840bb8b5de0ba24ee497a877796824199206eeaeab36d1c829cc943487990b298071a4ec88e02b6a9bcde81437af3beb5e223ac55c41f102b77ca83a2958459973e6a475fc4d980094312146276001491ea965a404879be5ac73cf815501ec019da973d5c996284516de721db81f985d411f2d2372586aaed7c48187f0404004828ace393d97daeb01417e967c53d71f8e9a70effd7fcfa5940544f98e3767443d00920c9b7fd05854538310380978b9be43c4b133c8be0b63cf4fb8871270a0538cc440a0c1165a66e7e4cd7982d3445d860dcaf65b32459f9c9bca401b6fedc1ad13cdb65d227f213ad1121d3bd767f6c87c0fac5614371c3d69b49ab98578eff10fe57bf9f1399abf3950b46d5d29229abe336099d760b7401307fb34cf46a47e785974a5a5fdfaf5a7fbe19cd59f37d08df1d9eeda216bc364e6b16b46b98c337ebcb68ddebdd3b90a73f108b2847e76d4e40908fdea050346001fadab41b7580ce4dddfea7f001d93acd6c5dcb54e2f62348534fdf8e6cff579669c00389d3c8f695dd646c7afc2d962a4e29b4be43e4aed28f9cdc8d53505d918c115a3e325c1ed9b99309129957ee586cc32ffdd0270451c13554a0b1eeb3782c46395083c885b3aac51a9a3e90fef34d2f42b01647fbcaf2ebee72f6cd61b052819cfbd9aed6eabb995618b90bd87d10f7f3225cfde570860b48c6603c6aa531d15058e79fc3cfa9c2b007336ffd68f762e03ae9fe1baca43a8e8bdb26061acfbc6406a10243a8248fdb214db93e5a702efcc14cca11cc99604a6401b5098940b7644d8b969309e6f5cf4335b0cab9f37d0770870c71eda5d802c2f4096c26d037e3680372cb2efbb57d281bd8acf6833b73d4895f6a82bbfa8044b94522b35d1ef6d36f31beb14a0af89b6ced42d18a2775e5ad801dbbb4ee8fe3447fd02caea8c1f2288b4473ab10a520a068b3d392a0a244d48c9c675377eed14e926d3f772cdd09950d839db34687c188d3ca3571b21b4a4355ffaa3955b397e2561002f74d786b5df9dbd548a09c028adf3427eec37985a2e8aeade6b5f3966d08a4bcf3853bc42c7dc69d6e8c918eff9140eb3dbc6d359432b3005a8a79ecfb2ef86e8f016719072d0928be09e1fc0927fd9e4804013c677db1a85c48e8d5eb0a5d3f116e0a179288a5769ec0525e1213d7dc46b636d1d54b90596a2966921ad0fa76514a0b07808664318cb871adb58914b3fca3ca0d13e7a9d5cc71c1f1294c575f4377a5bbbc0ef7b5dd1ad9309f39033b80b71273dc4f4e5d9eed21b4d1bb595986f5c0391d994b86989fcccb74ecbfe0b7d7f0a86076cbd5028ab1f5550069adad46bb18c4a2da7a65fb68efab8960d99c4281bf00b856d7ec92d4f3c1df6933f6743bef133aebdd0ea6cfafc479815f2cac0cbc4f0bcb6a71252ef052e770c0384802ace2c1c26740f0c88dee5b61108023820beb30cf88d3c22c427db20a6d32760df1fd19e55dc57525b87dfa22459ed2b27d6003f8fc14ad7cd7c96bd85020e4ffdbea3d686c41b260a2e0c4876e370591671477f82c81e686b29b7cb908ae970e1d71991b3a1b1a3199021839f1d83285f4059c33086b1a444cd3bca3e46f60a96b0f578fcd64a8930faa68a7c88e3f39f285cdda9115277edbe6a8c243f2e5059e0a705834526d3056659b744cd68d6648468e86f05e9a62c0d4e01290179b3ff31b2ca5c78b80b2cccd02f6ece8211b45782f249574e63f2134cd3dbdf89316f1f1bf69a1e2e42d41e103b1f45a6c59e86f31f5a0cb9e89142f94a53007ed9f3447937f777a1745ce5805bb0360da8cd6387f2815df2fc217205b9ad83d5d2d17196fcd82ce5a84b51547e87b1f4dc15047fdc41fb3780c070f8dfd1993173e0f773cd8409cb0af07b7fe92c6139a6aa2c398ea4f223449cdab85807bf372c9bde5db1467b812758544dc67f6c51bcda250249a76c595072cc8fa87c9f3404b8d220fc5f2124d174d74d15aece8719c10e9c0ffec154d7d7f1908a8b8379957cb7a2b447951688691eebd8509f929b7dbea9bc9c25eb9004b266011c697e195e7ceaac013a8cf481749e9940f33e1a853dac50172394c72dc1925623a648edcd8536fe401af4d17df5a3808be740b06f240401c088e0399fffc3a5c38ea1ba57682bab78e3f9869fd00ee745d07f796ffab136981012b0c9bcec1b269491cf2517912f98e10471e6ea08035371bbe1d2ecf7046ba15a34e45947f7adeef5a3cd48a32dad2c58328d08190ec29c59fd38e1b42a64a65caa002ef28beca0e16464d6386002b40eac237290c95009e757eb5edb463e729e555f2384e499a6dd20dcbbc35825febea4d8427ea3f269ca6beac901a0bd99f8f24e1b94d217bd1e74c874e522d409e76ef5e44a177dfbdc8016b437357c560d81b220da8c634a10846297505d6e5dd8f5302636052eaf91cd69a8301b22c2eed1c1cd4edce036fdc4db8aa6a92661acd5c1d44c0edf07a9d8062a52e00fa292e29fd881d7bfaa47aa9106398746f76bf5aff9b718733c65063eb0509ab1529a2583ede137f8cf847ebb12c51daf402b3f8da9dc5ad9b8a65616a819ea76e745069533bdd3d2eca31af0eed3911299e42e430494674d54a4943ac0680d2a6714e97576526c1f31665d41b229ab92161ab99f808aa2b1fa59bed7ecd8c9cdf5a0201e293c4e4d35ecc8d9824ba373242ad9a6b3a21ca68e72f2354c8805435d8f8f25c122404d23ddab535e8685ba88a4f96dcdf4b1335153b89101f39a14f75e7449be3c41c6a528785e74758da0fd8d55e5ffe759f8b506eaa964d0f7c9b7ae5bc1bfcea29462a45a9f8aa49f4c579463a91ee2fdab6750ced3778a956a8b3984c7625ed79248ad169fa8ee9a75262b0bf18bb0e2775235b5593ac2c5bd328760a8160ac381e145b373195c61c54e572baa2287222b26ea19bc5762ec3134074901100ffff1229673db5da66a057bb8c30c48b449cb23ad124f04f09419f2d3842e16aa57e5ef0efbfc567bd0e123fdb4c9846da83c9ebac64802e8b1bbb4d6d4667b9bb13753c97ed6691c61aad277971a262c9fb00917bfa5d086b744cd591f32febb400b9c32403ad86a35319b901c973edfe4dca721168d0778fb2c0732a5185049e15224c5c89ed972065e13a381f6da779c5bbe0d03c729caa4004f52ec897ae480f0c5e5d3967ccd06f6886c869e3053c10c5ece8f13913b52293549e27f3de10aaab9ec2933c89a6eaf51ea3f790179ccd37ec8c3dac6ee6af072b7dd2cdc08142c87d6a84ca99821139637b786ee1b296313bebf6bb3348f24b41028e8e90f676928fbc5945300994dee09d91d5d2edf07ab0a9cae3e3db60c985e589b8e1073f402ce4e28789c378b85e8738dd53f1d945ae53dbc5ce12d337b4981a2babc5677c10d65e91d1097f1e6e4548e42d67569eda9d026e0539358ffd90cdac80a0f8c632418ae7961994138fbac13c755f8a4a0206d00a2d584ac46850582e9aaef2642f462c8a6b31b1136c0c235a2f2fbdbabe39db56793300c0e43c1ab2318c4c23876e68602dd3dd82b28f9902b879b0f73b81b102e72006486079247c080a0f4e9fa21ddaa26e5dace2eb7a073ff246c0e728d3b3752af560dc633eda5533071fbe7173840449f588dd89ddd1435f0d92362801d2d9161e8c1e209675590af8c176e5e4a004270d6c917c937dbd6aadeb9e7df3d1ef87b148762d13b7c24b127b4b19a458cc8b2dc37a45fd44c7087c639b81778eb4e597a12e6908988a8b10eea0e685708beb66b8a96f3a439ece77d51dab9cd5bf941cc092fe5749e32d7a80051853dcd4a590f11b2e5559f01c5332985632d9f1d8b9c14cd19c2ce2f4bd7a3ac2cc37c73c6b89a0b5e89e091e77dd1194c65b1687ecfe81b273dd1643a5f952ac9f6c1d94e0273955de7d7c2d8cde9f82cb71cba220b214a5be85b7b832741c3f2f38a63a3abf4929ed117b56d4815f0873956a552ed0d734707fa55514921c70166ad4db0c3098fbd0e6531aeee8f0fae40f2f444deab6a5208c19536b6cf0708fcea2487ea55488039cb16acfe4a9681ff75627bb620bb970718d67154cae32b97c77da7dd0eb6dbe2a538f82ff0788c5123e7b9358414c12bdc609d1face204c1110c61efa1ca7", 0x1000}, {&(0x7f0000001680)="20bd4bd996a2b9b97e36a8ba38fdcb391460079176f1ccde5372fd5d23d42936d4a72a29cffb36b7356e16d6a4e73660305c7f167adebb9d6a90184984aff01ebb396cce15879b4a9a74", 0x4a}, {&(0x7f0000001700)="e09464709a88b37025976495a55b44ca97a1446ce18097541aa5a65223deb807025f1d74f4be202a6a628b60b6af6dd6e234e44103357bec495d90f0ffa310a15887c06dba03c78c93dec71b689adcfa8fa0af6310d3cbf7c78f9dd49bf16cb3ae0272a03e7656595b12e30cc7007a50a7d905ca4aa7eda17276efa890df1e79040ca6c1b86f87c743c165b4d49e4d86c1af63d328fc7581e62fa76d3b59332a48145e5baf41717b0dca5c340470e21e1e551cd49c0722cff225", 0xba}, {&(0x7f00000017c0)="3d1ab31c30f443e23330bd36a7e1c6eac8244eb5bb35e700ff848448e154909ce92b70da9675494ff243cd27c7c2e5f8e95bd3e9ae3fdd93f8018e0892a0350bbf81511d397c2ea9da5354861386b1531e8f5c", 0x53}], 0x4) executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x8c800) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4011}, 0x8894) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000200)={0x43, 0x2, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc8045}, 0x40011) r4 = socket$inet(0x2, 0x2, 0x1) connect$inet(r4, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000000540)=[{{0x0, 0x2, &(0x7f0000000000)=[{&(0x7f00000000c0)="08001497733f5d3e", 0x6c6d}], 0x5}}, {{0x0, 0x0, &(0x7f0000000440), 0x56}}], 0x2, 0x2004000) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x10, r6}, 0x14) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000010c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x1e7d, 0x3232, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xb0, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x8, 0xc, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0xe, 0xff}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x6, 0x10, 0xf2}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000280)={0xffffffffffffff4c, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x9, {0x9, 0x21, 0x0, 0x1e, 0x1, {0x22, 0xc7b}}}}, &(0x7f00000002c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock2(&(0x7f0000381000/0x4000)=nil, 0x4000, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r8 = memfd_secret(0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r8, 0x8000000) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r8, 0x8000000) program crashed: INFO: task hung in rtnl_lock bisect: the chunk can be dropped bisect: split chunks (needed=true): <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 30] detailed listing: executing program 1: r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000000)=[@dead_binder_done, @register_looper], 0x0, 0x0, 0x0}) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x400000, 0xffffffff}}, 0xffffffffffffff56) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r6, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$sock_linger(r6, 0x1, 0x3d, &(0x7f00000001c0)={0x0, 0x8}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) bind$tipc(r5, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r8, &(0x7f0000000380)={&(0x7f0000000240)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r9 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r9, &(0x7f0000000240)={0xa, 0x4e20, 0x1000, @local}, 0x1c) r10 = accept(r6, &(0x7f0000000480)=@in={0x2, 0x0, @dev}, &(0x7f0000000300)=0x80) writev(r10, &(0x7f0000001840)=[{&(0x7f0000000680)="c8ce0d2f7d199f23f44bd2dd89f3f5d43b5d74439bfb9d837ffd9f2d1d8f70438aa17bf7890caa57252f0e0bd3e59fc1ed9a5cdcda06c1c6204b53154abd1066645beaf3be157729057ddaaab48ab49d18aeb9bee8a4642fe46efc1be3ce806f93ef0976e32032d5ae5f89c46f6d5e82589661f6d7e89010580804b0d7d6b7b9ffc3d8372dc7f16a8da2e8c311392acea050f3fa3a2f1fa03f19122071a9a084d95ad128db948e43345eec149169d4abafd381995e33be74fe343295937cf9d1a1637ecb7c10357fa7b46cb26dce5a6f7dc0fbf361745bb6b46ddb7e785aafa70b2b7742604f1fdc9ad80ee658a63e482a5ca9a0203a9b832231f9a9977da77173586f622488e2477baf3264dca137ad8c071a9bff0c1a7b70335a179ec76ed2d0e3802e0757d91b595597a78ffb7b5af1174a7c477b247f5c3857a6f145d5d95263c7bba9c2bf82a32aa48171aefa1c77176718d1033b0d1c6844d52bf895508f5a1e281b7a38184d0b037f3fc2149010db8d3f4bd9e0834e029d484a92ee84b7881388ce65d9bfe874c248c11e469cdbde79f422dedd5a1c64c656c58c49403567b5bd8b57f0470b31b01720770fd95269eb79910514a4f3d9e1ed855da8e5cfc31648a8caf150589e19123252019f3ff4513e18f3f706870b37f3a2072d9d42d980ef5bbf8473fa3ff95bb9d4623054b4481360d8f05407cc432a55348a64f9808201bee019f99d92188e153be439bb5d0b0b49bdc2a1d4b9639ccc3b2efcc0f323445a41864895aa356c6705557b7a7fcc6e969d367bbb5b8b5a8686ab02f7bff23fd467b0097e3076d81fad9fc05b6aec91fb74f146718a738eac4ba4c3ea8447e43271263059ef46cdc920ccd1ae049eba24b8fdb715ec39210fb0069e328cd3164cf63106b25c0e702eea54dc1e1365ed8e902bf90b3b890c06d284aaf7c6d1370a9a08e2d8f70e7ae07a2961eeee259d61f086d4b5084d93e5a0e7a3c95be0cf9ac3dac3047c9d505ae3e0007c31b9ee3038db4a595c4ef0e9e90b0163182c7f050a5d84a86fcf492ccdd6cded36d4bb1e7a5fc48c0c606a045a583b8a25dd24a8ef1c24b2f4e1d59329e03a387b1ae1357c55182ed028ac0a0e0d859d3929871b7f3d6a56416bd06a27ababbdbce685b8b6f73bb67128aec716ad60a7f1c22dbeb67ad053c941e401c4ced65fa060137a70ead33a77d90e55c71e1219cbcc1019ddbc6df5a4ee4f2fe3f930ca052046f14dec9763b307e49537f39db52e32a611fed4570cad94c81c8b0bf7b67c091a9270758e3e0903ffb603c3a63fe5cf0eb04e12cf24b0bdfbbb01eefbc25fdfa33b45a7244b1ccc3a7376cbb9bc0d1740179908d3e0b9888d56fa30f87e569a2ba97a4628c6a1c4e7e3496797888fb987530af8c4be1ba5100e2f86e7dfdc0d4f5ee3647ae96ec694d6750e0b34a3f35f120ec16bf63c2480e21433aaa5769e6e29bd930ffe93e167323c0faffd4ec3c2ac27cdadb647e35aff0bae4d7aef78427a1385c4768e340ed897c5ed853eab42443c29f17bafcce28229470115ef052205ae0a819d97f497198b29c856e1a11ef4936a87665305ef493a01d97024d716cddc7f90265840bb8b5de0ba24ee497a877796824199206eeaeab36d1c829cc943487990b298071a4ec88e02b6a9bcde81437af3beb5e223ac55c41f102b77ca83a2958459973e6a475fc4d980094312146276001491ea965a404879be5ac73cf815501ec019da973d5c996284516de721db81f985d411f2d2372586aaed7c48187f0404004828ace393d97daeb01417e967c53d71f8e9a70effd7fcfa5940544f98e3767443d00920c9b7fd05854538310380978b9be43c4b133c8be0b63cf4fb8871270a0538cc440a0c1165a66e7e4cd7982d3445d860dcaf65b32459f9c9bca401b6fedc1ad13cdb65d227f213ad1121d3bd767f6c87c0fac5614371c3d69b49ab98578eff10fe57bf9f1399abf3950b46d5d29229abe336099d760b7401307fb34cf46a47e785974a5a5fdfaf5a7fbe19cd59f37d08df1d9eeda216bc364e6b16b46b98c337ebcb68ddebdd3b90a73f108b2847e76d4e40908fdea050346001fadab41b7580ce4dddfea7f001d93acd6c5dcb54e2f62348534fdf8e6cff579669c00389d3c8f695dd646c7afc2d962a4e29b4be43e4aed28f9cdc8d53505d918c115a3e325c1ed9b99309129957ee586cc32ffdd0270451c13554a0b1eeb3782c46395083c885b3aac51a9a3e90fef34d2f42b01647fbcaf2ebee72f6cd61b052819cfbd9aed6eabb995618b90bd87d10f7f3225cfde570860b48c6603c6aa531d15058e79fc3cfa9c2b007336ffd68f762e03ae9fe1baca43a8e8bdb26061acfbc6406a10243a8248fdb214db93e5a702efcc14cca11cc99604a6401b5098940b7644d8b969309e6f5cf4335b0cab9f37d0770870c71eda5d802c2f4096c26d037e3680372cb2efbb57d281bd8acf6833b73d4895f6a82bbfa8044b94522b35d1ef6d36f31beb14a0af89b6ced42d18a2775e5ad801dbbb4ee8fe3447fd02caea8c1f2288b4473ab10a520a068b3d392a0a244d48c9c675377eed14e926d3f772cdd09950d839db34687c188d3ca3571b21b4a4355ffaa3955b397e2561002f74d786b5df9dbd548a09c028adf3427eec37985a2e8aeade6b5f3966d08a4bcf3853bc42c7dc69d6e8c918eff9140eb3dbc6d359432b3005a8a79ecfb2ef86e8f016719072d0928be09e1fc0927fd9e4804013c677db1a85c48e8d5eb0a5d3f116e0a179288a5769ec0525e1213d7dc46b636d1d54b90596a2966921ad0fa76514a0b07808664318cb871adb58914b3fca3ca0d13e7a9d5cc71c1f1294c575f4377a5bbbc0ef7b5dd1ad9309f39033b80b71273dc4f4e5d9eed21b4d1bb595986f5c0391d994b86989fcccb74ecbfe0b7d7f0a86076cbd5028ab1f5550069adad46bb18c4a2da7a65fb68efab8960d99c4281bf00b856d7ec92d4f3c1df6933f6743bef133aebdd0ea6cfafc479815f2cac0cbc4f0bcb6a71252ef052e770c0384802ace2c1c26740f0c88dee5b61108023820beb30cf88d3c22c427db20a6d32760df1fd19e55dc57525b87dfa22459ed2b27d6003f8fc14ad7cd7c96bd85020e4ffdbea3d686c41b260a2e0c4876e370591671477f82c81e686b29b7cb908ae970e1d71991b3a1b1a3199021839f1d83285f4059c33086b1a444cd3bca3e46f60a96b0f578fcd64a8930faa68a7c88e3f39f285cdda9115277edbe6a8c243f2e5059e0a705834526d3056659b744cd68d6648468e86f05e9a62c0d4e01290179b3ff31b2ca5c78b80b2cccd02f6ece8211b45782f249574e63f2134cd3dbdf89316f1f1bf69a1e2e42d41e103b1f45a6c59e86f31f5a0cb9e89142f94a53007ed9f3447937f777a1745ce5805bb0360da8cd6387f2815df2fc217205b9ad83d5d2d17196fcd82ce5a84b51547e87b1f4dc15047fdc41fb3780c070f8dfd1993173e0f773cd8409cb0af07b7fe92c6139a6aa2c398ea4f223449cdab85807bf372c9bde5db1467b812758544dc67f6c51bcda250249a76c595072cc8fa87c9f3404b8d220fc5f2124d174d74d15aece8719c10e9c0ffec154d7d7f1908a8b8379957cb7a2b447951688691eebd8509f929b7dbea9bc9c25eb9004b266011c697e195e7ceaac013a8cf481749e9940f33e1a853dac50172394c72dc1925623a648edcd8536fe401af4d17df5a3808be740b06f240401c088e0399fffc3a5c38ea1ba57682bab78e3f9869fd00ee745d07f796ffab136981012b0c9bcec1b269491cf2517912f98e10471e6ea08035371bbe1d2ecf7046ba15a34e45947f7adeef5a3cd48a32dad2c58328d08190ec29c59fd38e1b42a64a65caa002ef28beca0e16464d6386002b40eac237290c95009e757eb5edb463e729e555f2384e499a6dd20dcbbc35825febea4d8427ea3f269ca6beac901a0bd99f8f24e1b94d217bd1e74c874e522d409e76ef5e44a177dfbdc8016b437357c560d81b220da8c634a10846297505d6e5dd8f5302636052eaf91cd69a8301b22c2eed1c1cd4edce036fdc4db8aa6a92661acd5c1d44c0edf07a9d8062a52e00fa292e29fd881d7bfaa47aa9106398746f76bf5aff9b718733c65063eb0509ab1529a2583ede137f8cf847ebb12c51daf402b3f8da9dc5ad9b8a65616a819ea76e745069533bdd3d2eca31af0eed3911299e42e430494674d54a4943ac0680d2a6714e97576526c1f31665d41b229ab92161ab99f808aa2b1fa59bed7ecd8c9cdf5a0201e293c4e4d35ecc8d9824ba373242ad9a6b3a21ca68e72f2354c8805435d8f8f25c122404d23ddab535e8685ba88a4f96dcdf4b1335153b89101f39a14f75e7449be3c41c6a528785e74758da0fd8d55e5ffe759f8b506eaa964d0f7c9b7ae5bc1bfcea29462a45a9f8aa49f4c579463a91ee2fdab6750ced3778a956a8b3984c7625ed79248ad169fa8ee9a75262b0bf18bb0e2775235b5593ac2c5bd328760a8160ac381e145b373195c61c54e572baa2287222b26ea19bc5762ec3134074901100ffff1229673db5da66a057bb8c30c48b449cb23ad124f04f09419f2d3842e16aa57e5ef0efbfc567bd0e123fdb4c9846da83c9ebac64802e8b1bbb4d6d4667b9bb13753c97ed6691c61aad277971a262c9fb00917bfa5d086b744cd591f32febb400b9c32403ad86a35319b901c973edfe4dca721168d0778fb2c0732a5185049e15224c5c89ed972065e13a381f6da779c5bbe0d03c729caa4004f52ec897ae480f0c5e5d3967ccd06f6886c869e3053c10c5ece8f13913b52293549e27f3de10aaab9ec2933c89a6eaf51ea3f790179ccd37ec8c3dac6ee6af072b7dd2cdc08142c87d6a84ca99821139637b786ee1b296313bebf6bb3348f24b41028e8e90f676928fbc5945300994dee09d91d5d2edf07ab0a9cae3e3db60c985e589b8e1073f402ce4e28789c378b85e8738dd53f1d945ae53dbc5ce12d337b4981a2babc5677c10d65e91d1097f1e6e4548e42d67569eda9d026e0539358ffd90cdac80a0f8c632418ae7961994138fbac13c755f8a4a0206d00a2d584ac46850582e9aaef2642f462c8a6b31b1136c0c235a2f2fbdbabe39db56793300c0e43c1ab2318c4c23876e68602dd3dd82b28f9902b879b0f73b81b102e72006486079247c080a0f4e9fa21ddaa26e5dace2eb7a073ff246c0e728d3b3752af560dc633eda5533071fbe7173840449f588dd89ddd1435f0d92362801d2d9161e8c1e209675590af8c176e5e4a004270d6c917c937dbd6aadeb9e7df3d1ef87b148762d13b7c24b127b4b19a458cc8b2dc37a45fd44c7087c639b81778eb4e597a12e6908988a8b10eea0e685708beb66b8a96f3a439ece77d51dab9cd5bf941cc092fe5749e32d7a80051853dcd4a590f11b2e5559f01c5332985632d9f1d8b9c14cd19c2ce2f4bd7a3ac2cc37c73c6b89a0b5e89e091e77dd1194c65b1687ecfe81b273dd1643a5f952ac9f6c1d94e0273955de7d7c2d8cde9f82cb71cba220b214a5be85b7b832741c3f2f38a63a3abf4929ed117b56d4815f0873956a552ed0d734707fa55514921c70166ad4db0c3098fbd0e6531aeee8f0fae40f2f444deab6a5208c19536b6cf0708fcea2487ea55488039cb16acfe4a9681ff75627bb620bb970718d67154cae32b97c77da7dd0eb6dbe2a538f82ff0788c5123e7b9358414c12bdc609d1face204c1110c61efa1ca7", 0x1000}, {&(0x7f0000001680)="20bd4bd996a2b9b97e36a8ba38fdcb391460079176f1ccde5372fd5d23d42936d4a72a29cffb36b7356e16d6a4e73660305c7f167adebb9d6a90184984aff01ebb396cce15879b4a9a74", 0x4a}, {&(0x7f0000001700)="e09464709a88b37025976495a55b44ca97a1446ce18097541aa5a65223deb807025f1d74f4be202a6a628b60b6af6dd6e234e44103357bec495d90f0ffa310a15887c06dba03c78c93dec71b689adcfa8fa0af6310d3cbf7c78f9dd49bf16cb3ae0272a03e7656595b12e30cc7007a50a7d905ca4aa7eda17276efa890df1e79040ca6c1b86f87c743c165b4d49e4d86c1af63d328fc7581e62fa76d3b59332a48145e5baf41717b0dca5c340470e21e1e551cd49c0722cff225", 0xba}, {&(0x7f00000017c0)="3d1ab31c30f443e23330bd36a7e1c6eac8244eb5bb35e700ff848448e154909ce92b70da9675494ff243cd27c7c2e5f8e95bd3e9ae3fdd93f8018e0892a0350bbf81511d397c2ea9da5354861386b1531e8f5c", 0x53}], 0x4) executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x8c800) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4011}, 0x8894) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000200)={0x43, 0x2, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc8045}, 0x40011) r4 = socket$inet(0x2, 0x2, 0x1) connect$inet(r4, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000000540)=[{{0x0, 0x2, &(0x7f0000000000)=[{&(0x7f00000000c0)="08001497733f5d3e", 0x6c6d}], 0x5}}, {{0x0, 0x0, &(0x7f0000000440), 0x56}}], 0x2, 0x2004000) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x10, r6}, 0x14) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000010c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x1e7d, 0x3232, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xb0, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x8, 0xc, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0xe, 0xff}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x6, 0x10, 0xf2}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000280)={0xffffffffffffff4c, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x9, {0x9, 0x21, 0x0, 0x1e, 0x1, {0x22, 0xc7b}}}}, &(0x7f00000002c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock2(&(0x7f0000381000/0x4000)=nil, 0x4000, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r8 = memfd_secret(0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r8, 0x8000000) syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r8, 0x8000000) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 9] detailed listing: executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e21}, 0x6e) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') pread64(r3, &(0x7f0000000480)=""/177, 0xb1, 0x2) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f00000000c0)={@private=0xa010101, @broadcast}, 0x8) ppoll(&(0x7f0000000040)=[{r0, 0x5008}], 0x1, 0x0, 0x0, 0x0) executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) program crashed: INFO: task hung in rtnl_lock bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR-socketpair$tipc-openat$selinux_load-sendmsg$nl_generic-write$selinux_load-mknod$loop detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) program crashed: INFO: task hung in rtnl_lock bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR-socketpair$tipc-openat$selinux_load-sendmsg$nl_generic-write$selinux_load-mknod$loop detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) program crashed: INFO: task hung in rtnl_lock bisect: concatenation succeeded found reproducer with 9 syscalls minimizing guilty program testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR-socketpair$tipc-openat$selinux_load-sendmsg$nl_generic-write$selinux_load detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) program crashed: INFO: task hung in rtnl_lock testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR-socketpair$tipc-openat$selinux_load-sendmsg$nl_generic detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x1e, 0x1, 0x70bd25, 0x25dfdbfb, {0x14}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4) program crashed: INFO: task hung in rtnl_lock testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR-socketpair$tipc-openat$selinux_load detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) program crashed: INFO: task hung in rtnl_lock testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR-socketpair$tipc detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') socketpair$tipc(0x1e, 0x5, 0x0, 0x0) program crashed: INFO: task hung in rtnl_lock testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program crashed: INFO: task hung in rtnl_lock testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-write$input_event detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-socket$netlink-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a2, &(0x7f0000000000)='bridge0\x00') program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program crashed: INFO: task hung in rtnl_lock testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR program did not crash simplifying guilty program options testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program crashed: INFO: task hung in rtnl_lock extracting C reproducer testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program did not crash testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program crashed: INFO: task hung in rtnl_lock validation run: crashed=true testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program crashed: INFO: task hung in rtnl_lock validation run: crashed=true testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-write$input_event-ioctl$sock_SIOCBRDELBR detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') program crashed: INFO: task hung in rtnl_lock validation run: crashed=true reproducing took 3h41m48.02457013s repro crashed as (corrupted=false): INFO: task syz-executor:409 blocked for more than 122 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:409 tgid:409 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:6026 [inline] __schedule+0x1399/0x1fa0 kernel/sched/core.c:7880 __schedule_loop kernel/sched/core.c:7961 [inline] schedule+0xc5/0x240 kernel/sched/core.c:7976 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8033 __mutex_lock_common kernel/locking/mutex.c:707 [inline] __mutex_lock+0x960/0x1bb0 kernel/locking/mutex.c:803 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1134 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285 rtnl_lock+0x19/0x20 net/core/rtnetlink.c:79 wg_netns_pre_exit+0x22/0x190 drivers/net/wireguard/device.c:414 ops_pre_exit_list net/core/net_namespace.c:163 [inline] setup_net+0x48f/0x9b0 net/core/net_namespace.c:373 copy_net_ns+0x512/0xa30 net/core/net_namespace.c:510 create_new_namespaces+0x3b5/0x720 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228 ksys_unshare+0x503/0x8d0 kernel/fork.c:3374 __do_sys_unshare kernel/fork.c:3457 [inline] __se_sys_unshare kernel/fork.c:3455 [inline] __x64_sys_unshare+0x3c/0x50 kernel/fork.c:3455 x64_sys_call+0x2998/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:273 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2f0cb9e0a7 RSP: 002b:00007ffe44fddda8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2f0cb9e0a7 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007ffe44fdde00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffe44fdde08 R13: 0000000000000002 R14: 00007ffe44fddfe8 R15: 0000000000000000 INFO: task syz-executor:416 blocked for more than 125 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:416 tgid:416 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:6026 [inline] __schedule+0x1399/0x1fa0 kernel/sched/core.c:7880 __schedule_loop kernel/sched/core.c:7961 [inline] schedule+0xc5/0x240 kernel/sched/core.c:7976 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8033 __mutex_lock_common kernel/locking/mutex.c:707 [inline] __mutex_lock+0x960/0x1bb0 kernel/locking/mutex.c:803 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1134 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285 rtnl_lock net/core/rtnetlink.c:79 [inline] rtnetlink_rcv_msg+0x79e/0xa40 net/core/rtnetlink.c:6672 netlink_rcv_skb+0x259/0x4f0 net/netlink/af_netlink.c:2545 rtnetlink_rcv+0x20/0x30 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x8c3/0xa60 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x7fe/0xb10 net/netlink/af_netlink.c:1889 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x68a/0x700 net/socket.c:2216 __do_sys_sendto net/socket.c:2228 [inline] __se_sys_sendto net/socket.c:2224 [inline] __x64_sys_sendto+0xe9/0x100 net/socket.c:2224 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd5d2157f57 RSP: 002b:00007ffd93b058a0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555583cde500 RCX: 00007fd5d2157f57 RDX: 000000000000002c RSI: 00007fd5d2f44670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffd93b05904 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fd5d2f44670 R15: 0000000000000000 INFO: task syz-executor:424 blocked for more than 126 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:424 tgid:424 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:6026 [inline] __schedule+0x1399/0x1fa0 kernel/sched/core.c:7880 __schedule_loop kernel/sched/core.c:7961 [inline] schedule+0xc5/0x240 kernel/sched/core.c:7976 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8033 __mutex_lock_common kernel/locking/mutex.c:707 [inline] __mutex_lock+0x960/0x1bb0 kernel/locking/mutex.c:803 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1134 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285 rtnl_lock net/core/rtnetlink.c:79 [inline] rtnetlink_rcv_msg+0x79e/0xa40 net/core/rtnetlink.c:6672 netlink_rcv_skb+0x259/0x4f0 net/netlink/af_netlink.c:2545 rtnetlink_rcv+0x20/0x30 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x8c3/0xa60 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x7fe/0xb10 net/netlink/af_netlink.c:1889 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x68a/0x700 net/socket.c:2216 __do_sys_sendto net/socket.c:2228 [inline] __se_sys_sendto net/socket.c:2224 [inline] __x64_sys_sendto+0xe9/0x100 net/socket.c:2224 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f02ca957f57 RSP: 002b:00007ffdde0fdb80 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055556dd50500 RCX: 00007f02ca957f57 RDX: 0000000000000028 RSI: 00007f02cb744670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffdde0fdbe4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f02cb744670 R15: 0000000000000000 NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 0f3775a9ea948f8f8f06e34e337f4a1c8395b27e Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 nmi_cpu_backtrace+0x2ba/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:267 [inline] watchdog+0xdad/0xf00 kernel/hung_task.c:423 kthread+0x2c9/0x370 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 99 Comm: klogd Not tainted syzkaller #0 0f3775a9ea948f8f8f06e34e337f4a1c8395b27e Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:128 [inline] RIP: 0010:put_cpu_partial+0x25/0xc0 mm/slub.c:3303 Code: 90 90 90 90 90 55 48 89 e5 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 45 f8 48 c7 45 f0 00 00 00 00 9c 8f 45 f0 48 8b 4d f0 65 48 8b 05 8a ac 25 7e 48 8b 07 65 4c 8b 40 18 41 b9 01 00 00 RSP: 0018:ffffc90000e4f668 EFLAGS: 00000282 RAX: 8fc58822b2917f00 RBX: ffff8881207f7dc0 RCX: 0000000000000282 RDX: 0000000000000001 RSI: ffffea000481fdc0 RDI: ffff88810565b640 RBP: ffffc90000e4f678 R08: ffff8881207f7dc0 R09: 00000000000c000b R10: 0000000000000000 R11: fffff520001c9ebc R12: 0000000000000000 R13: 000000000000000b R14: 00000000000c000c R15: ffffea000481fdc0 FS: 00007fe236788c80(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa786748060 CR3: 000000010c782000 CR4: 00000000003526b0 Call Trace: __slab_free+0x1cf/0x2a0 mm/slub.c:4584 do_slab_free mm/slub.c:4666 [inline] ___cache_free+0xc9/0xe0 mm/slub.c:4781 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0xb5/0x130 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x180 mm/kasan/quarantine.c:286 __kasan_kmalloc+0x28/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:261 [inline] __do_kmalloc_node mm/slub.c:4395 [inline] __kmalloc_node_track_caller_noprof+0x251/0x4f0 mm/slub.c:4414 kmalloc_reserve+0x144/0x4f0 net/core/skbuff.c:618 __alloc_skb+0x144/0x370 net/core/skbuff.c:687 alloc_skb include/linux/skbuff.h:1363 [inline] alloc_skb_with_frags+0xce/0x8b0 net/core/skbuff.c:6611 sock_alloc_send_pskb+0x883/0x9a0 net/core/sock.c:2923 unix_dgram_sendmsg+0x647/0x1ac0 net/unix/af_unix.c:2038 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x68a/0x700 net/socket.c:2216 __do_sys_sendto net/socket.c:2228 [inline] __se_sys_sendto net/socket.c:2224 [inline] __x64_sys_sendto+0xe9/0x100 net/socket.c:2224 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe2368d8407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffd01a05490 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fe236788c80 RCX: 00007fe2368d8407 RDX: 000000000000003a RSI: 00007ffd01a055d0 RDI: 0000000000000003 RBP: 00007ffd01a05a00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffd01a05a18 R13: 00007ffd01a055d0 R14: 000000000000001f R15: 00007ffd01a055d0 net_ratelimit: 82704 callbacks suppressed bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:9e:e7:54:0f:6d:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:9e:e7:54:0f:6d:fd, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) final repro crashed as (corrupted=false): INFO: task syz-executor:409 blocked for more than 122 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:409 tgid:409 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:6026 [inline] __schedule+0x1399/0x1fa0 kernel/sched/core.c:7880 __schedule_loop kernel/sched/core.c:7961 [inline] schedule+0xc5/0x240 kernel/sched/core.c:7976 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8033 __mutex_lock_common kernel/locking/mutex.c:707 [inline] __mutex_lock+0x960/0x1bb0 kernel/locking/mutex.c:803 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1134 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285 rtnl_lock+0x19/0x20 net/core/rtnetlink.c:79 wg_netns_pre_exit+0x22/0x190 drivers/net/wireguard/device.c:414 ops_pre_exit_list net/core/net_namespace.c:163 [inline] setup_net+0x48f/0x9b0 net/core/net_namespace.c:373 copy_net_ns+0x512/0xa30 net/core/net_namespace.c:510 create_new_namespaces+0x3b5/0x720 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228 ksys_unshare+0x503/0x8d0 kernel/fork.c:3374 __do_sys_unshare kernel/fork.c:3457 [inline] __se_sys_unshare kernel/fork.c:3455 [inline] __x64_sys_unshare+0x3c/0x50 kernel/fork.c:3455 x64_sys_call+0x2998/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:273 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2f0cb9e0a7 RSP: 002b:00007ffe44fddda8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2f0cb9e0a7 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007ffe44fdde00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffe44fdde08 R13: 0000000000000002 R14: 00007ffe44fddfe8 R15: 0000000000000000 INFO: task syz-executor:416 blocked for more than 125 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:416 tgid:416 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:6026 [inline] __schedule+0x1399/0x1fa0 kernel/sched/core.c:7880 __schedule_loop kernel/sched/core.c:7961 [inline] schedule+0xc5/0x240 kernel/sched/core.c:7976 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8033 __mutex_lock_common kernel/locking/mutex.c:707 [inline] __mutex_lock+0x960/0x1bb0 kernel/locking/mutex.c:803 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1134 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285 rtnl_lock net/core/rtnetlink.c:79 [inline] rtnetlink_rcv_msg+0x79e/0xa40 net/core/rtnetlink.c:6672 netlink_rcv_skb+0x259/0x4f0 net/netlink/af_netlink.c:2545 rtnetlink_rcv+0x20/0x30 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x8c3/0xa60 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x7fe/0xb10 net/netlink/af_netlink.c:1889 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x68a/0x700 net/socket.c:2216 __do_sys_sendto net/socket.c:2228 [inline] __se_sys_sendto net/socket.c:2224 [inline] __x64_sys_sendto+0xe9/0x100 net/socket.c:2224 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd5d2157f57 RSP: 002b:00007ffd93b058a0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555583cde500 RCX: 00007fd5d2157f57 RDX: 000000000000002c RSI: 00007fd5d2f44670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffd93b05904 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fd5d2f44670 R15: 0000000000000000 INFO: task syz-executor:424 blocked for more than 126 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:424 tgid:424 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:6026 [inline] __schedule+0x1399/0x1fa0 kernel/sched/core.c:7880 __schedule_loop kernel/sched/core.c:7961 [inline] schedule+0xc5/0x240 kernel/sched/core.c:7976 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8033 __mutex_lock_common kernel/locking/mutex.c:707 [inline] __mutex_lock+0x960/0x1bb0 kernel/locking/mutex.c:803 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1134 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285 rtnl_lock net/core/rtnetlink.c:79 [inline] rtnetlink_rcv_msg+0x79e/0xa40 net/core/rtnetlink.c:6672 netlink_rcv_skb+0x259/0x4f0 net/netlink/af_netlink.c:2545 rtnetlink_rcv+0x20/0x30 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x8c3/0xa60 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x7fe/0xb10 net/netlink/af_netlink.c:1889 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x68a/0x700 net/socket.c:2216 __do_sys_sendto net/socket.c:2228 [inline] __se_sys_sendto net/socket.c:2224 [inline] __x64_sys_sendto+0xe9/0x100 net/socket.c:2224 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f02ca957f57 RSP: 002b:00007ffdde0fdb80 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055556dd50500 RCX: 00007f02ca957f57 RDX: 0000000000000028 RSI: 00007f02cb744670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffdde0fdbe4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f02cb744670 R15: 0000000000000000 NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 0f3775a9ea948f8f8f06e34e337f4a1c8395b27e Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 nmi_cpu_backtrace+0x2ba/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:267 [inline] watchdog+0xdad/0xf00 kernel/hung_task.c:423 kthread+0x2c9/0x370 kernel/kthread.c:389 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 99 Comm: klogd Not tainted syzkaller #0 0f3775a9ea948f8f8f06e34e337f4a1c8395b27e Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:128 [inline] RIP: 0010:put_cpu_partial+0x25/0xc0 mm/slub.c:3303 Code: 90 90 90 90 90 55 48 89 e5 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 45 f8 48 c7 45 f0 00 00 00 00 9c 8f 45 f0 48 8b 4d f0 65 48 8b 05 8a ac 25 7e 48 8b 07 65 4c 8b 40 18 41 b9 01 00 00 RSP: 0018:ffffc90000e4f668 EFLAGS: 00000282 RAX: 8fc58822b2917f00 RBX: ffff8881207f7dc0 RCX: 0000000000000282 RDX: 0000000000000001 RSI: ffffea000481fdc0 RDI: ffff88810565b640 RBP: ffffc90000e4f678 R08: ffff8881207f7dc0 R09: 00000000000c000b R10: 0000000000000000 R11: fffff520001c9ebc R12: 0000000000000000 R13: 000000000000000b R14: 00000000000c000c R15: ffffea000481fdc0 FS: 00007fe236788c80(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa786748060 CR3: 000000010c782000 CR4: 00000000003526b0 Call Trace: __slab_free+0x1cf/0x2a0 mm/slub.c:4584 do_slab_free mm/slub.c:4666 [inline] ___cache_free+0xc9/0xe0 mm/slub.c:4781 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0xb5/0x130 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x180 mm/kasan/quarantine.c:286 __kasan_kmalloc+0x28/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:261 [inline] __do_kmalloc_node mm/slub.c:4395 [inline] __kmalloc_node_track_caller_noprof+0x251/0x4f0 mm/slub.c:4414 kmalloc_reserve+0x144/0x4f0 net/core/skbuff.c:618 __alloc_skb+0x144/0x370 net/core/skbuff.c:687 alloc_skb include/linux/skbuff.h:1363 [inline] alloc_skb_with_frags+0xce/0x8b0 net/core/skbuff.c:6611 sock_alloc_send_pskb+0x883/0x9a0 net/core/sock.c:2923 unix_dgram_sendmsg+0x647/0x1ac0 net/unix/af_unix.c:2038 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x68a/0x700 net/socket.c:2216 __do_sys_sendto net/socket.c:2228 [inline] __se_sys_sendto net/socket.c:2224 [inline] __x64_sys_sendto+0xe9/0x100 net/socket.c:2224 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe2368d8407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffd01a05490 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fe236788c80 RCX: 00007fe2368d8407 RDX: 000000000000003a RSI: 00007ffd01a055d0 RDI: 0000000000000003 RBP: 00007ffd01a05a00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffd01a05a18 R13: 00007ffd01a055d0 R14: 000000000000001f R15: 00007ffd01a055d0 net_ratelimit: 82704 callbacks suppressed bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:9e:e7:54:0f:6d:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:9e:e7:54:0f:6d:fd, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)