Extracting prog: 1h33m33.444279813s Minimizing prog: 1h49m20.90379619s Simplifying prog options: 0s Extracting C: 4m9.33339723s Simplifying C: 29m14.817484831s 30 programs, timeouts [6m0s] extracting reproducer from 30 programs single: executing 5 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$nl_route-openat$uinput-prctl$PR_SCHED_CORE-sched_setaffinity-openat$cgroup_ro-socket$can_raw-prctl$PR_SCHED_CORE-openat$hwrng-preadv-openat$sysctl-write$sysctl-write$sysctl-getpgrp-add_key$user-keyctl$dh_compute-syz_open_procfs-writev-io_uring_setup-socket$inet6_sctp-sendto$inet6-syz_usb_connect-open-inotify_init-inotify_add_watch-open-close_range detailed listing: executing program 0: pipe(0x0) socket$nl_route(0x10, 0x3, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x2000000002, 0x0, 0x3, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000300)='1\x00', 0xffffff4a) write$sysctl(r1, &(0x7f0000000000)='2\x00', 0x2) getpgrp(0x0) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x30, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, 0x0, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) writev(r3, &(0x7f00000010c0), 0x0) r4 = io_uring_setup(0x3dd, &(0x7f0000000240)={0x0, 0x7d52, 0x10, 0x1}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b8c07d40450c01800a9000000012090212000100000000090400000080829900"], 0x0) open(&(0x7f0000000100)='./file0\x00', 0x60c2, 0x0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x400017e) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rdma_cm-prlimit64-sched_setscheduler-bind$alg-setpriority-prctl$PR_SET_VMA-request_key-sched_setaffinity-openat$hwrng-preadv-prctl$PR_SCHED_CORE-getpid-process_vm_readv-prctl$PR_SCHED_CORE-bpf$MAP_CREATE_CONST_STR-writev-madvise-shmget$private-shmctl$SHM_STAT-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-close-write$RDMA_USER_CM_CMD_ACCEPT-socket$nl_generic-socket$unix-syz_genetlink_get_family_id$ethtool-socket$nl_generic-syz_genetlink_get_family_id$ethtool detailed listing: executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000140)="f8c21f4bc6399e4abef3caa95c18e756720b0e0d2ca0dfc6a7764ee163ed5b27210966662239d539b0b8979c58453bfe87a23b32e26af342b545adecbb34d6ec75fe8b831db2d585923e3ef4d58489bad96e5c71f3dee89d89fe1aaf5eb7199ac9c0da47a2ee58c7efa44ec58ce18a4ef43112bd575a539b40", 0x79}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socket$nl_route-sendmsg$nl_route-sendmsg$nl_route detailed listing: executing program 0: syz_emit_ethernet(0x4f, &(0x7f0000000000)={@remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @val={@val={0x88a8, 0x1, 0x0, 0x3}, {0x8100, 0x6, 0x1, 0x4}}, {@x25={0x805, {0x2, 0x2, 0x17, "724fdeff1154e521cee75aac1a3f05e260f0e08a803ef98ac694ffa6e1d0494625c2a791793b92866f10db317ac8e0fc9b6afd4c759d"}}}}, &(0x7f0000000080)={0x1, 0x4, [0xf1e, 0x1, 0xb7d, 0x8e1]}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028008000d0001000000080014000000000006000300917000000600100000000000040012"], 0x5c}, 0x1, 0xba01}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028008000d0001000000080014000000000006000300917000000600100000000000040012"], 0x5c}, 0x1, 0xba01}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_ENUM_FMT-sendmsg$kcm-syz_usb_connect-socket$rxrpc-close_range-bind$rxrpc-syz_usb_connect-syz_usb_connect-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-socket$nl_route-setsockopt$netlink_NETLINK_TX_RING-recvmmsg detailed listing: executing program 0: r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xeb, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000ac0)={0xf, 0x1, 0x0, "f7877c0a0e4407413af4c7caa29b00b04a7d0000dff4ffffff000000e900"}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)="d8000000140081044e81f782db44b9040a1d08020a000000040000a118000200ff11000000000e1208000f0100810401a80016ea1f0008400304000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a", 0xbd}], 0x1, 0x0, 0x0, 0x7400}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000183b9220b113420016580102030109021b00010000000009040000012e459e00090504"], 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$rxrpc(r1, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private0}}, 0x24) syz_usb_connect(0x0, 0x41, &(0x7f0000000040)=ANY=[@ANYRESDEC], 0x0) syz_usb_connect(0x6, 0x36, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f00000000c0)={@val={0x8, 0x800}, @val, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0xd, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x0, 0x88a8, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0xfffe}, {"77d9"}}}}, 0x38) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000003400), 0x0, 0x100, &(0x7f0000003500)={0x77359400}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-socket$nl_route-socket$nl_route-ioctl$sock_SIOCGIFINDEX-ioctl$KVM_IOEVENTFD-prctl$PR_SCHED_CORE-sched_setaffinity-openat$hwrng-preadv-openat$binderfs-ioctl$HIDIOCGRDESC-openat$binderfs-openat$binderfs-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-ioctl$AUTOFS_IOC_SETTIMEOUT-openat$fb0-ioctl$FBIOPUT_CON2FBMAP-socket$nl_route-sendmsg$nl_route-syz_usb_connect-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_MON_PEER_GET-madvise-get_mempolicy-socket$nl_generic-sendmsg$TIPC_NL_NAME_TABLE_GET-mmap detailed listing: executing program 0: socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$HIDIOCGRDESC(r1, 0x90044802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000480)=[@request_death], 0x0, 0x0, 0x0}) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r3, 0x4610, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x8, 0x1, [{0x5}]}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x30}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x1c, 0x58, 0xf0, 0x40, 0x12d1, 0xfa3, 0xd910, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xab, 0x0, 0x2, 0xff, 0x6, 0x6e, 0x0, [], [{{0x9, 0x5, 0x84, 0x10, 0x20, 0x2, 0x1, 0x9}}, {{0x9, 0x5, 0x4, 0x10, 0x3ff, 0x7, 0x5, 0x2}}]}}]}}]}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x40, r6, 0xb03, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x40}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f0000439000/0x2000)=nil, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NAME_TABLE_GET(r7, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000780)={0x360, r6, 0x4, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x40, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xe3b}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xb}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}]}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x10000}]}, @TIPC_NLA_NODE={0x5c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "e0f749d9981f63305af5831fa9d7b2887867d2eba803d8107c4dd2"}}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x64, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x10000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x504}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x61f}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8001}]}, @TIPC_NLA_LINK={0x80, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc60}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3a66de88}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x400}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}]}, @TIPC_NLA_BEARER={0x150, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x10000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xab5d}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6599}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}]}]}, 0x360}, 0x1, 0x0, 0x0, 0xe40c3e7f71fa907f}, 0x44010) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 6m0s testing program (duration=6m7s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 5, 30, 26, 29, 5, 30, 26, 23, 21, 27, 3, 28, 27, 29, 30, 4, 20, 30, 30, 7, 27, 15, 29, 17, 4, 4, 4, 29, 27] detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000006000000850000008600000018110000", @ANYRES32], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r2, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}}, 0x0) executing program 4: lchown(&(0x7f0000000440)='./cgroup/cgroup.procs\x00', 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f00000000c0)={0x1d, r1, 0x0, 0x0, &(0x7f0000000280)}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000280)={0x0, 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) setsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000180), 0x4) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x7, 0x0, 0x10000) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8b", 0x1}], 0x1, 0x0, 0x0, 0x900}, 0x60) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000001c0)={0x60, 0x2, &(0x7f0000ea6000/0xe000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x62}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r4}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0e42, 0x0) preadv(r7, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000580)=ANY=[@ANYRES16=r4, @ANYRES8=0x0], 0x24, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) executing program 4: openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pipe(0x0) io_setup(0x3ff, &(0x7f0000000500)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = signalfd(0xffffffffffffffff, &(0x7f0000001200), 0x8) fgetxattr(r0, &(0x7f0000001440)=@known='security.selinux\x00', &(0x7f0000001480)=""/60, 0x3c) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x8, 0x8, 0x0, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x1}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000030805000000000000000000000000000c0004800800014000000000060002400000000005000300ff"], 0x30}}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0xcf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_clone3(&(0x7f00000004c0)={0x200001000, &(0x7f0000000180), &(0x7f0000000300)=0x0, 0x0, {0xe}, &(0x7f0000000740)=""/238, 0xee, &(0x7f0000000100)=""/54, &(0x7f00000003c0)=[0x0], 0x1}, 0x58) sched_setscheduler(r3, 0x0, &(0x7f0000000000)=0x6) r4 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x2, r4, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r5, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f000044b000/0x1000)=nil, 0x1000, 0x0) pipe(0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f00000003c0)="386d178529a39dea18dd3f87d7a5", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) socket(0x0, 0x2, 0x0) executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000940)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="210f00000000000000002000000008000300", @ANYRES32=r2], 0x1c}}, 0x0) read(r0, 0x0, 0x0) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x20000400) pwritev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0), 0x3e}], 0x1, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x0) socket(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file1/file4/file7\x00', 0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x4) open$dir(&(0x7f0000000300)='./file1/file4\x00', 0x161683, 0x100) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xa40004c4) r2 = open$dir(&(0x7f00000001c0)='./file1/../file0\x00', 0x0, 0x0) mkdirat(r2, &(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mremap(&(0x7f000018d000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mbind(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x0, &(0x7f0000000000)=0x2, 0x7, 0x0) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000002800)={0x5, 0x1, 0x0, "833461025a78ffa177be169916ea42232f59496b79b29963084f401a544b75d0"}) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x270, 0x168, 0x9, 0x0, 0xb, 0x370, 0x250, 0x250, 0x370, 0x250, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', [], [], 'ip6tnl0\x00', 'sit0\x00'}, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@common=@unspec=@addrtype1={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'veth1_to_team\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) r6 = socket(0x29, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r6, 0x89f8, &(0x7f0000000180)={'sit0\x00', &(0x7f0000001a00)}) r7 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r7, 0x40045731, &(0x7f00000002c0)) sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000009c0)=ANY=[@ANYBLOB="44010000100001000000000000000000fe800000000600000000000000000500ac1e0001000000000000000000008a3e00000000000000fc0000000000000000e9c9f646911c26d3f6a587ff01a0d8ec1f21d52811e0b0c82acc44ec586e250a21f76f2b5ce70000000000000000cb7a2fc3e79b3fbda63075dac97832da25590a78958b610c97846e1ddaa7", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="2001000000ffff010000000032000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c000000000000000000", @ANYRES64=r0], 0x144}}, 0x0) executing program 2: socket$kcm(0x10, 0x3, 0x10) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x2, 0x1}, 0x20) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0xa, 0x4e22, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000400)=[@hopopts_2292={{0x18}}, @dstopts={{0x58, 0x29, 0x37, {0x16, 0x1e8, '\x00', [@jumbo, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @empty}}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @broadcast}}, @jumbo, @jumbo, @ra]}}}], 0x70}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0x64, 0x0, 0x371860884d55c0ab, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac02}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "f85013e4"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "aa3406da76"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "fb0d20c9da"}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}]}, 0x64}, 0x1, 0x0, 0x0, 0x24040801}, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x30, 0x0, @ib={0x1b, 0x4, 0x0, {"00000000000000000000000000000001"}}}}, 0x90) r2 = syz_open_dev$usbfs(&(0x7f0000000200), 0x77, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, &(0x7f0000000000)=ANY=[@ANYBLOB="02002303100007"]) openat(0xffffffffffffffff, 0x0, 0x20002, 0x5) openat$cgroup_ro(r1, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc000ff}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000340)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r3, 0xc0182101, &(0x7f00000000c0)={r4}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000080)={r5, 0x3, r3, 0x5}) geteuid() openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) executing program 3: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) unshare(0x20040600) mknod(&(0x7f0000000000)='./bus\x00', 0x1000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) write$binfmt_elf32(r1, &(0x7f00000003c0)=ANY=[@ANYRESOCT], 0x82) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r1, &(0x7f0000000340)='./bus\x00', &(0x7f0000000500)={{0x77359400}, {r2, r3/1000+60000}}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000007c0)={{{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@loopback}}, &(0x7f0000000200)=0xe8) quotactl$Q_GETINFO(0xffffffff80000502, &(0x7f00000001c0)=@md0, r4, &(0x7f0000000300)) close(r1) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000780)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r6, 0x5b03, 0x0) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r3, 0x81044804, &(0x7f0000000400)={0x1}) ioctl$HIDIOCGUSAGE(r2, 0x40184810, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_open_dev$tty20(0xc, 0x4, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702bf0014000000b7030000000000008500000000000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500"/96], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x30, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x1, 0x0}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040880}, 0x200400c4) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) executing program 0: pipe(0x0) socket$nl_route(0x10, 0x3, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x2000000002, 0x0, 0x3, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000300)='1\x00', 0xffffff4a) write$sysctl(r1, &(0x7f0000000000)='2\x00', 0x2) getpgrp(0x0) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x30, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, 0x0, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) writev(r3, &(0x7f00000010c0), 0x0) r4 = io_uring_setup(0x3dd, &(0x7f0000000240)={0x0, 0x7d52, 0x10, 0x1}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b8c07d40450c01800a9000000012090212000100000000090400000080829900"], 0x0) open(&(0x7f0000000100)='./file0\x00', 0x60c2, 0x0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x400017e) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) executing program 2: r0 = socket$inet6(0xa, 0x3, 0x84) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in=@private, 0x4e24, 0x3ff, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x3}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x6c}, 0xa, @in6=@private2, 0x0, 0x4}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x2000000, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) executing program 2: unshare(0x22020600) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000300), 0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x200, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) ioctl$KVM_GET_PIT2(r0, 0x8070ae9f, &(0x7f0000000480)) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000040)='.\x00', 0x440000a0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8983, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001f0000), 0x1000002, 0x0) r3 = dup(r2) r4 = open(&(0x7f0000000100)='./bus\x00', 0x40542, 0x0) r5 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r5, 0x0, 0x0, 0x1001f0) sendfile(r3, r4, 0x0, 0x8000fffffffe) r6 = fcntl$dupfd(r4, 0x0, r4) r7 = dup3(r3, r6, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0x1b) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), r0) sendmsg$TIPC_NL_LINK_SET(r8, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB='H\x00', @ANYRES16=r9, @ANYBLOB="000426bd7000fddbdf25090000001c000780080002004c720000080002000200000008000200000200001800078008000200060000000c0004000000000000130090"], 0x48}, 0x1, 0x0, 0x0, 0x20000004}, 0xbe9ad5817ce3da8a) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, &(0x7f0000000040)) socket(0x40000000015, 0x0, 0x0) r10 = socket(0x15, 0x5, 0x0) getsockopt(r10, 0x200000000114, 0x2713, 0x0, &(0x7f0000000100)) socket$nl_generic(0x10, 0x3, 0x10) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_CLOCK(r2, 0x4188aec6, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) socket$unix(0x1, 0x5, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xfa, 0xcf, 0x1, 0x40, 0x56e, 0x4010, 0x201c, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x91, 0x55, 0xe7}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000600)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x1, 'w'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f00000003c0)=ANY=[@ANYBLOB="200002a033ae00ba"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000240)={0x40, 0xa, 0x2, "5c05"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) preadv(r4, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000140)="f8c21f4bc6399e4abef3caa95c18e756720b0e0d2ca0dfc6a7764ee163ed5b27210966662239d539b0b8979c58453bfe87a23b32e26af342b545adecbb34d6ec75fe8b831db2d585923e3ef4d58489bad96e5c71f3dee89d89fe1aaf5eb7199ac9c0da47a2ee58c7efa44ec58ce18a4ef43112bd575a539b40", 0x79}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x20000400) pwritev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0), 0x3e}], 0x1, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x0) socket(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file1/file4/file7\x00', 0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x4) open$dir(&(0x7f0000000300)='./file1/file4\x00', 0x161683, 0x100) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xa40004c4) r2 = open$dir(&(0x7f00000001c0)='./file1/../file0\x00', 0x0, 0x0) mkdirat(r2, &(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mremap(&(0x7f000018d000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mbind(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x0, &(0x7f0000000000)=0x2, 0x7, 0x0) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000002800)={0x5, 0x1, 0x0, "833461025a78ffa177be169916ea42232f59496b79b29963084f401a544b75d0"}) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x270, 0x168, 0x9, 0x0, 0xb, 0x370, 0x250, 0x250, 0x370, 0x250, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', [], [], 'ip6tnl0\x00', 'sit0\x00'}, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@common=@unspec=@addrtype1={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'veth1_to_team\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) r6 = socket(0x29, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r6, 0x89f8, &(0x7f0000000180)={'sit0\x00', &(0x7f0000001a00)}) r7 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r7, 0x40045731, &(0x7f00000002c0)) sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000009c0)=ANY=[@ANYBLOB="44010000100001000000000000000000fe800000000600000000000000000500ac1e0001000000000000000000008a3e00000000000000fc0000000000000000e9c9f646911c26d3f6a587ff01a0d8ec1f21d52811e0b0c82acc44ec586e250a21f76f2b5ce70000000000000000cb7a2fc3e79b3fbda63075dac97832da25590a78958b610c97846e1ddaa7", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="2001000000ffff010000000032000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c000000000000000000", @ANYRES64=r0], 0x144}}, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB='D\x00\x00!', @ANYRES16=r1, @ANYBLOB="050000000000000000002800000008000300", @ANYRES32=r2, @ANYBLOB="0a00360002020202020200000a0006"], 0x44}}, 0x0) executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1c000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1], 0x20}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x700, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000070000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="0c0001800800010003000100100001800c0004800800020000000000100001"], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x80}, 0x0) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r10, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000000000008d03"]) r11 = dup(r7) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x46221, 0x0) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000080000044d564b"]) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x44002, 0x0) executing program 2: epoll_create1(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000480)='wlan0\x00', 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = io_uring_setup(0x17f7, &(0x7f0000000100)) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r2, 0x0, 0x0) sendto$inet6(r2, &(0x7f00000002c0)="9e", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000000c80)="7cffa9061b2f8b", 0x7, 0xbcff, 0x0, 0x0) sendmsg$inet6(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)='h', 0x1}], 0x1}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r3 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201100182e5e74033073004fb472400000109021200018bfc40400904"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) write$proc_mixer(r3, 0x0, 0xb0) write$proc_mixer(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0xf7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) r5 = syz_io_uring_setup(0x7307, &(0x7f0000000340)={0x0, 0x39f3, 0x10100, 0x3, 0x3}, &(0x7f0000000200), &(0x7f0000000100)=0x0) syz_io_uring_setup(0x1866, &(0x7f0000000140)={0x0, 0x2000}, &(0x7f0000000500)=0x0, &(0x7f0000000240)) syz_io_uring_submit(r7, r6, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r5, 0x184c, 0x0, 0x0, 0x0, 0x0) executing program 0: ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xe, 0x4}, {0x0, 0x400, 0x0, 0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x8}], 0x2}) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd000005000500000000000a"], 0x70}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2}}}}}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001380)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0xfefc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x12, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, &(0x7f0000000180)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x0, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcff"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000780)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @remote}, 0x4a, {}, 'lo\x00'}) socket$netlink(0x10, 0x3, 0x0) mmap$snddsp_control(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x83000000) r4 = openat$fuse(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r3, 0x1, 0x11, 0x0, &(0x7f0000000380)) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000b00)={{'fd', 0x3d, r4}, 0x2c, {}, 0x2c, {'user_id', 0x3d, r5}}) syz_emit_vhci(&(0x7f0000001480)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x6}, @hci_ev_le_phy_update_complete={{}, {0x0, 0xc9}}}}, 0x9) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x28}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001040)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xfff3}, {}, {0x0, 0xa}}}, 0x24}, 0x1, 0x100000000000000}, 0x20040880) executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$snddsp(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x81ff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7, 0x13, r5, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="9306d813d7dcd35750a7408871cdd4a61fe4d48beecb38f12aae45f2f226fe45b578c97ff4bf7fdf7504c5c08a0f1e6bdbaa7b79ce572f50574943f7972d5b84424ff66e3f4143a7fc5e2b4d4cf6018d1cab4e37ecd6531fb3dde7cbebef87c81a", 0x61, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r7 = dup(r6) ioctl$KVM_SET_MSRS(r7, 0x4140aecd, &(0x7f00000001c0)=ANY=[]) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0015000000000000140012800b00010062617461647600"], 0x3c}}, 0x0) r9 = landlock_create_ruleset(&(0x7f00000002c0)={0x309}, 0x10, 0x0) landlock_restrict_self(r9, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) sendmsg$nl_route(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c0000005e000100"/17, @ANYRES8], 0x4e}}, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./file1/file2\x00', 0x2) socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x4f, &(0x7f0000000640)={{0x12, 0x1, 0x0, 0x3d, 0xa3, 0x77, 0x20, 0x572, 0xcafe, 0x5501, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x4, 0x96, 0xdb, 0xa8, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "e37e1b82e6"}]}}, {{0x9, 0x5, 0xb, 0x2}}, {{0x9, 0x5, 0x1}}, {{0x9, 0x5, 0x2, 0x0, 0x10}}]}}]}}]}}, 0x0) syz_usb_connect(0x6, 0x0, 0x0, &(0x7f0000001440)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x300, 0xa, 0x8, 0x1, 0x8, 0x9}, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x5, [{0x0, 0x0}, {0xc7, &(0x7f0000000280)=@string={0xc7, 0x3, "0288193689aedb64acb06ccf113193a9a82e2788ee7cca10055f28778c20e6003c81c38c8fb0fe5153fe5acc0b6d7d20f4c7f7ccb0a6044eb6f51dab36b82caec069207cf3c3689fa0e4786fa98cf993706cac46178aa51aa33bd605f0b3e711749bbbc138b22cbb25657b62f3362365f008ee5d1f8676f8ecd9e46f973808be070aca59ca05f7ac150c509476a00b1138cab2bc56015cc9f3211c0671821f384a6057ebd92eb094d309cea76f5c0d27bd8a552dd040ab8d38eacbe4551548e34b60c52612"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x100c}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0xfcff}}, {0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x411}}]}) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) unshare(0x22020400) getpeername$netlink(0xffffffffffffffff, 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x204000, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket(0x2, 0x6, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000c00)=@raw={'raw\x00', 0x4018, 0x3, 0x230, 0x0, 0x0, 0x148, 0x108, 0x148, 0x198, 0x240, 0x240, 0x198, 0x240, 0x7fffffe, 0x0, {[{{@ip={@loopback=0x7f002600, @local, 0x0, 0x0, 'pim6reg1\x00', 'netdevsim0\x00'}, 0x0, 0xe8, 0x108, 0x0, {}, [@common=@inet=@set4={{0x50}}, @common=@unspec=@connlabel={{0x28}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x290) io_setup(0x222, &(0x7f0000000180)=0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/bus/input/devices\x00', 0x0, 0x0) io_submit(r3, 0x2, &(0x7f0000001500)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x1000, r4, &(0x7f0000000280)='\f', 0x1}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7, 0x0, r5, 0x0}]) setsockopt$inet_tcp_int(r5, 0x6, 0xa, &(0x7f00000000c0)=0x274, 0x4) write$vga_arbiter(r1, &(0x7f0000000080)=@target={'target ', {'PCI:', '4', ':', 'f', ':', '6', '.', '1f'}}, 0x14) executing program 3: socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$HIDIOCGRDESC(r1, 0x90044802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000480)=[@request_death], 0x0, 0x0, 0x0}) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r3, 0x4610, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x8, 0x1, [{0x5}]}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x30}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x1c, 0x58, 0xf0, 0x40, 0x12d1, 0xfa3, 0xd910, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xab, 0x0, 0x2, 0xff, 0x6, 0x6e, 0x0, [], [{{0x9, 0x5, 0x84, 0x10, 0x20, 0x2, 0x1, 0x9}}, {{0x9, 0x5, 0x4, 0x10, 0x3ff, 0x7, 0x5, 0x2}}]}}]}}]}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x40, r6, 0xb03, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x40}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f0000439000/0x2000)=nil, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NAME_TABLE_GET(r7, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000780)={0x360, r6, 0x4, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x40, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xe3b}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xb}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}]}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x10000}]}, @TIPC_NLA_NODE={0x5c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "e0f749d9981f63305af5831fa9d7b2887867d2eba803d8107c4dd2"}}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x64, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x10000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x504}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x61f}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8001}]}, @TIPC_NLA_LINK={0x80, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc60}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3a66de88}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x400}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}]}, @TIPC_NLA_BEARER={0x150, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x10000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xab5d}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6599}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}]}]}, 0x360}, 0x1, 0x0, 0x0, 0xe40c3e7f71fa907f}, 0x44010) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) executing program 0: r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xeb, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000ac0)={0xf, 0x1, 0x0, "f7877c0a0e4407413af4c7caa29b00b04a7d0000dff4ffffff000000e900"}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)="d8000000140081044e81f782db44b9040a1d08020a000000040000a118000200ff11000000000e1208000f0100810401a80016ea1f0008400304000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a", 0xbd}], 0x1, 0x0, 0x0, 0x7400}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000183b9220b113420016580102030109021b00010000000009040000012e459e00090504"], 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$rxrpc(r1, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private0}}, 0x24) syz_usb_connect(0x0, 0x41, &(0x7f0000000040)=ANY=[@ANYRESDEC], 0x0) syz_usb_connect(0x6, 0x36, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f00000000c0)={@val={0x8, 0x800}, @val, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0xd, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x0, 0x88a8, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0xfffe}, {"77d9"}}}}, 0x38) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000003400), 0x0, 0x100, &(0x7f0000003500)={0x77359400}) executing program 4: syz_emit_ethernet(0x4f, &(0x7f0000000000)={@remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @val={@val={0x88a8, 0x1, 0x0, 0x3}, {0x8100, 0x6, 0x1, 0x4}}, {@x25={0x805, {0x2, 0x2, 0x17, "724fdeff1154e521cee75aac1a3f05e260f0e08a803ef98ac694ffa6e1d0494625c2a791793b92866f10db317ac8e0fc9b6afd4c759d"}}}}, &(0x7f0000000080)={0x1, 0x4, [0xf1e, 0x1, 0xb7d, 0x8e1]}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028008000d0001000000080014000000000006000300917000000600100000000000040012"], 0x5c}, 0x1, 0xba01}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028008000d0001000000080014000000000006000300917000000600100000000000040012"], 0x5c}, 0x1, 0xba01}, 0x0) executing program 1: r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000040)='.\x00', 0x440000a0) r1 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r1, 0x2000000, 0x0, 0x1001f0) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'geneve1\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b050600f4ff020006004788aa96a13bb1000011000088ca1a00", 0x1001a, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000140)="f8c21f4bc6399e4abef3caa95c18e756720b0e0d2ca0dfc6a7764ee163ed5b27210966662239d539b0b8979c58453bfe87a23b32e26af342b545adecbb34d6ec75fe8b831db2d585923e3ef4d58489bad96e5c71f3dee89d89fe1aaf5eb7199ac9c0da47a2ee58c7efa44ec58ce18a4ef43112bd575a539b40", 0x79}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) executing program 2: pipe(0x0) socket$nl_route(0x10, 0x3, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x2000000002, 0x0, 0x3, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000300)='1\x00', 0xffffff4a) write$sysctl(r1, &(0x7f0000000000)='2\x00', 0x2) getpgrp(0x0) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x30, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, 0x0, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) writev(r3, &(0x7f00000010c0), 0x0) r4 = io_uring_setup(0x3dd, &(0x7f0000000240)={0x0, 0x7d52, 0x10, 0x1}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b8c07d40450c01800a9000000012090212000100000000090400000080829900"], 0x0) open(&(0x7f0000000100)='./file0\x00', 0x60c2, 0x0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x400017e) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) program crashed: INFO: task hung in addrconf_dad_work bisect: bisecting 30 programs bisect: split chunks (needed=false): <30> bisect: split chunk #0 of len 30 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 3, 28, 27, 29, 30, 4, 20, 30, 30, 7, 27, 15, 29, 17, 4, 4, 4, 29, 27] detailed listing: executing program 0: pipe(0x0) socket$nl_route(0x10, 0x3, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x2000000002, 0x0, 0x3, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000300)='1\x00', 0xffffff4a) write$sysctl(r1, &(0x7f0000000000)='2\x00', 0x2) getpgrp(0x0) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x30, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, 0x0, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) writev(r3, &(0x7f00000010c0), 0x0) r4 = io_uring_setup(0x3dd, &(0x7f0000000240)={0x0, 0x7d52, 0x10, 0x1}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b8c07d40450c01800a9000000012090212000100000000090400000080829900"], 0x0) open(&(0x7f0000000100)='./file0\x00', 0x60c2, 0x0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x400017e) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) executing program 2: r0 = socket$inet6(0xa, 0x3, 0x84) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in=@private, 0x4e24, 0x3ff, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x3}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x6c}, 0xa, @in6=@private2, 0x0, 0x4}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x2000000, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) executing program 2: unshare(0x22020600) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000300), 0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x200, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) ioctl$KVM_GET_PIT2(r0, 0x8070ae9f, &(0x7f0000000480)) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000040)='.\x00', 0x440000a0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8983, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001f0000), 0x1000002, 0x0) r3 = dup(r2) r4 = open(&(0x7f0000000100)='./bus\x00', 0x40542, 0x0) r5 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r5, 0x0, 0x0, 0x1001f0) sendfile(r3, r4, 0x0, 0x8000fffffffe) r6 = fcntl$dupfd(r4, 0x0, r4) r7 = dup3(r3, r6, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0x1b) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), r0) sendmsg$TIPC_NL_LINK_SET(r8, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB='H\x00', @ANYRES16=r9, @ANYBLOB="000426bd7000fddbdf25090000001c000780080002004c720000080002000200000008000200000200001800078008000200060000000c0004000000000000130090"], 0x48}, 0x1, 0x0, 0x0, 0x20000004}, 0xbe9ad5817ce3da8a) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, &(0x7f0000000040)) socket(0x40000000015, 0x0, 0x0) r10 = socket(0x15, 0x5, 0x0) getsockopt(r10, 0x200000000114, 0x2713, 0x0, &(0x7f0000000100)) socket$nl_generic(0x10, 0x3, 0x10) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_CLOCK(r2, 0x4188aec6, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) socket$unix(0x1, 0x5, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xfa, 0xcf, 0x1, 0x40, 0x56e, 0x4010, 0x201c, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x91, 0x55, 0xe7}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000600)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x1, 'w'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f00000003c0)=ANY=[@ANYBLOB="200002a033ae00ba"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000240)={0x40, 0xa, 0x2, "5c05"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) preadv(r4, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000140)="f8c21f4bc6399e4abef3caa95c18e756720b0e0d2ca0dfc6a7764ee163ed5b27210966662239d539b0b8979c58453bfe87a23b32e26af342b545adecbb34d6ec75fe8b831db2d585923e3ef4d58489bad96e5c71f3dee89d89fe1aaf5eb7199ac9c0da47a2ee58c7efa44ec58ce18a4ef43112bd575a539b40", 0x79}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x20000400) pwritev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0), 0x3e}], 0x1, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x0) socket(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file1/file4/file7\x00', 0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x4) open$dir(&(0x7f0000000300)='./file1/file4\x00', 0x161683, 0x100) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xa40004c4) r2 = open$dir(&(0x7f00000001c0)='./file1/../file0\x00', 0x0, 0x0) mkdirat(r2, &(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mremap(&(0x7f000018d000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mbind(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x0, &(0x7f0000000000)=0x2, 0x7, 0x0) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000002800)={0x5, 0x1, 0x0, "833461025a78ffa177be169916ea42232f59496b79b29963084f401a544b75d0"}) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x270, 0x168, 0x9, 0x0, 0xb, 0x370, 0x250, 0x250, 0x370, 0x250, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', [], [], 'ip6tnl0\x00', 'sit0\x00'}, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@common=@unspec=@addrtype1={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'veth1_to_team\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) r6 = socket(0x29, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r6, 0x89f8, &(0x7f0000000180)={'sit0\x00', &(0x7f0000001a00)}) r7 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r7, 0x40045731, &(0x7f00000002c0)) sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000009c0)=ANY=[@ANYBLOB="44010000100001000000000000000000fe800000000600000000000000000500ac1e0001000000000000000000008a3e00000000000000fc0000000000000000e9c9f646911c26d3f6a587ff01a0d8ec1f21d52811e0b0c82acc44ec586e250a21f76f2b5ce70000000000000000cb7a2fc3e79b3fbda63075dac97832da25590a78958b610c97846e1ddaa7", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="2001000000ffff010000000032000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c000000000000000000", @ANYRES64=r0], 0x144}}, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB='D\x00\x00!', @ANYRES16=r1, @ANYBLOB="050000000000000000002800000008000300", @ANYRES32=r2, @ANYBLOB="0a00360002020202020200000a0006"], 0x44}}, 0x0) executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1c000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1], 0x20}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x700, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000070000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="0c0001800800010003000100100001800c0004800800020000000000100001"], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x80}, 0x0) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r10, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000000000008d03"]) r11 = dup(r7) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x46221, 0x0) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000080000044d564b"]) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x44002, 0x0) executing program 2: epoll_create1(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000480)='wlan0\x00', 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = io_uring_setup(0x17f7, &(0x7f0000000100)) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r2, 0x0, 0x0) sendto$inet6(r2, &(0x7f00000002c0)="9e", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000000c80)="7cffa9061b2f8b", 0x7, 0xbcff, 0x0, 0x0) sendmsg$inet6(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)='h', 0x1}], 0x1}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r3 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201100182e5e74033073004fb472400000109021200018bfc40400904"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) write$proc_mixer(r3, 0x0, 0xb0) write$proc_mixer(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0xf7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) r5 = syz_io_uring_setup(0x7307, &(0x7f0000000340)={0x0, 0x39f3, 0x10100, 0x3, 0x3}, &(0x7f0000000200), &(0x7f0000000100)=0x0) syz_io_uring_setup(0x1866, &(0x7f0000000140)={0x0, 0x2000}, &(0x7f0000000500)=0x0, &(0x7f0000000240)) syz_io_uring_submit(r7, r6, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r5, 0x184c, 0x0, 0x0, 0x0, 0x0) executing program 0: ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xe, 0x4}, {0x0, 0x400, 0x0, 0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x8}], 0x2}) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd000005000500000000000a"], 0x70}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2}}}}}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001380)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0xfefc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x12, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, &(0x7f0000000180)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x0, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcff"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000780)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @remote}, 0x4a, {}, 'lo\x00'}) socket$netlink(0x10, 0x3, 0x0) mmap$snddsp_control(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x83000000) r4 = openat$fuse(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r3, 0x1, 0x11, 0x0, &(0x7f0000000380)) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000b00)={{'fd', 0x3d, r4}, 0x2c, {}, 0x2c, {'user_id', 0x3d, r5}}) syz_emit_vhci(&(0x7f0000001480)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x6}, @hci_ev_le_phy_update_complete={{}, {0x0, 0xc9}}}}, 0x9) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x28}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001040)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xfff3}, {}, {0x0, 0xa}}}, 0x24}, 0x1, 0x100000000000000}, 0x20040880) executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$snddsp(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x81ff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7, 0x13, r5, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="9306d813d7dcd35750a7408871cdd4a61fe4d48beecb38f12aae45f2f226fe45b578c97ff4bf7fdf7504c5c08a0f1e6bdbaa7b79ce572f50574943f7972d5b84424ff66e3f4143a7fc5e2b4d4cf6018d1cab4e37ecd6531fb3dde7cbebef87c81a", 0x61, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r7 = dup(r6) ioctl$KVM_SET_MSRS(r7, 0x4140aecd, &(0x7f00000001c0)=ANY=[]) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0015000000000000140012800b00010062617461647600"], 0x3c}}, 0x0) r9 = landlock_create_ruleset(&(0x7f00000002c0)={0x309}, 0x10, 0x0) landlock_restrict_self(r9, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) sendmsg$nl_route(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c0000005e000100"/17, @ANYRES8], 0x4e}}, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./file1/file2\x00', 0x2) socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x4f, &(0x7f0000000640)={{0x12, 0x1, 0x0, 0x3d, 0xa3, 0x77, 0x20, 0x572, 0xcafe, 0x5501, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x4, 0x96, 0xdb, 0xa8, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "e37e1b82e6"}]}}, {{0x9, 0x5, 0xb, 0x2}}, {{0x9, 0x5, 0x1}}, {{0x9, 0x5, 0x2, 0x0, 0x10}}]}}]}}]}}, 0x0) syz_usb_connect(0x6, 0x0, 0x0, &(0x7f0000001440)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x300, 0xa, 0x8, 0x1, 0x8, 0x9}, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x5, [{0x0, 0x0}, {0xc7, &(0x7f0000000280)=@string={0xc7, 0x3, "0288193689aedb64acb06ccf113193a9a82e2788ee7cca10055f28778c20e6003c81c38c8fb0fe5153fe5acc0b6d7d20f4c7f7ccb0a6044eb6f51dab36b82caec069207cf3c3689fa0e4786fa98cf993706cac46178aa51aa33bd605f0b3e711749bbbc138b22cbb25657b62f3362365f008ee5d1f8676f8ecd9e46f973808be070aca59ca05f7ac150c509476a00b1138cab2bc56015cc9f3211c0671821f384a6057ebd92eb094d309cea76f5c0d27bd8a552dd040ab8d38eacbe4551548e34b60c52612"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x100c}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0xfcff}}, {0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x411}}]}) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) unshare(0x22020400) getpeername$netlink(0xffffffffffffffff, 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x204000, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket(0x2, 0x6, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000c00)=@raw={'raw\x00', 0x4018, 0x3, 0x230, 0x0, 0x0, 0x148, 0x108, 0x148, 0x198, 0x240, 0x240, 0x198, 0x240, 0x7fffffe, 0x0, {[{{@ip={@loopback=0x7f002600, @local, 0x0, 0x0, 'pim6reg1\x00', 'netdevsim0\x00'}, 0x0, 0xe8, 0x108, 0x0, {}, [@common=@inet=@set4={{0x50}}, @common=@unspec=@connlabel={{0x28}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x290) io_setup(0x222, &(0x7f0000000180)=0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/bus/input/devices\x00', 0x0, 0x0) io_submit(r3, 0x2, &(0x7f0000001500)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x1000, r4, &(0x7f0000000280)='\f', 0x1}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7, 0x0, r5, 0x0}]) setsockopt$inet_tcp_int(r5, 0x6, 0xa, &(0x7f00000000c0)=0x274, 0x4) write$vga_arbiter(r1, &(0x7f0000000080)=@target={'target ', {'PCI:', '4', ':', 'f', ':', '6', '.', '1f'}}, 0x14) executing program 3: socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$HIDIOCGRDESC(r1, 0x90044802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000480)=[@request_death], 0x0, 0x0, 0x0}) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r3, 0x4610, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x8, 0x1, [{0x5}]}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x30}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x1c, 0x58, 0xf0, 0x40, 0x12d1, 0xfa3, 0xd910, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xab, 0x0, 0x2, 0xff, 0x6, 0x6e, 0x0, [], [{{0x9, 0x5, 0x84, 0x10, 0x20, 0x2, 0x1, 0x9}}, {{0x9, 0x5, 0x4, 0x10, 0x3ff, 0x7, 0x5, 0x2}}]}}]}}]}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x40, r6, 0xb03, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x40}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f0000439000/0x2000)=nil, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NAME_TABLE_GET(r7, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000780)={0x360, r6, 0x4, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x40, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xe3b}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xb}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}]}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x10000}]}, @TIPC_NLA_NODE={0x5c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "e0f749d9981f63305af5831fa9d7b2887867d2eba803d8107c4dd2"}}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x64, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x10000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x504}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x61f}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8001}]}, @TIPC_NLA_LINK={0x80, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc60}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3a66de88}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x400}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}]}, @TIPC_NLA_BEARER={0x150, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x10000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xab5d}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6599}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}]}]}, 0x360}, 0x1, 0x0, 0x0, 0xe40c3e7f71fa907f}, 0x44010) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) executing program 0: r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xeb, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000ac0)={0xf, 0x1, 0x0, "f7877c0a0e4407413af4c7caa29b00b04a7d0000dff4ffffff000000e900"}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)="d8000000140081044e81f782db44b9040a1d08020a000000040000a118000200ff11000000000e1208000f0100810401a80016ea1f0008400304000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a", 0xbd}], 0x1, 0x0, 0x0, 0x7400}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000183b9220b113420016580102030109021b00010000000009040000012e459e00090504"], 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$rxrpc(r1, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private0}}, 0x24) syz_usb_connect(0x0, 0x41, &(0x7f0000000040)=ANY=[@ANYRESDEC], 0x0) syz_usb_connect(0x6, 0x36, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f00000000c0)={@val={0x8, 0x800}, @val, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0xd, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x0, 0x88a8, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0xfffe}, {"77d9"}}}}, 0x38) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000003400), 0x0, 0x100, &(0x7f0000003500)={0x77359400}) executing program 4: syz_emit_ethernet(0x4f, &(0x7f0000000000)={@remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @val={@val={0x88a8, 0x1, 0x0, 0x3}, {0x8100, 0x6, 0x1, 0x4}}, {@x25={0x805, {0x2, 0x2, 0x17, "724fdeff1154e521cee75aac1a3f05e260f0e08a803ef98ac694ffa6e1d0494625c2a791793b92866f10db317ac8e0fc9b6afd4c759d"}}}}, &(0x7f0000000080)={0x1, 0x4, [0xf1e, 0x1, 0xb7d, 0x8e1]}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028008000d0001000000080014000000000006000300917000000600100000000000040012"], 0x5c}, 0x1, 0xba01}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028008000d0001000000080014000000000006000300917000000600100000000000040012"], 0x5c}, 0x1, 0xba01}, 0x0) executing program 1: r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000040)='.\x00', 0x440000a0) r1 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r1, 0x2000000, 0x0, 0x1001f0) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'geneve1\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b050600f4ff020006004788aa96a13bb1000011000088ca1a00", 0x1001a, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000140)="f8c21f4bc6399e4abef3caa95c18e756720b0e0d2ca0dfc6a7764ee163ed5b27210966662239d539b0b8979c58453bfe87a23b32e26af342b545adecbb34d6ec75fe8b831db2d585923e3ef4d58489bad96e5c71f3dee89d89fe1aaf5eb7199ac9c0da47a2ee58c7efa44ec58ce18a4ef43112bd575a539b40", 0x79}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) executing program 2: pipe(0x0) socket$nl_route(0x10, 0x3, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x2000000002, 0x0, 0x3, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000300)='1\x00', 0xffffff4a) write$sysctl(r1, &(0x7f0000000000)='2\x00', 0x2) getpgrp(0x0) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x30, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, 0x0, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) writev(r3, &(0x7f00000010c0), 0x0) r4 = io_uring_setup(0x3dd, &(0x7f0000000240)={0x0, 0x7d52, 0x10, 0x1}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b8c07d40450c01800a9000000012090212000100000000090400000080829900"], 0x0) open(&(0x7f0000000100)='./file0\x00', 0x60c2, 0x0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x400017e) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 5, 30, 26, 29, 5, 30, 26, 23, 21, 7, 27, 15, 29, 17, 4, 4, 4, 29, 27] detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000006000000850000008600000018110000", @ANYRES32], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r2, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}}, 0x0) executing program 4: lchown(&(0x7f0000000440)='./cgroup/cgroup.procs\x00', 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f00000000c0)={0x1d, r1, 0x0, 0x0, &(0x7f0000000280)}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000280)={0x0, 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) setsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000180), 0x4) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x7, 0x0, 0x10000) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8b", 0x1}], 0x1, 0x0, 0x0, 0x900}, 0x60) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000001c0)={0x60, 0x2, &(0x7f0000ea6000/0xe000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x62}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r4}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0e42, 0x0) preadv(r7, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000580)=ANY=[@ANYRES16=r4, @ANYRES8=0x0], 0x24, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) executing program 4: openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pipe(0x0) io_setup(0x3ff, &(0x7f0000000500)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = signalfd(0xffffffffffffffff, &(0x7f0000001200), 0x8) fgetxattr(r0, &(0x7f0000001440)=@known='security.selinux\x00', &(0x7f0000001480)=""/60, 0x3c) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x8, 0x8, 0x0, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x1}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000030805000000000000000000000000000c0004800800014000000000060002400000000005000300ff"], 0x30}}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0xcf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_clone3(&(0x7f00000004c0)={0x200001000, &(0x7f0000000180), &(0x7f0000000300)=0x0, 0x0, {0xe}, &(0x7f0000000740)=""/238, 0xee, &(0x7f0000000100)=""/54, &(0x7f00000003c0)=[0x0], 0x1}, 0x58) sched_setscheduler(r3, 0x0, &(0x7f0000000000)=0x6) r4 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x2, r4, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r5, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f000044b000/0x1000)=nil, 0x1000, 0x0) pipe(0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f00000003c0)="386d178529a39dea18dd3f87d7a5", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) socket(0x0, 0x2, 0x0) executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000940)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="210f00000000000000002000000008000300", @ANYRES32=r2], 0x1c}}, 0x0) read(r0, 0x0, 0x0) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x20000400) pwritev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0), 0x3e}], 0x1, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x0) socket(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file1/file4/file7\x00', 0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x4) open$dir(&(0x7f0000000300)='./file1/file4\x00', 0x161683, 0x100) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xa40004c4) r2 = open$dir(&(0x7f00000001c0)='./file1/../file0\x00', 0x0, 0x0) mkdirat(r2, &(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mremap(&(0x7f000018d000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mbind(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x0, &(0x7f0000000000)=0x2, 0x7, 0x0) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000002800)={0x5, 0x1, 0x0, "833461025a78ffa177be169916ea42232f59496b79b29963084f401a544b75d0"}) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x270, 0x168, 0x9, 0x0, 0xb, 0x370, 0x250, 0x250, 0x370, 0x250, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', [], [], 'ip6tnl0\x00', 'sit0\x00'}, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@common=@unspec=@addrtype1={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'veth1_to_team\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) r6 = socket(0x29, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r6, 0x89f8, &(0x7f0000000180)={'sit0\x00', &(0x7f0000001a00)}) r7 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r7, 0x40045731, &(0x7f00000002c0)) sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000009c0)=ANY=[@ANYBLOB="44010000100001000000000000000000fe800000000600000000000000000500ac1e0001000000000000000000008a3e00000000000000fc0000000000000000e9c9f646911c26d3f6a587ff01a0d8ec1f21d52811e0b0c82acc44ec586e250a21f76f2b5ce70000000000000000cb7a2fc3e79b3fbda63075dac97832da25590a78958b610c97846e1ddaa7", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="2001000000ffff010000000032000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c000000000000000000", @ANYRES64=r0], 0x144}}, 0x0) executing program 2: socket$kcm(0x10, 0x3, 0x10) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x2, 0x1}, 0x20) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0xa, 0x4e22, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000400)=[@hopopts_2292={{0x18}}, @dstopts={{0x58, 0x29, 0x37, {0x16, 0x1e8, '\x00', [@jumbo, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @empty}}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @broadcast}}, @jumbo, @jumbo, @ra]}}}], 0x70}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0x64, 0x0, 0x371860884d55c0ab, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac02}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "f85013e4"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "aa3406da76"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "fb0d20c9da"}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}]}, 0x64}, 0x1, 0x0, 0x0, 0x24040801}, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x30, 0x0, @ib={0x1b, 0x4, 0x0, {"00000000000000000000000000000001"}}}}, 0x90) r2 = syz_open_dev$usbfs(&(0x7f0000000200), 0x77, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, &(0x7f0000000000)=ANY=[@ANYBLOB="02002303100007"]) openat(0xffffffffffffffff, 0x0, 0x20002, 0x5) openat$cgroup_ro(r1, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc000ff}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000340)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r3, 0xc0182101, &(0x7f00000000c0)={r4}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000080)={r5, 0x3, r3, 0x5}) geteuid() openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) executing program 3: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) unshare(0x20040600) mknod(&(0x7f0000000000)='./bus\x00', 0x1000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) write$binfmt_elf32(r1, &(0x7f00000003c0)=ANY=[@ANYRESOCT], 0x82) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r1, &(0x7f0000000340)='./bus\x00', &(0x7f0000000500)={{0x77359400}, {r2, r3/1000+60000}}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000007c0)={{{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@loopback}}, &(0x7f0000000200)=0xe8) quotactl$Q_GETINFO(0xffffffff80000502, &(0x7f00000001c0)=@md0, r4, &(0x7f0000000300)) close(r1) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000780)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r6, 0x5b03, 0x0) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r3, 0x81044804, &(0x7f0000000400)={0x1}) ioctl$HIDIOCGUSAGE(r2, 0x40184810, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_open_dev$tty20(0xc, 0x4, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702bf0014000000b7030000000000008500000000000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500"/96], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x30, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x1, 0x0}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040880}, 0x200400c4) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x28}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001040)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xfff3}, {}, {0x0, 0xa}}}, 0x24}, 0x1, 0x100000000000000}, 0x20040880) executing program 1: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$snddsp(r0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x81ff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7, 0x13, r5, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="9306d813d7dcd35750a7408871cdd4a61fe4d48beecb38f12aae45f2f226fe45b578c97ff4bf7fdf7504c5c08a0f1e6bdbaa7b79ce572f50574943f7972d5b84424ff66e3f4143a7fc5e2b4d4cf6018d1cab4e37ecd6531fb3dde7cbebef87c81a", 0x61, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r7 = dup(r6) ioctl$KVM_SET_MSRS(r7, 0x4140aecd, &(0x7f00000001c0)=ANY=[]) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0015000000000000140012800b00010062617461647600"], 0x3c}}, 0x0) r9 = landlock_create_ruleset(&(0x7f00000002c0)={0x309}, 0x10, 0x0) landlock_restrict_self(r9, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) sendmsg$nl_route(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c0000005e000100"/17, @ANYRES8], 0x4e}}, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./file1/file2\x00', 0x2) socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x4f, &(0x7f0000000640)={{0x12, 0x1, 0x0, 0x3d, 0xa3, 0x77, 0x20, 0x572, 0xcafe, 0x5501, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x4, 0x96, 0xdb, 0xa8, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "e37e1b82e6"}]}}, {{0x9, 0x5, 0xb, 0x2}}, {{0x9, 0x5, 0x1}}, {{0x9, 0x5, 0x2, 0x0, 0x10}}]}}]}}]}}, 0x0) syz_usb_connect(0x6, 0x0, 0x0, &(0x7f0000001440)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x300, 0xa, 0x8, 0x1, 0x8, 0x9}, 0x5, &(0x7f00000001c0)={0x5, 0xf, 0x5}, 0x5, [{0x0, 0x0}, {0xc7, &(0x7f0000000280)=@string={0xc7, 0x3, "0288193689aedb64acb06ccf113193a9a82e2788ee7cca10055f28778c20e6003c81c38c8fb0fe5153fe5acc0b6d7d20f4c7f7ccb0a6044eb6f51dab36b82caec069207cf3c3689fa0e4786fa98cf993706cac46178aa51aa33bd605f0b3e711749bbbc138b22cbb25657b62f3362365f008ee5d1f8676f8ecd9e46f973808be070aca59ca05f7ac150c509476a00b1138cab2bc56015cc9f3211c0671821f384a6057ebd92eb094d309cea76f5c0d27bd8a552dd040ab8d38eacbe4551548e34b60c52612"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x100c}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0xfcff}}, {0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x411}}]}) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) unshare(0x22020400) getpeername$netlink(0xffffffffffffffff, 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x204000, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket(0x2, 0x6, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000c00)=@raw={'raw\x00', 0x4018, 0x3, 0x230, 0x0, 0x0, 0x148, 0x108, 0x148, 0x198, 0x240, 0x240, 0x198, 0x240, 0x7fffffe, 0x0, {[{{@ip={@loopback=0x7f002600, @local, 0x0, 0x0, 'pim6reg1\x00', 'netdevsim0\x00'}, 0x0, 0xe8, 0x108, 0x0, {}, [@common=@inet=@set4={{0x50}}, @common=@unspec=@connlabel={{0x28}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x290) io_setup(0x222, &(0x7f0000000180)=0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/bus/input/devices\x00', 0x0, 0x0) io_submit(r3, 0x2, &(0x7f0000001500)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x1000, r4, &(0x7f0000000280)='\f', 0x1}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7, 0x0, r5, 0x0}]) setsockopt$inet_tcp_int(r5, 0x6, 0xa, &(0x7f00000000c0)=0x274, 0x4) write$vga_arbiter(r1, &(0x7f0000000080)=@target={'target ', {'PCI:', '4', ':', 'f', ':', '6', '.', '1f'}}, 0x14) executing program 3: socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$HIDIOCGRDESC(r1, 0x90044802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000480)=[@request_death], 0x0, 0x0, 0x0}) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r3, 0x4610, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x8, 0x1, [{0x5}]}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x30}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x1c, 0x58, 0xf0, 0x40, 0x12d1, 0xfa3, 0xd910, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xab, 0x0, 0x2, 0xff, 0x6, 0x6e, 0x0, [], [{{0x9, 0x5, 0x84, 0x10, 0x20, 0x2, 0x1, 0x9}}, {{0x9, 0x5, 0x4, 0x10, 0x3ff, 0x7, 0x5, 0x2}}]}}]}}]}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x40, r6, 0xb03, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x40}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f0000439000/0x2000)=nil, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NAME_TABLE_GET(r7, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000780)={0x360, r6, 0x4, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x40, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xe3b}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xb}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}]}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x10000}]}, @TIPC_NLA_NODE={0x5c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "e0f749d9981f63305af5831fa9d7b2887867d2eba803d8107c4dd2"}}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x64, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x10000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x504}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x61f}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8001}]}, @TIPC_NLA_LINK={0x80, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc60}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3a66de88}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x400}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}]}, @TIPC_NLA_BEARER={0x150, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x10000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xab5d}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6599}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}]}]}, 0x360}, 0x1, 0x0, 0x0, 0xe40c3e7f71fa907f}, 0x44010) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) executing program 0: r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0xeb, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000ac0)={0xf, 0x1, 0x0, "f7877c0a0e4407413af4c7caa29b00b04a7d0000dff4ffffff000000e900"}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)="d8000000140081044e81f782db44b9040a1d08020a000000040000a118000200ff11000000000e1208000f0100810401a80016ea1f0008400304000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a", 0xbd}], 0x1, 0x0, 0x0, 0x7400}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000183b9220b113420016580102030109021b00010000000009040000012e459e00090504"], 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$rxrpc(r1, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private0}}, 0x24) syz_usb_connect(0x0, 0x41, &(0x7f0000000040)=ANY=[@ANYRESDEC], 0x0) syz_usb_connect(0x6, 0x36, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f00000000c0)={@val={0x8, 0x800}, @val, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0xd, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x0, 0x88a8, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0xfffe}, {"77d9"}}}}, 0x38) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000003400), 0x0, 0x100, &(0x7f0000003500)={0x77359400}) executing program 4: syz_emit_ethernet(0x4f, &(0x7f0000000000)={@remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @val={@val={0x88a8, 0x1, 0x0, 0x3}, {0x8100, 0x6, 0x1, 0x4}}, {@x25={0x805, {0x2, 0x2, 0x17, "724fdeff1154e521cee75aac1a3f05e260f0e08a803ef98ac694ffa6e1d0494625c2a791793b92866f10db317ac8e0fc9b6afd4c759d"}}}}, &(0x7f0000000080)={0x1, 0x4, [0xf1e, 0x1, 0xb7d, 0x8e1]}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028008000d0001000000080014000000000006000300917000000600100000000000040012"], 0x5c}, 0x1, 0xba01}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800e0001006970366772657461700000002800028008000d0001000000080014000000000006000300917000000600100000000000040012"], 0x5c}, 0x1, 0xba01}, 0x0) executing program 1: r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000040)='.\x00', 0x440000a0) r1 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r1, 0x2000000, 0x0, 0x1001f0) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'geneve1\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b050600f4ff020006004788aa96a13bb1000011000088ca1a00", 0x1001a, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000140)="f8c21f4bc6399e4abef3caa95c18e756720b0e0d2ca0dfc6a7764ee163ed5b27210966662239d539b0b8979c58453bfe87a23b32e26af342b545adecbb34d6ec75fe8b831db2d585923e3ef4d58489bad96e5c71f3dee89d89fe1aaf5eb7199ac9c0da47a2ee58c7efa44ec58ce18a4ef43112bd575a539b40", 0x79}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) executing program 2: pipe(0x0) socket$nl_route(0x10, 0x3, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x2000000002, 0x0, 0x3, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r1, &(0x7f0000000300)='1\x00', 0xffffff4a) write$sysctl(r1, &(0x7f0000000000)='2\x00', 0x2) getpgrp(0x0) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x30, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, 0x0, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) writev(r3, &(0x7f00000010c0), 0x0) r4 = io_uring_setup(0x3dd, &(0x7f0000000240)={0x0, 0x7d52, 0x10, 0x1}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b8c07d40450c01800a9000000012090212000100000000090400000080829900"], 0x0) open(&(0x7f0000000100)='./file0\x00', 0x60c2, 0x0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x400017e) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) program crashed: INFO: task hung in r871xu_dev_remove bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 5, 30, 26, 29, 5, 30, 26, 23, 21] detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000006000000850000008600000018110000", @ANYRES32], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r2, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}}, 0x0) executing program 4: lchown(&(0x7f0000000440)='./cgroup/cgroup.procs\x00', 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f00000000c0)={0x1d, r1, 0x0, 0x0, &(0x7f0000000280)}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000280)={0x0, 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) setsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000180), 0x4) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x7, 0x0, 0x10000) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8b", 0x1}], 0x1, 0x0, 0x0, 0x900}, 0x60) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000001c0)={0x60, 0x2, &(0x7f0000ea6000/0xe000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x62}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r4}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0e42, 0x0) preadv(r7, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000580)=ANY=[@ANYRES16=r4, @ANYRES8=0x0], 0x24, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) executing program 4: openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pipe(0x0) io_setup(0x3ff, &(0x7f0000000500)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = signalfd(0xffffffffffffffff, &(0x7f0000001200), 0x8) fgetxattr(r0, &(0x7f0000001440)=@known='security.selinux\x00', &(0x7f0000001480)=""/60, 0x3c) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x8, 0x8, 0x0, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x1}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000030805000000000000000000000000000c0004800800014000000000060002400000000005000300ff"], 0x30}}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0xcf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_clone3(&(0x7f00000004c0)={0x200001000, &(0x7f0000000180), &(0x7f0000000300)=0x0, 0x0, {0xe}, &(0x7f0000000740)=""/238, 0xee, &(0x7f0000000100)=""/54, &(0x7f00000003c0)=[0x0], 0x1}, 0x58) sched_setscheduler(r3, 0x0, &(0x7f0000000000)=0x6) r4 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x2, r4, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r5, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f000044b000/0x1000)=nil, 0x1000, 0x0) pipe(0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f00000003c0)="386d178529a39dea18dd3f87d7a5", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) socket(0x0, 0x2, 0x0) executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000940)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="210f00000000000000002000000008000300", @ANYRES32=r2], 0x1c}}, 0x0) read(r0, 0x0, 0x0) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x20000400) pwritev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0), 0x3e}], 0x1, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x0) socket(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file1/file4/file7\x00', 0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x4) open$dir(&(0x7f0000000300)='./file1/file4\x00', 0x161683, 0x100) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xa40004c4) r2 = open$dir(&(0x7f00000001c0)='./file1/../file0\x00', 0x0, 0x0) mkdirat(r2, &(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mremap(&(0x7f000018d000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mbind(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x0, &(0x7f0000000000)=0x2, 0x7, 0x0) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000002800)={0x5, 0x1, 0x0, "833461025a78ffa177be169916ea42232f59496b79b29963084f401a544b75d0"}) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x270, 0x168, 0x9, 0x0, 0xb, 0x370, 0x250, 0x250, 0x370, 0x250, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', [], [], 'ip6tnl0\x00', 'sit0\x00'}, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@common=@unspec=@addrtype1={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'veth1_to_team\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) r6 = socket(0x29, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r6, 0x89f8, &(0x7f0000000180)={'sit0\x00', &(0x7f0000001a00)}) r7 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r7, 0x40045731, &(0x7f00000002c0)) sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000009c0)=ANY=[@ANYBLOB="44010000100001000000000000000000fe800000000600000000000000000500ac1e0001000000000000000000008a3e00000000000000fc0000000000000000e9c9f646911c26d3f6a587ff01a0d8ec1f21d52811e0b0c82acc44ec586e250a21f76f2b5ce70000000000000000cb7a2fc3e79b3fbda63075dac97832da25590a78958b610c97846e1ddaa7", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="2001000000ffff010000000032000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c000000000000000000", @ANYRES64=r0], 0x144}}, 0x0) executing program 2: socket$kcm(0x10, 0x3, 0x10) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x2, 0x1}, 0x20) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0xa, 0x4e22, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000400)=[@hopopts_2292={{0x18}}, @dstopts={{0x58, 0x29, 0x37, {0x16, 0x1e8, '\x00', [@jumbo, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @empty}}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @broadcast}}, @jumbo, @jumbo, @ra]}}}], 0x70}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0x64, 0x0, 0x371860884d55c0ab, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac02}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "f85013e4"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "aa3406da76"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "fb0d20c9da"}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}]}, 0x64}, 0x1, 0x0, 0x0, 0x24040801}, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x30, 0x0, @ib={0x1b, 0x4, 0x0, {"00000000000000000000000000000001"}}}}, 0x90) r2 = syz_open_dev$usbfs(&(0x7f0000000200), 0x77, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, &(0x7f0000000000)=ANY=[@ANYBLOB="02002303100007"]) openat(0xffffffffffffffff, 0x0, 0x20002, 0x5) openat$cgroup_ro(r1, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc000ff}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000340)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r3, 0xc0182101, &(0x7f00000000c0)={r4}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000080)={r5, 0x3, r3, 0x5}) geteuid() openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) executing program 3: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) unshare(0x20040600) mknod(&(0x7f0000000000)='./bus\x00', 0x1000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) write$binfmt_elf32(r1, &(0x7f00000003c0)=ANY=[@ANYRESOCT], 0x82) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r1, &(0x7f0000000340)='./bus\x00', &(0x7f0000000500)={{0x77359400}, {r2, r3/1000+60000}}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000007c0)={{{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@loopback}}, &(0x7f0000000200)=0xe8) quotactl$Q_GETINFO(0xffffffff80000502, &(0x7f00000001c0)=@md0, r4, &(0x7f0000000300)) close(r1) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000780)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r6, 0x5b03, 0x0) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r3, 0x81044804, &(0x7f0000000400)={0x1}) ioctl$HIDIOCGUSAGE(r2, 0x40184810, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_open_dev$tty20(0xc, 0x4, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702bf0014000000b7030000000000008500000000000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500"/96], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x30, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x1, 0x0}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040880}, 0x200400c4) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) program crashed: INFO: task hung in r871xu_dev_remove bisect: the chunk can be dropped bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30, 26, 23, 21] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000940)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="210f00000000000000002000000008000300", @ANYRES32=r2], 0x1c}}, 0x0) read(r0, 0x0, 0x0) executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x20000400) pwritev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0), 0x3e}], 0x1, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x0) socket(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file1/file4/file7\x00', 0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x4) open$dir(&(0x7f0000000300)='./file1/file4\x00', 0x161683, 0x100) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xa40004c4) r2 = open$dir(&(0x7f00000001c0)='./file1/../file0\x00', 0x0, 0x0) mkdirat(r2, &(0x7f00000000c0)='./file0\x00', 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mremap(&(0x7f000018d000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mbind(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x0, &(0x7f0000000000)=0x2, 0x7, 0x0) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000002800)={0x5, 0x1, 0x0, "833461025a78ffa177be169916ea42232f59496b79b29963084f401a544b75d0"}) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e8, 0x270, 0x168, 0x9, 0x0, 0xb, 0x370, 0x250, 0x250, 0x370, 0x250, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', [], [], 'ip6tnl0\x00', 'sit0\x00'}, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@common=@unspec=@addrtype1={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'veth1_to_team\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x348) r6 = socket(0x29, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r6, 0x89f8, &(0x7f0000000180)={'sit0\x00', &(0x7f0000001a00)}) r7 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r7, 0x40045731, &(0x7f00000002c0)) sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000009c0)=ANY=[@ANYBLOB="44010000100001000000000000000000fe800000000600000000000000000500ac1e0001000000000000000000008a3e00000000000000fc0000000000000000e9c9f646911c26d3f6a587ff01a0d8ec1f21d52811e0b0c82acc44ec586e250a21f76f2b5ce70000000000000000cb7a2fc3e79b3fbda63075dac97832da25590a78958b610c97846e1ddaa7", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="2001000000ffff010000000032000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c000000000000000000", @ANYRES64=r0], 0x144}}, 0x0) executing program 2: socket$kcm(0x10, 0x3, 0x10) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x2, 0x1}, 0x20) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0xa, 0x4e22, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000400)=[@hopopts_2292={{0x18}}, @dstopts={{0x58, 0x29, 0x37, {0x16, 0x1e8, '\x00', [@jumbo, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @empty}}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @broadcast}}, @jumbo, @jumbo, @ra]}}}], 0x70}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0x64, 0x0, 0x371860884d55c0ab, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac02}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "f85013e4"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "aa3406da76"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "fb0d20c9da"}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}]}, 0x64}, 0x1, 0x0, 0x0, 0x24040801}, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x30, 0x0, @ib={0x1b, 0x4, 0x0, {"00000000000000000000000000000001"}}}}, 0x90) r2 = syz_open_dev$usbfs(&(0x7f0000000200), 0x77, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, &(0x7f0000000000)=ANY=[@ANYBLOB="02002303100007"]) openat(0xffffffffffffffff, 0x0, 0x20002, 0x5) openat$cgroup_ro(r1, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc000ff}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000340)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r3, 0xc0182101, &(0x7f00000000c0)={r4}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000080)={r5, 0x3, r3, 0x5}) geteuid() openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) executing program 3: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) unshare(0x20040600) mknod(&(0x7f0000000000)='./bus\x00', 0x1000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) write$binfmt_elf32(r1, &(0x7f00000003c0)=ANY=[@ANYRESOCT], 0x82) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r1, &(0x7f0000000340)='./bus\x00', &(0x7f0000000500)={{0x77359400}, {r2, r3/1000+60000}}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000007c0)={{{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@loopback}}, &(0x7f0000000200)=0xe8) quotactl$Q_GETINFO(0xffffffff80000502, &(0x7f00000001c0)=@md0, r4, &(0x7f0000000300)) close(r1) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000780)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r6, 0x5b03, 0x0) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r3, 0x81044804, &(0x7f0000000400)={0x1}) ioctl$HIDIOCGUSAGE(r2, 0x40184810, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) syz_open_dev$tty20(0xc, 0x4, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702bf0014000000b7030000000000008500000000000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500"/96], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x30, 0x0, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x1, 0x0}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040880}, 0x200400c4) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 5, 30, 26, 29] detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000006000000850000008600000018110000", @ANYRES32], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r2, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}}, 0x0) executing program 4: lchown(&(0x7f0000000440)='./cgroup/cgroup.procs\x00', 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f00000000c0)={0x1d, r1, 0x0, 0x0, &(0x7f0000000280)}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000280)={0x0, 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) setsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000180), 0x4) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x7, 0x0, 0x10000) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8b", 0x1}], 0x1, 0x0, 0x0, 0x900}, 0x60) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000001c0)={0x60, 0x2, &(0x7f0000ea6000/0xe000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x62}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r4}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0e42, 0x0) preadv(r7, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000580)=ANY=[@ANYRES16=r4, @ANYRES8=0x0], 0x24, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) executing program 4: openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pipe(0x0) io_setup(0x3ff, &(0x7f0000000500)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = signalfd(0xffffffffffffffff, &(0x7f0000001200), 0x8) fgetxattr(r0, &(0x7f0000001440)=@known='security.selinux\x00', &(0x7f0000001480)=""/60, 0x3c) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x8, 0x8, 0x0, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x1}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000030805000000000000000000000000000c0004800800014000000000060002400000000005000300ff"], 0x30}}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0xcf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_clone3(&(0x7f00000004c0)={0x200001000, &(0x7f0000000180), &(0x7f0000000300)=0x0, 0x0, {0xe}, &(0x7f0000000740)=""/238, 0xee, &(0x7f0000000100)=""/54, &(0x7f00000003c0)=[0x0], 0x1}, 0x58) sched_setscheduler(r3, 0x0, &(0x7f0000000000)=0x6) r4 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x2, r4, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r5, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f000044b000/0x1000)=nil, 0x1000, 0x0) pipe(0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f00000003c0)="386d178529a39dea18dd3f87d7a5", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) socket(0x0, 0x2, 0x0) executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) program crashed: INFO: task hung in r871xu_dev_remove bisect: the chunk can be dropped bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 29] detailed listing: executing program 4: openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pipe(0x0) io_setup(0x3ff, &(0x7f0000000500)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = signalfd(0xffffffffffffffff, &(0x7f0000001200), 0x8) fgetxattr(r0, &(0x7f0000001440)=@known='security.selinux\x00', &(0x7f0000001480)=""/60, 0x3c) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x8, 0x8, 0x0, 0x0, 0xffffffffffffffff, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x1}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000030805000000000000000000000000000c0004800800014000000000060002400000000005000300ff"], 0x30}}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0xcf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_clone3(&(0x7f00000004c0)={0x200001000, &(0x7f0000000180), &(0x7f0000000300)=0x0, 0x0, {0xe}, &(0x7f0000000740)=""/238, 0xee, &(0x7f0000000100)=""/54, &(0x7f00000003c0)=[0x0], 0x1}, 0x58) sched_setscheduler(r3, 0x0, &(0x7f0000000000)=0x6) r4 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x2, r4, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r5, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f000044b000/0x1000)=nil, 0x1000, 0x0) pipe(0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f00000003c0)="386d178529a39dea18dd3f87d7a5", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) socket(0x0, 0x2, 0x0) executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bind$alg(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) request_key(&(0x7f0000000280)='id_legacy\x00', &(0x7f0000000200)={'syz', 0x0, 0xc}, &(0x7f00000001c0)='R\x10rust\xe3c*sgrVex:D%', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() process_vm_readv(r2, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r3, 0xd, 0x0) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x1) close(r4) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x2, {0xcd, 0x8000, "9daa27bf3370160a2fc6f093e361418bb0d3a2aeea345a5326184c7b691d5739903edb6b19a006751c0173035fc864264180012dc5d0e07553c9106824a89d1b25a00148d4863173a4a46bbb327a9ce287e188aeceeb3aecc6f9e194194893ad7a80fddb1eebf9607fd6651f50e74ca012aa7f46bd8c38dddf4c4416e8fe58529c22fd839796df0a3761a5ca5132a48239a715cbdd883372ec65bff016981269c834e005579b1663c23110122a5931864569e8c919c6eb4506d03963f6918e7794f288bbafd20aa630986d0395ad5904d1d6872338110fdf7ef00afff60861fb793fb6d9bcc126a76c618c240d158bd962bcbd7df5fdf4f429b55969e7a621dd", 0x87, 0x4, 0xe, 0x5, 0x6, 0xc, 0x3, 0x1}}}, 0x128) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 5, 30] detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000006000000850000008600000018110000", @ANYRES32], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r2, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}}, 0x0) executing program 4: lchown(&(0x7f0000000440)='./cgroup/cgroup.procs\x00', 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f00000000c0)={0x1d, r1, 0x0, 0x0, &(0x7f0000000280)}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000280)={0x0, 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) setsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000180), 0x4) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x7, 0x0, 0x10000) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8b", 0x1}], 0x1, 0x0, 0x0, 0x900}, 0x60) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000001c0)={0x60, 0x2, &(0x7f0000ea6000/0xe000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x62}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r4}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0e42, 0x0) preadv(r7, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000580)=ANY=[@ANYRES16=r4, @ANYRES8=0x0], 0x24, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) program crashed: INFO: task hung in r871xu_dev_remove bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): lchown-socket$igmp6-syz_open_dev$dri-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_ALLOW_IOVAS-fcntl$dupfd-openat$cgroup_ro-prctl$PR_SET_SECCOMP-bind$alg-setsockopt$ALG_SET_KEY-setsockopt$CAN_RAW_FD_FRAMES-setsockopt$ALG_SET_AEAD_AUTHSIZE-socket$kcm-sendmsg$kcm-ioctl$PAGEMAP_SCAN-openat$iommufd-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-mkdir-socket$nl_route-sendmsg$nl_route-openat$kvm-prctl$PR_SCHED_CORE-sched_setaffinity-openat$hwrng-preadv-fsetxattr$system_posix_acl-ioctl$KVM_CREATE_VM detailed listing: executing program 4: lchown(&(0x7f0000000440)='./cgroup/cgroup.procs\x00', 0xffffffffffffffff, 0x0) socket$igmp6(0xa, 0x3, 0x2) syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f00000000c0)={0x1d, r1, 0x0, 0x0, &(0x7f0000000280)}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000280)={0x0, 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) setsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000180), 0x4) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x7, 0x0, 0x10000) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8b", 0x1}], 0x1, 0x0, 0x0, 0x900}, 0x60) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000001c0)={0x60, 0x2, &(0x7f0000ea6000/0xe000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x62}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x5}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r4}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0e42, 0x0) preadv(r7, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000580)=ANY=[@ANYRES16=r4, @ANYRES8=0x0], 0x24, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 5] detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000006000000850000008600000018110000", @ANYRES32], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r2, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}}, 0x0) program crashed: INFO: task hung in addrconf_dad_work bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-socket$nl_route-socket$nl_netfilter-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route detailed listing: executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000006000000850000008600000018110000", @ANYRES32], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r2, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv-getpid-syz_clone-waitid-ptrace-sched_setscheduler-getsockopt$sock_cred-sendmsg$netlink detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) program crashed: INFO: task hung in addrconf_verify_work bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv-getpid-syz_clone-waitid-ptrace-sched_setscheduler-getsockopt$sock_cred-sendmsg$netlink detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = getpid() process_vm_readv(r3, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r4 = getpid() r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r5) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c02000010000b"], 0x22c}, {&(0x7f00000008c0)={0x240, 0x2a, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="4830c2d093e71b65c30506899667bbe4d09a5383d663f1a5fee6ecb0ff5730575cf3bc50ee9057745a45eab9bfbf938614df4bb564e6cff313d3b8a8f2365105745c42580d55495057a977e46bc4ab0def0207ecc2761e0e44c60e1caebc53d618815e380cf65bf442ee6ff0b0c40d97688fc352ec5c81ed4c98bbb5e5b44fa305e37a0d38d9954d8572594228385f608b3818eaed8914abae", @typed={0x8, 0x9c, 0x0, 0x0, @fd=r2}, @generic='9', @typed={0x8, 0x39, 0x0, 0x0, @pid=r3}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@private=0xa010102}, @nested={0x17c, 0x129, 0x0, 0x1, [@typed={0x4, 0x2e}, @generic="10b54a2658204c22bbba495ef435e51d1b2438cddab7417718b5470cc53dd01477ea393d21f0cdf349dfedecc3d1ac3411e73ca68401ed9be2f3f4378a67aaa14911ae291d1d4b98c8189ecf903bc76614d9160af105cb03564e842a7dbcc530d9f494413b2ba829e84d5b3a66a537b90aa263b2423328c01d22de4616f89dfbe2ff34fa8d7ad9cd9d5c591fb4e97764e584980545fc56f272440afae697543cc201387612556c297a43fd2d7ba66a2e847e605cba90", @typed={0x8, 0xf9, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x5b, 0x0, 0x0, @uid=r6}, @generic="1a7ddef71ee2f60fdce3f55695a9aec103d3f851b0198c28b507111adcf4db4bd244cc945f942dba1827c316a060560ba20335825d8d83f2c8a5c305e539e2905f65f3db20ec1c2c17350fe2e76aa1e26157593817a646bf6d5f6eadbe1b0ede29eee139ab212f789c291be9910c0813120f7ec80ffe4607e42576cdbea0f58b3387fafca30d308fcad5f93c17a05beb1794c2f2c65772c89225c5bbce162096d0627c0c4dc2afa2eb4d6c1bbc18"]}]}, 0x240}], 0x2, 0x0, 0x0, 0x1}, 0x20004004) program crashed: INFO: task hung in addrconf_verify_work bisect: concatenation succeeded found reproducer with 16 syscalls minimizing guilty program testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv-getpid-syz_clone-waitid-ptrace-sched_setscheduler-getsockopt$sock_cred detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = getpid() process_vm_readv(r2, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r3 = getpid() r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r4) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0xc) program crashed: INFO: task hung in addrconf_dad_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv-getpid-syz_clone-waitid-ptrace-sched_setscheduler detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = getpid() process_vm_readv(r1, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) r2 = getpid() r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r3) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) program crashed: INFO: task hung in reg_check_chans_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv-getpid-syz_clone-waitid-ptrace detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = getpid() process_vm_readv(r1, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) getpid() r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) ptrace(0x10, r2) program crashed: INFO: task hung in addrconf_dad_work testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv-getpid-syz_clone-waitid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = getpid() process_vm_readv(r1, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) getpid() syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, 0x0) program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv-getpid-syz_clone detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = getpid() process_vm_readv(r1, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) getpid() syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = getpid() process_vm_readv(r1, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) getpid() program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid-process_vm_readv detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = getpid() process_vm_readv(r1, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}], 0x1, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) getpid() program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-socket$pppl2tp detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-connect$unix-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) getpid() program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-socketpair$unix-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) getpid() program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-unshare-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) unshare(0x24020400) getpid() program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-sendmsg$IPCTNL_MSG_CT_NEW-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3c8d9334a7963ded}}]}]}, 0x68}}, 0x0) getpid() program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_crypto-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) socket$nl_crypto(0x10, 0x3, 0x15) getpid() program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB="12010000bcc38110050b91175704010203010902110c04fd00000009049d04057e4f3b080824060000468c120524007f000d240f01a40000000008f6150505241503000a24070805000200050006240600009205240002000d240f010800000000000004fd0524010004072414b80607000c241b060000000602ff7f0397241309ebfbc8a5ceb8e4440105a21c6da2920dfaed363d5291381d818a6a02f02972921fd5d1c5d696265ed6e193ae0e9fefff021d83191bec527571e36080f9d9a14d99a769dba779c88541dce68c266b9643eb14f129b4fb9aa68b24f6f6a8cd18e3bbe00a0c2a0b786bf33749521b633cc1a22ca203091f5f3284859539786af97428a8b3222ebea899f74c16822a0d59329a518309058b1f2000040820072501800001010905071000020407a307250102fa0700f611a15112d5db9111bca3e1876f8f2b36053f50531982fe0926db2f674b2d567146594690ae05ecc9195aeac3c127ab94c2a961df0c2538e5493482e5a26fe70ebbaa28e019d07cc0ededf506f37b734a31f1db7a9bf13f162b96f5123531e6586f9a30f53ba96c97d644b9b5462fc5b6745858b2e2e932d1ee5f8c5b2ce8ccd086006960c37ea6ce01454a1d6b08effdd34db9e3ad0d66e611cfd653aefc90eb52c607d5c8306709d98a5663e7f8a6cf5f67a3b68c9e92408fa1de0d95662ba0690d0b93eb0493b7899989c16efd3960f37153e0d124010f15df7b4baa6ea2666f44c212ccbdd89f67a14f08a7374746026a1f0ade09050d400800b80b03310248d4c4e81350d1fa5bbce7829076c9589882f0706e31550f367cbdd00d1a608ddf2ec93da1bc96981d5eb67003cabf090504000002f902200725018205070009050d8508000600080904d5090e0e0100f2112402010202"], 0x0) getpid() program crashed: INFO: task hung in r871xu_dev_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid detailed listing: executing program 0: getpid() program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, 0x0, 0x0) getpid() program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid detailed listing: executing program 0: syz_usb_connect(0x0, 0xc23, &(0x7f0000000e00)=ANY=[@ANYBLOB], 0x0) getpid() program did not crash extracting C reproducer testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program crashed: INFO: task hung in r871xu_dev_remove simplifying C reproducer testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program crashed: INFO: task hung in r871xu_dev_remove testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program did not crash testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program crashed: INFO: task hung in r871xu_dev_remove testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program crashed: INFO: task hung in r871xu_dev_remove testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program crashed: INFO: task hung in r871xu_dev_remove testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program crashed: INFO: task hung in r871xu_dev_remove testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program crashed: INFO: task hung in r871xu_dev_remove testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-getpid program crashed: INFO: task hung in r871xu_dev_remove reproducing took 3h56m18.498977585s repro crashed as (corrupted=false): INFO: task kworker/0:0:8 blocked for more than 143 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:21200 pid:8 tgid:8 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 r871xu_dev_remove+0x72/0x450 drivers/staging/rtl8712/usb_intf.c:594 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/0:1:9 blocked for more than 143 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:1 state:D stack:20200 pid:9 tgid:9 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 r871xu_dev_remove+0x72/0x450 drivers/staging/rtl8712/usb_intf.c:594 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:0:25 blocked for more than 143 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:21016 pid:25 tgid:25 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 r871xu_dev_remove+0x72/0x450 drivers/staging/rtl8712/usb_intf.c:594 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:1:46 blocked for more than 144 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:1 state:D stack:21424 pid:46 tgid:46 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 r871xu_dev_remove+0x72/0x450 drivers/staging/rtl8712/usb_intf.c:594 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:2:58 blocked for more than 144 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:2 state:D stack:21208 pid:58 tgid:58 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 unregister_netdev+0x12/0x30 net/core/dev.c:11431 r871xu_dev_remove+0xae/0x450 drivers/staging/rtl8712/usb_intf.c:596 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/u8:10:2526 blocked for more than 144 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:10 state:D stack:21784 pid:2526 tgid:2526 ppid:2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_verify_work Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/0:7:5405 blocked for more than 145 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:7 state:D stack:27856 pid:5405 tgid:5405 ppid:2 flags:0x00004000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 reg_check_chans_work+0x99/0xfd0 net/wireless/reg.c:2480 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Showing all locks held in the system: 5 locks held by kworker/0:0/8: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900000d7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900000d7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023da4190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023da4190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff8880773f9190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff8880773f9190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff88807d147160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff88807d147160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff88807d147160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 5 locks held by kworker/0:1/9: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900000e7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900000e7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023e03190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023e03190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff8880771e8190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff8880771e8190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff888061aca160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff888061aca160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff888061aca160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 5 locks held by kworker/1:0/25: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900001f7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900001f7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023dec190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023dec190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff8880777f5190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff8880777f5190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff88807aca7160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff88807aca7160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff88807aca7160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 1 lock held by khungtaskd/30: #0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6626 5 locks held by kworker/1:1/46: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90000b67d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90000b67d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023e8b190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023e8b190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff888076cbc190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff888076cbc190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff888076dc5160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff888076dc5160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff888076dc5160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 6 locks held by kworker/1:2/58: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc9000133fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc9000133fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023eab190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023eab190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff8880777f6190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff8880777f6190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff888076cbd160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff888076cbd160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff888076cbd160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 #5: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: unregister_netdev+0x12/0x30 net/core/dev.c:11431 3 locks held by kworker/u8:10/2526: #0: ffff88802acb0148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88802acb0148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc9000988fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc9000988fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 7 locks held by kworker/u8:11/2569: 2 locks held by dhcpcd/4897: #0: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2ce/0x1bc0 net/ipv4/devinet.c:1101 #1: ffff8880228dce28 (&padapter->mutex_start){+.+.}-{3:3}, at: netdev_open+0x3c/0x730 drivers/staging/rtl8712/os_intfs.c:392 2 locks held by getty/4982: #0: ffff88802ade40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000312b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ac/0x1e00 drivers/tty/n_tty.c:2211 3 locks held by kworker/0:3/5253: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90002e37d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90002e37d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/1:4/5255: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90002e17d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90002e17d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/1:5/5260: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90002df7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90002df7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 4 locks held by udevd/5264: #0: ffff888060ff49e0 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xb7/0xd60 fs/seq_file.c:182 #1: ffff88807be7c088 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_seq_start+0x53/0x3b0 fs/kernfs/file.c:154 #2: ffff88801193db48 (kn->active#20){++++}-{0:0}, at: kernfs_seq_start+0x72/0x3b0 fs/kernfs/file.c:155 #3: ffff8880777f6190 (&dev->mutex){....}-{3:3}, at: device_lock_interruptible include/linux/device.h:1014 [inline] #3: ffff8880777f6190 (&dev->mutex){....}-{3:3}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 3 locks held by kworker/0:4/5268: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003da7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003da7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/0:5/5269: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003db7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003db7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/1:6/5270: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003dc7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003dc7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/0:6/5404: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003f2fd00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003f2fd00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/0:7/5405: #0: ffff888015881948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015881948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900020afd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900020afd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x99/0xfd0 net/wireless/reg.c:2480 1 lock held by syz-executor356/5663: #0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:296 [inline] #0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x381/0x830 kernel/rcu/tree_exp.h:958 1 lock held by syz-executor356/5664: #0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:328 [inline] #0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:958 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xff4/0x1040 kernel/hung_task.c:379 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 5244 Comm: syz-executor356 Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__lock_acquire+0xba3/0x2040 kernel/locking/lockdep.c:5096 Code: 00 00 48 8b 44 24 58 0f b6 04 10 84 c0 0f 85 68 10 00 00 48 8b 44 24 18 83 38 00 74 75 4c 89 e7 48 89 ee ba 05 00 00 00 eb 51 <85> c0 74 22 45 31 f6 4c 89 e7 48 89 ee 31 d2 e8 b9 60 00 00 48 ba RSP: 0018:ffffc90002e97750 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 1ffff110038658e5 RCX: 00000000000c0001 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffffff93734848 RBP: ffff88801c32c708 R08: ffffffff9373484f R09: 1ffffffff26e6909 R10: dffffc0000000000 R11: fffffbfff26e690a R12: ffff88801c32bc00 R13: ffff88801c32c6d8 R14: 0000000000000001 R15: ffff88801c32c728 FS: 0000555592020380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7793360350 CR3: 0000000020970000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 debug_object_activate+0x16d/0x510 lib/debugobjects.c:709 debug_hrtimer_activate kernel/time/hrtimer.c:423 [inline] debug_activate kernel/time/hrtimer.c:478 [inline] enqueue_hrtimer+0x30/0x3c0 kernel/time/hrtimer.c:1085 __hrtimer_start_range_ns kernel/time/hrtimer.c:1260 [inline] hrtimer_start_range_ns+0xac8/0xca0 kernel/time/hrtimer.c:1302 hrtimer_start_expires include/linux/hrtimer.h:289 [inline] hrtimer_sleeper_start_expires kernel/time/hrtimer.c:1951 [inline] do_nanosleep+0x158/0x600 kernel/time/hrtimer.c:2027 hrtimer_nanosleep+0x227/0x470 kernel/time/hrtimer.c:2083 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1396 [inline] __se_sys_clock_nanosleep+0x32b/0x3c0 kernel/time/posix-timers.c:1373 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f77933549c3 Code: 00 00 00 00 00 66 90 83 ff 03 74 7b 83 ff 02 b8 fa ff ff ff 49 89 ca 0f 44 f8 80 3d be 06 05 00 00 74 14 b8 e6 00 00 00 0f 05 d8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 28 48 89 54 24 10 RSP: 002b:00007ffdc01fa1b8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 0000000000001621 RCX: 00007f77933549c3 RDX: 00007ffdc01fa1d0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000000f4240 R08: 00000000336c9139 R09: 7fffffffffffffff R10: 0000000000000000 R11: 0000000000000202 R12: 00000000000687f0 R13: 00007ffdc01fa20c R14: 00007ffdc01fa220 R15: 00007ffdc01fa210 INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.330 msecs final repro crashed as (corrupted=false): INFO: task kworker/0:0:8 blocked for more than 143 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:21200 pid:8 tgid:8 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 r871xu_dev_remove+0x72/0x450 drivers/staging/rtl8712/usb_intf.c:594 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/0:1:9 blocked for more than 143 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:1 state:D stack:20200 pid:9 tgid:9 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 r871xu_dev_remove+0x72/0x450 drivers/staging/rtl8712/usb_intf.c:594 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:0:25 blocked for more than 143 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:21016 pid:25 tgid:25 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 r871xu_dev_remove+0x72/0x450 drivers/staging/rtl8712/usb_intf.c:594 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:1:46 blocked for more than 144 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:1 state:D stack:21424 pid:46 tgid:46 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 r871xu_dev_remove+0x72/0x450 drivers/staging/rtl8712/usb_intf.c:594 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:2:58 blocked for more than 144 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:2 state:D stack:21208 pid:58 tgid:58 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 unregister_netdev+0x12/0x30 net/core/dev.c:11431 r871xu_dev_remove+0xae/0x450 drivers/staging/rtl8712/usb_intf.c:596 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:568 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x57a/0x9b0 drivers/base/core.c:3871 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/u8:10:2526 blocked for more than 144 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:10 state:D stack:21784 pid:2526 tgid:2526 ppid:2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_verify_work Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/0:7:5405 blocked for more than 145 seconds. Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:7 state:D stack:27856 pid:5405 tgid:5405 ppid:2 flags:0x00004000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x1800/0x4a60 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 reg_check_chans_work+0x99/0xfd0 net/wireless/reg.c:2480 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Showing all locks held in the system: 5 locks held by kworker/0:0/8: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900000d7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900000d7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023da4190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023da4190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff8880773f9190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff8880773f9190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff88807d147160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff88807d147160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff88807d147160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 5 locks held by kworker/0:1/9: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900000e7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900000e7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023e03190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023e03190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff8880771e8190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff8880771e8190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff888061aca160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff888061aca160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff888061aca160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 5 locks held by kworker/1:0/25: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900001f7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900001f7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023dec190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023dec190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff8880777f5190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff8880777f5190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff88807aca7160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff88807aca7160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff88807aca7160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 1 lock held by khungtaskd/30: #0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8e938320 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6626 5 locks held by kworker/1:1/46: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90000b67d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90000b67d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023e8b190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023e8b190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff888076cbc190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff888076cbc190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff888076dc5160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff888076dc5160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff888076dc5160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 6 locks held by kworker/1:2/58: #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801d687d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc9000133fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc9000133fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888023eab190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #2: ffff888023eab190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff8880777f6190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff8880777f6190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff888076cbd160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #4: ffff888076cbd160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1094 [inline] #4: ffff888076cbd160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1292 #5: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: unregister_netdev+0x12/0x30 net/core/dev.c:11431 3 locks held by kworker/u8:10/2526: #0: ffff88802acb0148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88802acb0148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc9000988fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc9000988fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 7 locks held by kworker/u8:11/2569: 2 locks held by dhcpcd/4897: #0: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2ce/0x1bc0 net/ipv4/devinet.c:1101 #1: ffff8880228dce28 (&padapter->mutex_start){+.+.}-{3:3}, at: netdev_open+0x3c/0x730 drivers/staging/rtl8712/os_intfs.c:392 2 locks held by getty/4982: #0: ffff88802ade40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000312b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ac/0x1e00 drivers/tty/n_tty.c:2211 3 locks held by kworker/0:3/5253: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90002e37d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90002e37d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/1:4/5255: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90002e17d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90002e17d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/1:5/5260: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90002df7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90002df7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 4 locks held by udevd/5264: #0: ffff888060ff49e0 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xb7/0xd60 fs/seq_file.c:182 #1: ffff88807be7c088 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_seq_start+0x53/0x3b0 fs/kernfs/file.c:154 #2: ffff88801193db48 (kn->active#20){++++}-{0:0}, at: kernfs_seq_start+0x72/0x3b0 fs/kernfs/file.c:155 #3: ffff8880777f6190 (&dev->mutex){....}-{3:3}, at: device_lock_interruptible include/linux/device.h:1014 [inline] #3: ffff8880777f6190 (&dev->mutex){....}-{3:3}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 3 locks held by kworker/0:4/5268: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003da7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003da7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/0:5/5269: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003db7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003db7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/1:6/5270: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003dc7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003dc7d00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/0:6/5404: #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003f2fd00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003f2fd00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdev+0x13/0x50 net/core/dev.c:10579 3 locks held by kworker/0:7/5405: #0: ffff888015881948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015881948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900020afd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900020afd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fc845c8 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x99/0xfd0 net/wireless/reg.c:2480 1 lock held by syz-executor356/5663: #0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:296 [inline] #0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x381/0x830 kernel/rcu/tree_exp.h:958 1 lock held by syz-executor356/5664: #0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:328 [inline] #0: ffffffff8e93d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:958 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xff4/0x1040 kernel/hung_task.c:379 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 5244 Comm: syz-executor356 Not tainted 6.11.0-rc4-syzkaller-00143-g3d5f968a177d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__lock_acquire+0xba3/0x2040 kernel/locking/lockdep.c:5096 Code: 00 00 48 8b 44 24 58 0f b6 04 10 84 c0 0f 85 68 10 00 00 48 8b 44 24 18 83 38 00 74 75 4c 89 e7 48 89 ee ba 05 00 00 00 eb 51 <85> c0 74 22 45 31 f6 4c 89 e7 48 89 ee 31 d2 e8 b9 60 00 00 48 ba RSP: 0018:ffffc90002e97750 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 1ffff110038658e5 RCX: 00000000000c0001 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffffff93734848 RBP: ffff88801c32c708 R08: ffffffff9373484f R09: 1ffffffff26e6909 R10: dffffc0000000000 R11: fffffbfff26e690a R12: ffff88801c32bc00 R13: ffff88801c32c6d8 R14: 0000000000000001 R15: ffff88801c32c728 FS: 0000555592020380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7793360350 CR3: 0000000020970000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 debug_object_activate+0x16d/0x510 lib/debugobjects.c:709 debug_hrtimer_activate kernel/time/hrtimer.c:423 [inline] debug_activate kernel/time/hrtimer.c:478 [inline] enqueue_hrtimer+0x30/0x3c0 kernel/time/hrtimer.c:1085 __hrtimer_start_range_ns kernel/time/hrtimer.c:1260 [inline] hrtimer_start_range_ns+0xac8/0xca0 kernel/time/hrtimer.c:1302 hrtimer_start_expires include/linux/hrtimer.h:289 [inline] hrtimer_sleeper_start_expires kernel/time/hrtimer.c:1951 [inline] do_nanosleep+0x158/0x600 kernel/time/hrtimer.c:2027 hrtimer_nanosleep+0x227/0x470 kernel/time/hrtimer.c:2083 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1396 [inline] __se_sys_clock_nanosleep+0x32b/0x3c0 kernel/time/posix-timers.c:1373 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f77933549c3 Code: 00 00 00 00 00 66 90 83 ff 03 74 7b 83 ff 02 b8 fa ff ff ff 49 89 ca 0f 44 f8 80 3d be 06 05 00 00 74 14 b8 e6 00 00 00 0f 05 d8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 28 48 89 54 24 10 RSP: 002b:00007ffdc01fa1b8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 RAX: ffffffffffffffda RBX: 0000000000001621 RCX: 00007f77933549c3 RDX: 00007ffdc01fa1d0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000000f4240 R08: 00000000336c9139 R09: 7fffffffffffffff R10: 0000000000000000 R11: 0000000000000202 R12: 00000000000687f0 R13: 00007ffdc01fa20c R14: 00007ffdc01fa220 R15: 00007ffdc01fa210 INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.330 msecs