Extracting prog: 12m16.066723964s Minimizing prog: 10m8.41270225s Simplifying prog options: 5m52.0724578s Extracting C: 33.774555767s Simplifying C: 0s extracting reproducer from 24 programs testing a last program of every proc single: executing 4 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES-mkdirat-syz_usb_connect-syz_usb_control_io$printer-syz_open_dev$char_usb-ioctl$FS_IOC_GETVERSION detailed listing: executing program 0: ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000040)={0x0, &(0x7f0000000040), 0x0, 0x0, 0xcccccccc}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCETHTOOL-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x2, 0x76, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904000001020d0000052406000105240000000d240f0100000400000000000306241a00000008241c0600070d000905810300020000120904010000020d00000904010102020d00000905820200020000000905030240"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000180)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x11, 0x9, 0x400, 0x14, 0x604, 0x823c, 0xc, 0x8001, 0x8, 0x4, 0xe4, 0x7}}, 0x0, 0x0, 0x0, 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000f00)=@ethtool_per_queue_op={0x4b, 0xe, [0xf693, 0x8, 0x3, 0x1ff, 0x1ff, 0x4, 0xe97, 0x4, 0x6, 0xecbf, 0xff, 0x101, 0x7, 0x200, 0x3d, 0x5e, 0x1000, 0xffff, 0xf557, 0x2, 0x5, 0x7c, 0xce, 0x2, 0xffffff6b, 0xe52c, 0xaa8, 0x7ffffffc, 0xd, 0xe9c4, 0xcd8, 0x6e, 0x200006, 0x7, 0x11, 0x6, 0x3, 0x6, 0x3, 0x3, 0x3, 0xfffffffc, 0xfd2, 0x6, 0x8, 0x401, 0xfffffffe, 0x2b, 0xa, 0x0, 0x7, 0x8, 0x5, 0x3, 0x6, 0x8, 0x23, 0x2, 0x3, 0x10, 0x3, 0xffffffff, 0x6, 0x5ffffff, 0xd1, 0xf, 0x4, 0xa, 0xfffffffe, 0x400, 0x80000000, 0x8000, 0x3, 0x5, 0x0, 0x0, 0x2, 0x1, 0x80, 0x4, 0x2, 0x0, 0xd, 0x2000006, 0x4, 0x8, 0x0, 0x1, 0xfffffff8, 0x0, 0x7ff, 0x7, 0x2, 0xbde, 0x37, 0x3, 0x4, 0x1, 0xa, 0x6, 0x7fff, 0xffffff00, 0x3, 0x33e3, 0x9, 0x6, 0x7fff, 0x6, 0x100, 0x3, 0xfffffffd, 0x2, 0x6, 0x8, 0x6, 0x7, 0x200, 0x9, 0xe, 0x81, 0x0, 0x4, 0x105, 0x5, 0x8, 0x3, 0x1, 0xfffffffa]}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000340)={0x14, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$MEMREAD-syz_emit_vhci-syz_usb_connect detailed listing: executing program 0: ioctl$MEMREAD(0xffffffffffffffff, 0xc0404d1a, &(0x7f00000001c0)={0x1, 0x4d, 0xe7, &(0x7f0000000040)=""/77, &(0x7f00000000c0)=""/231, 0x0, '\x00', {0x2, 0x10000, 0x3}}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e04f82420"], 0x7) syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$char_usb-syz_usb_disconnect-socket$netlink-pselect6 detailed listing: executing program 0: r0 = syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) socket$netlink(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000100), &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x3000000}, 0x0, 0x0, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 5, 30, 3, 7, 17, 30, 14, 5, 18, 6, 5, 5, 12, 5, 19, 3, 19, 21, 14, 4, 10, 13, 6] detailed listing: executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) close_range(r0, r0, 0x0) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x201, 0x4000003e, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x38, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x38}}, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000ac0)={0x14, 0x0, &(0x7f0000000a80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x410}}}, 0x0) r3 = creat(&(0x7f0000000240)='./file1\x00', 0x0) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r4, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r3, &(0x7f0000000000), 0x4000}]) executing program 2: mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x989042, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x2042, 0x0) executing program 2: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="400c0000000020c1e56f67cc7f805b6a59ea338e302566c1558444549cadec93ba5e904b11cf106fc77cedf43d6e9f67373f67dbf683ce5d7e00"], 0x0, 0x0}) r1 = syz_usb_connect(0x3, 0x4a, &(0x7f00000004c0)=ANY=[@ANYBLOB="120100005520f010402038b1420100000001090238000100000000090400000371055900090582eb10000000010200090502f3"], 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x154, &(0x7f0000000740)=ANY=[@ANYBLOB="4e01004e47f483db1e35c376b6454bd5a4725ebc62164cd7415bec9d12d439dbccea8cbe45203e045dbf024f6e434ffedf49006990c70f9665587d59007b67f29c381503396b8ad60044709bb480b6f69a9a232c0d3ef817972be9921c98340b9c87c5a494fc68a5d03f0500a145c190119542a462c14bd864aaeb9ff19d317c4364b9c87dadfa60af984a85ca9f26e8f6c053aa5eeffe3f4510ebdbd2a5fd24e9a1730e4c3f50e292478c77c21cde3cbd43c6c1258a654816d36dcb3e9ad792932eabec56cdd8132a62fd7cedddeafb3ad6af8dd4b21deece556372779c56fea99974e22f3c690127d69af4e338f1e7b7d095651d80d6833e213126138baff976442a3bfb35f1bf2d6ca1dfbfae1afd13cdf5c9add657d96a9366f532539188ab3b5322dea7561285aee7494e48cb59cd0d52e9f5ec601d8e990b0031d8ec787a03c2fe713e8718d8d19f810000000000000000"]) r2 = syz_usb_connect$uac2(0x2, 0xbf, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xad, 0x3, 0x1, 0x0, 0x60, 0x40, {0x8, 0xb, 0x0, 0x1, 0x1, 0x6, 0x20, 0xfe}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5, 0x5, 0x21, 0x6}, [@output_terminal={0xc, 0x24, 0x3, 0x2, 0x304, 0x8, 0x3, 0x40, 0x1, 0x3}, @output_terminal={0xc, 0x24, 0x3, 0x2, 0x306, 0x7, 0x6, 0x0, 0x7}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0x7, 0x3, 0x4, 0x4, "86"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xa, 0xa, 0x80, 0x5, 0x5}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x10}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x4, 0x9, 0x77, {0x8, 0x25, 0x1, 0x0, 0x33, 0x7, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x8, 0x3, 0x5, 0xa, "af233f0805f6"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x4, 0x0, 0xe, {0x8, 0x25, 0x1, 0x2, 0x0, 0x9, 0xd6}}}}}}}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000480)={0xa, 0x6, 0x300, 0x7, 0x40, 0x27, 0xff, 0x6}, 0x25, &(0x7f00000004c0)={0x5, 0xf, 0x25, 0x1, [@ssp_cap={0x20, 0x10, 0xa, 0x9, 0x5, 0x9, 0xf, 0xf, [0xc000, 0x0, 0x140c0, 0x30, 0x0]}]}, 0x1, [{0xa8, &(0x7f0000000580)=@string={0xa8, 0x3, "301e770e80d05b8363cb5baae4f2d37f4460192924b5f7ce63f9c802ecef232499b8abd184b5c2d228970f1c084966638e4c700898e3cf53275ab7ad15ba92bc2aa01c28a79224f7741587499e52132f4bf0c5d94c8273560f4a33fc7ad81a5c6ad99921f52e9e023b24d43d9fba742b832b9f9b1c0745eaa7d4f1acbe08e101a951c11606ea8165a012935fd319fc957e7c6922920a3516dc03588935e12774b5c76f3d0321"}}]}) r3 = socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000abb000/0x1000)=nil, 0x1000, 0x0, 0x102000200032, 0xffffffffffffffff, 0x87f64000) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000abaff9)={0x77359400}, 0x10) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x1458c0, 0x0) ioctl$BLKGETSIZE64(r4, 0x80081272, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r5 = syz_usb_connect(0x5, 0x46, &(0x7f0000000780)=ANY=[@ANYRESHEX=r2], 0x0) syz_usb_control_io$cdc_ncm(r5, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) r6 = syz_usb_connect$sierra_net(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0xc, 0x2, 0x10, 0x3, 0x4f, 0x9}, {0x9, 0x5, 0x84, 0x2, 0x400, 0x17, 0x0, 0xd}, {0x9, 0x5, 0xa, 0x3, 0x20, 0x8, 0x2e, 0xb0}}}}}}]}}, 0x0) syz_usb_disconnect(r6) setns(0xc9, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) sendmmsg$inet(r7, &(0x7f0000002c80), 0x81dcbe, 0x200008c0) r8 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000090024206d041cc340000001000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$rtl8150(r8, 0x0, &(0x7f0000000840)={0x2c, &(0x7f0000000680)=ANY=[@ANYBLOB="200004"], 0x0, 0x0, 0x0, 0x0}) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) recvmmsg(r9, &(0x7f0000004900)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x40002062, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x34, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) executing program 0: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) mkdirat(r0, &(0x7f0000000040)='./bus\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) executing program 0: ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000040)={0x0, &(0x7f0000000040), 0x0, 0x0, 0xcccccccc}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, &(0x7f0000000040)) (fail_nth: 8) executing program 3: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) wait4(r0, 0x0, 0x8, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) chmod(&(0x7f0000000180)='./sys/module/virtio_mmio/parameters/device\x00', 0x1ff) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCGIFMTU(r1, 0x8921, &(0x7f0000000080)={'gre0\x00'}) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/virtio_mmio/parameters/device\x00', 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x2d, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x15, 0x1, 0xfffffffc, 0x25dfdbff, {0xd, 0x7c}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x3b5e04dbece314b7}, 0xc000) write(r2, &(0x7f0000000100)='0x1000@0x100000000:10:25\x00', 0x19) r4 = syz_open_dev$sndpcmc(&(0x7f0000000200), 0x14, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r4, 0xc0884123, &(0x7f0000000280)={0x0, "3b012ed3849dd562f3853cb8fa33db1ddb471139dd18a81b8db442ae59de389046f141f865b734402028cb709a37d004d6c555a0ba92acc6d7e34a1fbfcca584", {0x9, 0xa3d5}}) rmdir(&(0x7f0000000000)='sysfs\x00') ptrace$setregset(0x4211, r0, 0x1, 0x0) syz_usb_connect(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000dae11c105e0484028fa4010203010902240001000000000904000002437d67000905fc57d4"], 0x0) executing program 2: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_RUN(r0, 0xae80, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000000)) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x1406, 0x100, 0x70bd27, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x20020011}, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x8982, &(0x7f0000000180)={0x8, 'ip6tnl0\x00', {'ipvlan0\x00'}}) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000440)={0x0, &(0x7f00000001c0)=[@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x619, 0x8, 0x8, 0x8}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @ro32=0x440a, 0x8000000000000000, 0x9, 0x8000000000000001}}, @nested_vmlaunch={0x12f, 0x18}, @uexit={0x0, 0x18, 0x7}, @nested_amd_stgi={0x17e, 0x10}, @enable_nested={0x12c, 0x18}, @in_dx={0x69, 0x20, {0x1ec8, 0x3}}, @nested_vmresume={0x130, 0x18}, @nested_amd_vmsave={0x183, 0x18, 0x2}, @out_dx={0x6a, 0x28, {0xb83c, 0x4, 0x1}}, @nested_amd_stgi={0x17e, 0x10}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @wrmsr={0x65, 0x20, {0x400000b2, 0x9}}, @code={0xa, 0x5e, {"64f3420f514cfb940f060f01d1c441ed560648b8e6000000000000000f23d00f21f835200000070f23f8460f860b000000660f50c166baf80cb8533b1c89ef66bafc0cec8f6978832f450f01c2"}}, @nested_amd_stgi={0x17e, 0x10}, @out_dx={0x6a, 0x28, {0x7630, 0x2, 0xc}}, @nested_vmlaunch={0x12f, 0x18}, @in_dx={0x69, 0x20, {0xd5f2}}], 0x256}) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x5c, r3, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x25}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private1}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x1d}]}, 0x5c}, 0x1, 0x0, 0x0, 0x846}, 0x50) r4 = memfd_secret(0x80000) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r4, 0xc080661a, &(0x7f0000000600)={@id={0x2, 0x0, @auto="96273f4f25b63bc50f7169cb1be7b693"}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000680), r5) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f00000006c0)=@assoc_value, &(0x7f0000000700)=0x8) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r5) sendmsg$NLBL_MGMT_C_ADD(r7, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x40, r8, 0x400, 0x70bd28, 0x25dfdbff, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2b}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40000) ioctl$KVM_RUN(r0, 0xae80, 0x0) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f00000008c0), r5) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000900)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000940)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r7, &(0x7f0000000a80)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0xac, r9, 0x212, 0x70bd27, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_LEVEL={0x2c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xff}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_SEC_LEVEL={0x44, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0xac}, 0x1, 0x0, 0x0, 0x41}, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r5, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x1c, r6, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x904) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_REGS(r13, 0x4090ae82, &(0x7f0000000bc0)={[0x5, 0x1, 0xcc, 0x6, 0xe49, 0x1, 0x80000000, 0x3, 0xd, 0x176, 0x8, 0x100000000, 0x7fffffffffffffff, 0xf, 0x1, 0x2], 0xb000, 0x4}) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r12, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x1c, r6, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x11}, 0x4000000) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000e40)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x3c, 0x0, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4044881}, 0x4000414) remap_file_pages(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x2, 0x20) executing program 1: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) close_range(r0, r0, 0x0) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x201, 0x4000003e, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x38, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x38}}, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000ac0)={0x14, 0x0, &(0x7f0000000a80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x410}}}, 0x0) r3 = creat(&(0x7f0000000240)='./file1\x00', 0x0) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r4, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r3, &(0x7f0000000000), 0x4000}]) executing program 2: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000200)={0x20, 0x15, 0xa2, "941339e399fb0d5322214275e2487f41868d71455aa0e63fe29305a5eb72b5e914051a41db7b9a1382cfab0100000011ad7b64a18f147e68dea2fbe048e73c578396e08f304687ce29f74da4509a83fc8f0cdca73eb9810591ba4f25b98a18d866a7733384eba09127db1f3785764c69f9943e63c8d1f21af5dc3bab5e1f29b0f302f60cb615ed790b5faf9fef85063dfaf3b21bcec5c914ce06caedd105670f1b1b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="24000000010006", 0x7) syz_usb_connect(0x2, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="120100015ae4c41096050100f5050100030109021b0001000000000904d60001b5e14500090583"], 0x0) executing program 3: unlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000001000)=ANY=[@ANYBLOB="000000000000080760231a18dafc37f3e326cc964224ca03a56eb1a088b89bee1120d572690964ccee118ff406be4f857a81529483549719c4581d310c365f18f1e6619ba246ca79239361b46b52b1f76a956fdcbf22d39bbbcc3baec0d8545daa06b336a88a0c17ee5f98b6ee2b38e5a26fe32fd5c682529d77e884c4a1d6a2ee92c06430"], 0x0, 0x0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1f, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x28, r2, 0x1, 0x70bd27, 0x2, {}, [@ETHTOOL_A_COALESCE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_COALESCE_TX_USECS={0x8, 0x6, 0x7}]}, 0x28}, 0x1, 0x0, 0x0, 0x144}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01ffffff7f00000000006700080008000300", @ANYRES32=r7, @ANYBLOB="0800c300741300000800c400"], 0x30}}, 0x0) executing program 0: ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000040)={0x0, &(0x7f0000000040), 0x0, 0x0, 0xcccccccc}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000001c0)={0xf000000, 0x1, 0xa646, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0xf0f041, 0x4, '\x00', @value=0xcb}}) openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/webusb/landingPage\x00', 0x0, 0x0) executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x40, 0x0, 0x3}, {0x20, 0x0, 0x0, 0xfffff010}, {0x6, 0xe, 0x0, 0x3}]}, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000000000108117980800000000000109022400010000000009040000020308000009210000010122290a09058103"], 0x0) socket$rxrpc(0x21, 0x2, 0x2) executing program 2: r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) r2 = fanotify_init(0x200, 0x0) fanotify_mark(r2, 0x201, 0x4000003e, r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r3 = creat(&(0x7f0000000240)='./file1\x00', 0x0) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r4, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r3, &(0x7f0000000000), 0x4000}]) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081046a81f782db44b904021d080b01000000e8fe55a11800150006001400030000120800040043000000a8001600a400014020000900feffff7f3626feffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8dcef52a9d7c7c0b7a196e6f66112c88a6bbace80177ccbec4c2ee5a7cef4090000001f3c29643a5ee4ce1b14d6d930dfe1d9d322d4acd9b575730d0080000000000000b5675025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee28a0", 0xd8}], 0x1}, 0x0) executing program 2: r0 = syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) socket$netlink(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000100), &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x3000000}, 0x0, 0x0, 0x0) executing program 0: r0 = socket$pptp(0x18, 0x1, 0x2) fremovexattr(r0, &(0x7f0000002e00)=@known='system.sockprotoname\x00') mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) close(0x3) r2 = inotify_init() quotactl_fd$Q_QUOTAON(r2, 0xffffffff80000202, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c020000060a0b040000000000000000029c39129e180d9fe00201800a0001006d6174636800000028020280080002400000000114020300d67a8527f76ec1d39e537c4c3060c6a405106c72848aa8bcb429b3a20d532452032d5f166334739d1719a5778bd4f724ee4ca57f2527aeeb0c75755d68fc6fa55f4825682ee95e581039823e5963beedcf65b8b005623d90772b8b6ebd2498b0aff725a3eabb6c99cb2edfe10b9c33be8a971e08401bc0807e75a2ff376b7934473bc1f02bb512b77414daf260c9c7d4e1f0758b56ec5823892af310e6252fcfb1d9dbaddefdaa26f43f12f831fd221926d6536eeff641db46920ae0e48f3ff5de599714ba6510ce479d4116a519792281736f39c9fc0e10ef557392c43389271cebcf36543fcf6f83bf74b93ee4eb5e8c82e35bb4784cc1ed0ad291b16e8368487589f7590bf5896f340a36555a1cf69736da230a809176dbdfba3d47efb9a6932e5503d277532b7d4e6f7c7373a298e5843a9f74d5fd07fbc6ad22bc644ba9b3c94ec3c8f0b9321b16e5826b1f058f781760a5d4b6a8880202b41689139c37cd51f65a92d883f8901add03b650c9ec182fb565a4d657ebba9d6a5eb426b22d5933b72362e6ec327fb679aa8034b8b3b6680ad138be47652a3e77981187d2921cebfc1639aa280e3d38dba9b1af49ceded79c78a2d656b3a3e946e17e6257def6679f70f11aa01a2d906aecf4dbc7d1a332a8932ed719ce7eecb5450f494f944b3f6b637502ddba609c6e45dcfad1db7c7dda3e2c755ddcf27132985442e9b8df16f96c82e72e3e2491856d07756b9f08000100627066000900010073797a30000000000900020073797a320000000004000580140000001100010000000000000000000000000a"], 0x294}}, 0x4048010) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000001740)=0x7ffffffd, 0x4) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) recvmsg$can_j1939(r4, &(0x7f0000000280)={&(0x7f0000000080)=@pptp={0x18, 0x2, {0x0, @broadcast}}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000100)=""/141, 0x8d}, {&(0x7f00000001c0)=""/60, 0x3c}], 0x2}, 0x1) write$binfmt_script(r1, 0x0, 0x6f4000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)={0x24, r6, 0x1, 0x2070bd27, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x7}, @SEG6_ATTR_SECRETLEN={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x8000) sendmsg$SEG6_CMD_SET_TUNSRC(r4, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x54, r6, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x7}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xf0b4}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x68bb}, @SEG6_ATTR_HMACKEYID={0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x101}]}, 0x54}, 0x1, 0x0, 0x0, 0x100c0}, 0x84) executing program 0: ioctl$MEMREAD(0xffffffffffffffff, 0xc0404d1a, &(0x7f00000001c0)={0x1, 0x4d, 0xe7, &(0x7f0000000040)=""/77, &(0x7f00000000c0)=""/231, 0x0, '\x00', {0x2, 0x10000, 0x3}}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e04f82420"], 0x7) syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) executing program 1: mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="002145000014000b0000400600000a0000010a000002005000500000ffff00000002601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="d8000000180081064e81f782db44b904021d080400007c09e8fe55a10a0015c00500142603600e1208000f0000000401a8001600a400014003000004036010fab94dcf5c5f11043354fbc58df88b9a0461c1d6900094007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93", 0xd9}], 0x1}, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000001a40)={0x0, 0xca, "ff4d755824bfbae7e53cbae97f7e4e2f7465c9c8768600b5b60ea5820349a3e4bcb869fc89546da4c5a967a4a3d5b40494f22f6b1c0ebdeb97880a090685e37b28116d368fdddc2ac618bed7d1dbb5b90b68e48944ac17eafc10eba7a8d67ac75d632a3a701be937d95d7ca0a2e4554f91667fca482ceadaa876d6ebe659b3739f2f46f81e303b76796f7e02d8d072de4366edcad69e2ff1679383971e2478df42c1ccba5ae7a326c345db9ee94dc17b4b13481da49bb1b60c904b11f017af1632c53b39a23967c3d741"}, &(0x7f0000001b40)=0xd2) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000001c40)={r3, 0x94, &(0x7f0000001b80)=[@in6={0xa, 0x4e24, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x18800000}, @in6={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x7}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e22, @multicast1}, @in6={0xa, 0x4e24, 0x2, @loopback, 0xffffffff}, @in={0x2, 0x4e24, @broadcast}]}, &(0x7f0000001c80)=0x10) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file2\x00', 0x40, 0x23) open_by_handle_at(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="17000000fb"], 0x402800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a38000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000094000000060a010400000000000000000100000208000b40000000006c000480340001800b00010065787468647200002400028008000140000066c82c2ad159b875ffae000c080003400000000208000440000000220500020007000000340001800c00010062697477697365002400028008000340000000020800014000000014080002400000000d08000640000000300900010073797a300000000014000001110001000000"], 0x108}}, 0x0) writev(r5, &(0x7f00000019c0)=[{&(0x7f0000000400)="4a4ac1137f1b302fac2a8d6ce86ff618403db6e59eb039efa6bb311d799bf744afafbbe630de9c4bbe1f4ef8daffc7551d9cb8d1c6515128bf208ffd5e81c67cdeb264c4c235cbb7bca9d1150c670bbd9a3171e9c8f95b390eb0a25aee361533bc9405d42a7890fe654a0053bc30fc062e3216a23f3f4efb885cb91ad5b9c679816d007e1205edd87f104d", 0x8b}, {&(0x7f00000004c0)="17a55538903192d3a1314a60cf0fd7f6a399dd1b16bb00055495b18cd6610d437b8eedf27d718e11c65baa6ed66004906d53c483b09065707477460a806b0b0789692370c570a54b7f20b5a6fbb7554dbcc20032267a59ae2a36f0ae858b2706006da28f11268d8aea642b9cf4907ac739101fb4", 0x74}, {&(0x7f0000000540)="8fcec579dbaf85ed616e06f653ccdf35271858f0212718b7ac4b7c04c4af6ab05c39509c3cdeea13feae33810b14d67e288931556e79842fc07a17cc9ab8aca2ad81967ca8afd6dcba58157b501a8a6c049dd2b226270a3f0f17bc892e4ef9fc6c77715b60113ca532d741bd88ccd4e352b3b4c609c0f77c01df5be27fa7de8f417f60be4989a5118a4b81ccb50ce547597b27114b6713f68b89c9af82bdf3cdabcebe46d073166cba967bc102266bfbdd87fb3906bcb970db80bd8583c68b51d8f6ed8ff6de3b1ffa628d4adc32", 0xce}, {&(0x7f0000000780)="e65d3df9cae69901856c40f29c718554d66f2101c7332158b9a7ae089483a290bcc37613612143ee7682d33ee5876eb39d0c493346055d81925b23445c7af26faca5c3cec92a83bf9253aa3d20ef494f4686deb91c15c6af248fc18c6d01cd9daf6eab26368950dc2bd805dac48ad62c1d4eccd6075ec7962664808c6271990bc1", 0x81}, {&(0x7f0000000840)="139eb75446a35f3c6499a59d334afd4093107a362757f94014ecaa355b1d2d8d7d8ad79d7787f1796ffdb3809e72d415019af74457fdf89a506e2fe16a3e814d46e727d7062a33317acf1b131038d0e260747b024924fa206b86ec28e5dc6ee92a614c81ed530fc7d751e38cdbec45395978e96de2afef9b2606ca9fd47e494810b3f5e573e3fa4b5b457f7759656e8a7f3f5bb1a7daa4d1232f44278620d0f0109e2ac4f296c3c4c49589f6266e4f4c756e65bf7c647450b07498340e487b1f944a95cad457dfd4d5c2ea66e7f3b0443ad4310c29b5c370adc53ac870fb2cda707263837125c1e707c7b0f7d39f1d31b25e8f5049", 0xf5}, {&(0x7f0000000940)="015214c09048eac167822601a645184a69300068d03a18607b00ff255b3cf72c1b99c1bef6236c25584bbcc6b32c1ca9aac449e486f85a0c77918986d1f8920550ee253db2f3e04d9a305b725b2397b146f21bb177e6e7302323a180ed817b4dbbe7d4b9e6c35ff8eca08492bed252481968f2649a413d8026d09324c3abdcdb9cbaa39741a2f60631d57ac9c9c42e977ab5484a0092c7d3ee223e416640990731a39efa9f6ab0d59e75cbe47a565d62c5f0db13e5ccf143067d59c040b399ea30bf7210f260740c05e54ae57c01e83bdb014d8e219e3f595bb344f7581f33114d5f43d1c424ec7a2ad3d6b6786aa75fe1331a103891fdf40d91ca1c2b202d556ba9576dbb4ab37e52f64c06d31d0c4d9e6f05b2ccda7c31c6c403b95cca8a75c55ba0ad0e9409e28affc091780579171b64e90744d5dd883b1efae05574b889aa7861f853321f9196c76db55fd6d25790261b438c7fcae7ac62c781d7dbb0f923e0fdddee28dcfacfdb77e7234dbddfe761850703e303f20866d6abeab8136635c49d4e82c8ceba0bfd6e0aabb4254bd84f3b410915b7f7a02919d1c7c25f7f05aa97b28881e00eba15fa456c9a7213d74cb6af33704d114a197814097576c8e8b119c1f054b61ba553fe46134f7a703b134c4dfd3899ce84ef532c956c9d0e42a6a0210d6be6500d5199b8db536a8f57ccd79d3732af6bba86857d911d3ccb8f265aa03108820e933856bcb3eee4f1ebf4a07edb0b9628edb8b5c86b486dbcc236a314fb48fa107b5c8fd7103b9e5f37b0c287a0bfd843b6bb0bea473c7527dd552d590371af4dfa9ea26c06165cc0505b7035987063d1ef2518b783c7edd4a9a5e6ac8b77403269d2636ec6f026192a2349ce18078858fbce00d2241a79d979a91f7b2b6f095b3dc42c89d70661be2b7fa82446ddd4454c95843f023eba753afe8ded35e9625228fb9b75f55e74a672215b0e9970b203315c95e7c6e7e82efbab059d72926839b1ceac37e75bbe9031da16b3022dd4dcec3977c2f2ef2b162bdeab8df0f33ecba4feb91cf1c40317c48bf0a0b4d53ed4724b9300f9745a9b32f6c77608e8084de1856b00d4ee8001bc6a3a3f6c224c888becf897704cd914b15e0593de50179c0e379d31ca538348bd0fc5c5b33ba155c3c054e7f7444decbe7b8187ac8d3903178d728455ee9c575af76665eb0066bddfc5bbcd8c336cc769a8c82b7f4ceeb6c73c2cecd48f158c43af57b38608a807f66c8cc0385166eb75cad1586321e91357bb6079d89e32943d62b0645009f8447a38a582fe90900c368d77fb56666e6b0db94ae316d5954a9b5541196c00d10fb4ef7d7350a558978770ff4a36766b81dea944b93484c6cf8f80b30880768471a0887a96effac2f454ce29997cd1e8dfda5a442376173b04666620b4a2a8eadff4becf80df514309c25c3e792294e4f9ea6d90ff9a6b8832e8e9a5fae755f953675a9974754bb768b3d52b2a93223ef2dc8a320ce6ebbd1428fdac02cb781f9b8c6264339e6862c6ee5e31d330998baea75d792f3a62d3a5b99518b9b95cf9f4899c0b03a291ba2b7eb497986d6d0ef9f536826fbc712557bc0a27a4361675dc6e7d049734414cd7c3e7c453fb8018246486449cfbd7b09e9b375272173b65a0ce63a5a7b54dc50fea6abcb4d60056f3e31ca4ab985a50e067a6c2106bba385e912670ceaa03a93fef8201cd90ad323ae1185d436376bf82bbd13e1751bfcf6650df7b68d4ae5d3f79affbdf788ad1c235cd12529c51b8ee73fdf37076501634755e994761308c7503f453569d05fa12db9033c5df53f7b52a1d6ad7e9d4981655805457e6829983deed86188c4f8eab22139181cf34dbe843ca892d5868ff2b2b534c25fc1202e8f3d38b9cf50a43c39a467f56f7a1802751dfffe6a96f6efefa3a5d73a495fe059b810c20a1c2aada79f49cdff222937695b8f404bbbaf699e5eecdf2bc9585d6b6c19d05f54eb383140caecfebb88a09e688ac778e9dd6dce5b96d3be049c46f191dbeffff513f7c2d41e8fa9651a51f0651d0a7b43cbe36b89fe930df0422ba8930d2425d5a71ff9abd12455dbf90edef473587d639b529a76dd89694c962344c8c29a1393bd22621b058530706429ba229134ce871ce4cfadb4f10e22c5eef7bebf94ad6e5bb24edbf41b01cf77b28cb450dbf566e14af025803846a37ea7e252967a14e545676bf993989dcad52290392f6078e11c02f339daa817b922830b76c6305fe4048d9856f76c23c3717694e14882d44e0e938826ac65ea73baa42838f58217a8d68596b8a39f8df2cc8e6ee407bf3759a1511341369122aa98b474cc1e28827f9acd22318fab4dd79a9aed462c4697d14e93fe578404c384d7e7867185cdd11194b7d395ee8a89eb3ee7e0532d6785bf845c81939448a8c507d23d49de93e14c335b46c3b0ea5a1045cdfc4b0d40959d237e07d9f554786a99653d4b39a3107ee5d19afec0ad46e4568fd6b9ffe40dd9edca18ac7580ea1cc152d065eddea4d3f64b1689e87e86b330dc6963efc64040e434d4b5e8decb4c6376aaacc139e6d88a9f6c8609c67fa2ab9a64f6441b9611dbba6563b020d373aedcbd8ff726f915fd4f6fc46ef46d334809c2daadcda561574bd371fb6d8f3c9ad1a5da16a25333ff3c5c9b52fa6b19ef1d55fed6742f612a3bdd9c0e2207a79afa6d47458084304463825c69439470691ce11d5ee3af02625d826703df6c6e0629d825ffeba73c1d8838565ce37eeb874cf5867fe054d801845b897d18d3d9cb989ff1153783a05d3bfbdb61837ad1fc712dbc8a2a4f80a5d1ba2392dca3a27db12a162b5c9570c554bec2c6f41ff11b37ddb812b28ceddca42d21d28ea1d33b4811b2a9efe921c1b09e272c2ef5f47eb1c7ed60592260c751d5052cf66ed8eed97f6688059bf760ede0a5ea3ebab44b326b2e053e9d722b15064a0f630315c5e063279067bf53344dd57ae8f09147ad58ff5ec4c5be05facced24c57d2733123fb8726f5b3bf123a627d79cfd3d06ef1785f6b61c09447eff61dcd3a99dd9c1d17ffc78fb5964c8963571349becdcda2b339cb7ce61a043479d5cf4710cb6f36493b75dbed7a39ffaa489d32792ede49b0b10a8d439b5cfa5aed4cc3767399faf75fb0887992b6d983d0f28fb0b90582a7ca7b05c813501608d227c843e0386613d3be51c99ea5dd81339ded0b44e4d6b07465cb33de414c3bc42c78a78e7d8a1b96375f3c421a5b04a0bbc5c69e0cb1bab4f2a2f9f6d8e5354227fc4f3fdd6ac0ba67141a555cc0e2585ff8716b496db247cb72d92bf6568b7d60a52a95429788da4c115bd7353c613c6e746476995acaa631b9e31ad1d5cea4b0bc31d52aa7dcedd3d69a9a4511146d5934c20581f7ba39838bf9c1035f86c00a65839a07d99b44730ace483d3db756b93434c497426d7b4181f0d351f3df9f592181f8ba997bb3ab3a0d46eefb30c0c4161b454c0c64f3184f3203eff637caff762643dcf9a7521b30c0828e21c3101cf27514646f5ae5c6f27e8b3673b343b2120a2969ac561c228448cd59883cce67600f4a720778e8c2f842efc37d04f17194b4eba682591073203ef5b6c4d2a09264675f034de282943dacbd5a60139b724903625796b0cc076addfec997a3eb5b5eaa6e07ef45895c0c0d24b277631b862a3398475c0e14fd95c9e6814243b7eda1a43c48bf720a0575e038a2770f7e655992982b1b76f5442f4c0035dbb740679f1c78c14625b2f266fda6106261673cc02150f319ee23badd4b70cfe26ae464f610c74e2d8b7c985ce1f1fa8ea1574cea6591229e75e682bc7624172f4a8e2f6335fbcd498f67ff061b6cf2bdcd7d17978a4c6948938be8cb0f453d5173b09ad2469434555912b4dcc40871843f904ab6d012327b6e22757c89cb159acbc68d70e0d7cc1ce52298099e4d01d25e0b16782c7f80bb42edc4b0737bef6ec5a123eac393355733639db6bb9bef11b21e6409d7005afbac920b0dd06296de30052b230208e5ff602cd1d07d2d15d26acab49f3fe2d51ac303da25abb20233ab0109916e176ff7d174e031730a32bd067030943022c66455aa6942b7fa93a718ca442bf79f49e5cf68973e2524e56b1edf3cb6dff9e282008dc70dbb5967f3bbc15fae2c6bbea660b995940842c65b60ca8a8f8b525fd608d88df333172d5bcb10ccb161feeced44a6a066d648fae5d3fb4a60395fa2a937623e99a1607e072a27b1d99d0b4423821716e28c12a4c3127e151e6d4d6ed099cc1c8325024629dbf9c47f7a67559ff6afa4664fdbbff43a25e70e689a7147d0905ca5508d483293232231bd788be5af5a3cf6b363712639c417492e9f8cdca94f945e3849bdb322cf11da1d3b6fb5e173858a9906d64a21e317354c6cb43c1b83b01a9dd6b652a0d12ac4e9b1ea4d0386fc1c156f2f06251c95be7d159ac80744941e262acf045e99d497f4336fa8e7eae816ff115aa7428b13478d4f35fab1d6d3743defbb8956793de725e6e9280b5c99d4316ed1ca0e41eb924673c8ccbb5e4e5e7a8a8409124d6c2ecbd412d1e00d4d6e2cd68e3cda30695e498c1a62e288d6ec660c23b2253b9a67d8faa5c85c2ac83b40b2c3e06e67e7d32a912532463cf462535cf50fa8777426e5bb7bfa4c3228fe741f90e88127e32a119d06ca85796c1b8a670a0a8369881d0a36e400afcf977812434a15b0aabaac7e26c01f7098264b3cf0b4e5d6d3975ede62f4e5ee5d2c5966aacefc436d86e2ec50b7ded756ef0f55aea1a210af53f70d18899a5eb38d4e679fa9145db74a56446a6d2c3bc736709804def5a848075951b36ccd2ca5fb4fb9163c8123c2a2ac984e2f1c3bf2f8b87996f08bac6dae164f734e962683a651a252c226530b187cc9fb00ad2ce581458734a27ccc18d359aab66b99409b90c268ac478a7942e19c519139687c4a4f0469c07da7071e5b60fe9371e9cb7ac7fb114c77419162f27960bb7ca65524378495a7a57ea1ce15143ee83785ecdbd0fda419b755da32060078449283d2da265b15a27b5bf84dd94429fd8b4a7126df4263844cde05cdc9c17dace01c62ed6938d8904b743c618357b8c2494237877bb35ee1b4c763ecf104ab4d328eb10be1515bacd4aaf508ed014a41efae8e7cbc3fea15a3dbc7f8bdbc927e60592abb59dedbafd23c3780e907cfd04f1c8777bee9d3092a17bac09235f9dd8f161dc003349977c95e51359cbfe80803118fc07c92bf50e0116ec3a3fb8304af691ad69d442759a462f87ecf022eb4490333290296b4b73bc79961d6516f447e73ded4b9b7ed37b0a6234edad5d0c13a205364614f16c467bf321b65e9b0338d23c09eef04ebcdd5cdbbcf49185f49e48802eff869f36672b4c08c605c8806b5f2e43b394b882823c9a24661d2d58b1673901f485231a4df558b61ac23d043606dd34712454e863672199f35a2bc22753d462b29a9eb9c70badc2435aee8ddf58f7f2be9ce0f54f05c3ed812d7c026477fc1d9095570eb9455d2d932fe9f500c7527fa9747a7f51f27445015c7f2777f0f28c1336c2126c582e6f22c672d8fefc0b5aec3fada88ef01ea511e7197eec27e7449196adf68740dccd71789109fe7db677fcfd24160f2f0c1c2bbb0130c9e0d1da82405e4d16d021a42d4136c9be184cb6a999a9b92ace410a0bb2704dc12ab18d92473ce29b9d469c5fb732400dd75124b1cdae5064f132de032b55cfecab3a667ef9157adf329d9d34b131360f7116e", 0x1000}, {&(0x7f0000001940)="9e96e33ecc93e60b12f3a0f58e75fda2f7d0b39d0c83e2b2640ff393bde024b212af4be673e7c2aab6422c2ce79a432391c5c8c8d40c18955e39c9ca617eb0bf51901b1288f13974962063e16b50298ee8c7a9ca8e45d98b1c52aa1959e7351ff8eb478da2ab1e5cfc2a9b7d9b063cfaccf3d324f50e129274d393e1fd92fa0c", 0x80}], 0x7) executing program 3: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000001540)={r1, r1, r1}, 0x0, 0x0, 0x0) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f00000000c0)={0x1000806, 0x0, 0x4, 0x7}, 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r4, &(0x7f0000000800)='1', 0x1) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYRES16=r1, @ANYRES16, @ANYBLOB="d5eb2d018c57be6384d4cff0ef206b66414c411a3b8f400d409e9c43c332eb7a4d5cd667adea9d28800e84fa859210ba3880751ac2e6a7b4767a6a89c77f02fc173cd3fcfeeb00708994a9eae2117346e97bf26db95fbb9efaa7197665404a18cc24d5601e8601437deb3cedc5fff51dc374c29d8e043cfa2061", @ANYRESOCT=r4, @ANYRESOCT=0x0], 0x20}}, 0x4080) r5 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000002280)=0x6) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r4) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r4, &(0x7f0000000600)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000400)={0x198, r6, 0x0, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_CQM={0x74, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x1}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x1d9}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x47}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8}, @NL80211_ATTR_CQM_RSSI_THOLD={0x28, 0x1, [0x5, 0x0, 0xfffffffa, 0x7, 0x6, 0x9, 0x4e, 0x7, 0xfffffeff]}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x9fbb}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0xffffff01}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x5}]}, @NL80211_ATTR_CQM={0x34, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x6}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x45e}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x2d7}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x1e}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x2a8}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x43}]}, @NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_PKTS={0x8}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x26}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x43}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x2}]}, @NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0xffff}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0xfff}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x3d2}]}, @NL80211_ATTR_CQM={0x54, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0xffffff59}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0xffffb5e0}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x62d}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x3b}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x31}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0xa948}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x36}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x48}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x9}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8}]}, @NL80211_ATTR_CQM={0x40, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x3}, @NL80211_ATTR_CQM_RSSI_THOLD={0x24, 0x1, [0x8, 0xd74f, 0x0, 0x4, 0x7, 0x10000, 0x0, 0x6]}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x51}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x672}]}]}, 0x198}, 0x1, 0x0, 0x0, 0x4000854}, 0x40448c4) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x9, 0x0, 0x4, 0x1}]}, 0x10) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xffffffffffffffff, 0x1a31c1) executing program 3: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) close_range(r0, r0, 0x0) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x201, 0x4000003e, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x38, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x38}}, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000ac0)={0x14, 0x0, &(0x7f0000000a80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x410}}}, 0x0) r3 = creat(&(0x7f0000000240)='./file1\x00', 0x0) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r4, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r3, &(0x7f0000000000), 0x4000}]) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000280)={0x1, 0x2, 0x1000, 0xb1, &(0x7f0000000100)="463d8fe435d9b0fb06d36d2db344cb500a7e5bf8277dcb4399d5109cf7696f9130008090e253ad08817936f424133a67ce15743e804089969404c24f5c6d5a415f4eaccd852121d13719a4d6fcb9f24ea274296bea2dbc8ea0749e853f4c4c78c7c0468d90a56626d56c0fb4073afc956de0a0ba2b50092d6180b8ed420be32ef29dfa34160d3fec8b034446f9f8427b65a94dd331aeb5688dd130c82e4c1552d6517b55d00dba4868de4b5fecff798a25", 0xba, 0x0, &(0x7f00000001c0)="9c9996656a80df2f1d81fc104f278a633d6e86ee07efd0fc9fad06a3d9346843a221449ffec4cba19ce2d824f2bcd391186fa905563c561fd72e9ead2a9eeb27ef24933531b84eec56725ed41702b343f524dad08b97f59a893916dcd29aec2261881047b572868e4f0b8a84579aaf667b80b4f52a2cf1281b0e626605817e8e1980d336c752350313f8384a2db5e84ef712c02cc121ad612519fd0a31ac9b484bc8c399acac0dc5fef6cb0bf13ba3f450bf5ae2b427e7620d2a"}) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a9c000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002e2e00b9fdd672bad09dfb78c7699c74e891a0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) executing program 1: r0 = syz_usb_connect$cdc_ncm(0x2, 0x76, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904000001020d0000052406000105240000000d240f0100000400000000000306241a00000008241c0600070d000905810300020000120904010000020d00000904010102020d00000905820200020000000905030240"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000180)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x11, 0x9, 0x400, 0x14, 0x604, 0x823c, 0xc, 0x8001, 0x8, 0x4, 0xe4, 0x7}}, 0x0, 0x0, 0x0, 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000f00)=@ethtool_per_queue_op={0x4b, 0xe, [0xf693, 0x8, 0x3, 0x1ff, 0x1ff, 0x4, 0xe97, 0x4, 0x6, 0xecbf, 0xff, 0x101, 0x7, 0x200, 0x3d, 0x5e, 0x1000, 0xffff, 0xf557, 0x2, 0x5, 0x7c, 0xce, 0x2, 0xffffff6b, 0xe52c, 0xaa8, 0x7ffffffc, 0xd, 0xe9c4, 0xcd8, 0x6e, 0x200006, 0x7, 0x11, 0x6, 0x3, 0x6, 0x3, 0x3, 0x3, 0xfffffffc, 0xfd2, 0x6, 0x8, 0x401, 0xfffffffe, 0x2b, 0xa, 0x0, 0x7, 0x8, 0x5, 0x3, 0x6, 0x8, 0x23, 0x2, 0x3, 0x10, 0x3, 0xffffffff, 0x6, 0x5ffffff, 0xd1, 0xf, 0x4, 0xa, 0xfffffffe, 0x400, 0x80000000, 0x8000, 0x3, 0x5, 0x0, 0x0, 0x2, 0x1, 0x80, 0x4, 0x2, 0x0, 0xd, 0x2000006, 0x4, 0x8, 0x0, 0x1, 0xfffffff8, 0x0, 0x7ff, 0x7, 0x2, 0xbde, 0x37, 0x3, 0x4, 0x1, 0xa, 0x6, 0x7fff, 0xffffff00, 0x3, 0x33e3, 0x9, 0x6, 0x7fff, 0x6, 0x100, 0x3, 0xfffffffd, 0x2, 0x6, 0x8, 0x6, 0x7, 0x200, 0x9, 0xe, 0x81, 0x0, 0x4, 0x105, 0x5, 0x8, 0x3, 0x1, 0xfffffffa]}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000340)={0x14, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000200)={0x28, 0x5, r4, 0x0, &(0x7f0000000a40)="7f", 0x1, 0x4}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f00000002c0)={0x28, 0x5, r4, 0x0, &(0x7f0000ae1000/0x2000)=nil, 0x2000, 0x2}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x2c, &(0x7f0000000080)=[@in={0x2, 0x4e23, @rand_addr=0x640100fc}, @in6={0xa, 0x4e23, 0x7fb5fa78, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x27}}, 0x3}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r5, @in={{0x2, 0x4e22, @local}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000001c0)={r5, @in={{0x2, 0x4e24, @remote}}, 0x83, 0x2010}, 0x90) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) executing program 3: ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000040)={0x0, &(0x7f0000000040), 0x0, 0x0, 0xcccccccc}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 4 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES-mkdirat-syz_usb_connect-syz_usb_control_io$printer-syz_open_dev$char_usb-ioctl$FS_IOC_GETVERSION detailed listing: executing program 0: ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000040)={0x0, &(0x7f0000000040), 0x0, 0x0, 0xcccccccc}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCETHTOOL-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x2, 0x76, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904000001020d0000052406000105240000000d240f0100000400000000000306241a00000008241c0600070d000905810300020000120904010000020d00000904010102020d00000905820200020000000905030240"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000180)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x11, 0x9, 0x400, 0x14, 0x604, 0x823c, 0xc, 0x8001, 0x8, 0x4, 0xe4, 0x7}}, 0x0, 0x0, 0x0, 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000f00)=@ethtool_per_queue_op={0x4b, 0xe, [0xf693, 0x8, 0x3, 0x1ff, 0x1ff, 0x4, 0xe97, 0x4, 0x6, 0xecbf, 0xff, 0x101, 0x7, 0x200, 0x3d, 0x5e, 0x1000, 0xffff, 0xf557, 0x2, 0x5, 0x7c, 0xce, 0x2, 0xffffff6b, 0xe52c, 0xaa8, 0x7ffffffc, 0xd, 0xe9c4, 0xcd8, 0x6e, 0x200006, 0x7, 0x11, 0x6, 0x3, 0x6, 0x3, 0x3, 0x3, 0xfffffffc, 0xfd2, 0x6, 0x8, 0x401, 0xfffffffe, 0x2b, 0xa, 0x0, 0x7, 0x8, 0x5, 0x3, 0x6, 0x8, 0x23, 0x2, 0x3, 0x10, 0x3, 0xffffffff, 0x6, 0x5ffffff, 0xd1, 0xf, 0x4, 0xa, 0xfffffffe, 0x400, 0x80000000, 0x8000, 0x3, 0x5, 0x0, 0x0, 0x2, 0x1, 0x80, 0x4, 0x2, 0x0, 0xd, 0x2000006, 0x4, 0x8, 0x0, 0x1, 0xfffffff8, 0x0, 0x7ff, 0x7, 0x2, 0xbde, 0x37, 0x3, 0x4, 0x1, 0xa, 0x6, 0x7fff, 0xffffff00, 0x3, 0x33e3, 0x9, 0x6, 0x7fff, 0x6, 0x100, 0x3, 0xfffffffd, 0x2, 0x6, 0x8, 0x6, 0x7, 0x200, 0x9, 0xe, 0x81, 0x0, 0x4, 0x105, 0x5, 0x8, 0x3, 0x1, 0xfffffffa]}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000340)={0x14, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$MEMREAD-syz_emit_vhci-syz_usb_connect detailed listing: executing program 0: ioctl$MEMREAD(0xffffffffffffffff, 0xc0404d1a, &(0x7f00000001c0)={0x1, 0x4d, 0xe7, &(0x7f0000000040)=""/77, &(0x7f00000000c0)=""/231, 0x0, '\x00', {0x2, 0x10000, 0x3}}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e04f82420"], 0x7) syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program crashed: WARNING in blk_mq_free_tag_set single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$MEMREAD-syz_emit_vhci detailed listing: executing program 0: ioctl$MEMREAD(0xffffffffffffffff, 0xc0404d1a, &(0x7f00000001c0)={0x1, 0x4d, 0xe7, &(0x7f0000000040)=""/77, &(0x7f00000000c0)=""/231, 0x0, '\x00', {0x2, 0x10000, 0x3}}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e04f82420"], 0x7) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$MEMREAD-syz_usb_connect detailed listing: executing program 0: ioctl$MEMREAD(0xffffffffffffffff, 0xc0404d1a, &(0x7f00000001c0)={0x1, 0x4d, 0xe7, &(0x7f0000000040)=""/77, &(0x7f00000000c0)=""/231, 0x0, '\x00', {0x2, 0x10000, 0x3}}) syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program crashed: WARNING in blk_mq_free_tag_set testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program crashed: WARNING in blk_mq_free_tag_set testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program crashed: WARNING in blk_mq_free_tag_set extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program crashed: WARNING in blk_mq_free_tag_set validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program crashed: WARNING in blk_mq_free_tag_set validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f62760009051cc200000000000705e37e1b82e60905f202"], 0x0) program crashed: WARNING in blk_mq_free_tag_set validation run: crashed=true reproducing took 35m29.265174334s repro crashed as (corrupted=false): ------------[ cut here ]------------ timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist) WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706, CPU#0: kworker/0:5/5766 Modules linked in: CPU: 0 UID: 0 PID: 5766 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706 Code: c0 8b 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00 RSP: 0018:ffffc9000380f2b8 EFLAGS: 00010206 RAX: 1ffffd1ffff87aed RBX: 0000607edb3b3680 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: ffffffff8e5877bc RDI: 00000000ffffffff RBP: ffffe8ffffc3d680 R08: ffffffff909ba47f R09: 1ffffffff213748f R10: dffffc0000000000 R11: fffffbfff2137490 R12: ffff888079141000 R13: 0000000000000000 R14: ffffe8ffffc3d768 R15: 1ffffffff1d0b5de FS: 0000000000000000(0000) GS:ffff88812488a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007efdbe1eb7c0 CR3: 000000007322e000 CR4: 00000000003526f0 Call Trace: blk_mq_free_tag_set+0x617/0x790 block/blk-mq.c:4976 scsi_mq_free_tags+0x16/0x30 drivers/scsi/scsi_lib.c:2167 kref_put include/linux/kref.h:65 [inline] scsi_remove_host+0x243/0x730 drivers/scsi/hosts.c:193 mts_usb_disconnect+0x8e/0x100 drivers/usb/image/microtek.c:757 usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:618 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372 bus_remove_device+0x444/0x560 drivers/base/bus.c:664 device_del+0x524/0x8f0 drivers/base/core.c:3965 usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478 usb_disconnect+0x346/0x9a0 drivers/usb/core/hub.c:2350 hub_port_connect drivers/usb/core/hub.c:5420 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x1bbb/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): ------------[ cut here ]------------ timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist) WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706, CPU#0: kworker/0:5/5766 Modules linked in: CPU: 0 UID: 0 PID: 5766 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 kernel/rcu/srcutree.c:706 Code: c0 8b 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00 RSP: 0018:ffffc9000380f2b8 EFLAGS: 00010206 RAX: 1ffffd1ffff87aed RBX: 0000607edb3b3680 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: ffffffff8e5877bc RDI: 00000000ffffffff RBP: ffffe8ffffc3d680 R08: ffffffff909ba47f R09: 1ffffffff213748f R10: dffffc0000000000 R11: fffffbfff2137490 R12: ffff888079141000 R13: 0000000000000000 R14: ffffe8ffffc3d768 R15: 1ffffffff1d0b5de FS: 0000000000000000(0000) GS:ffff88812488a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007efdbe1eb7c0 CR3: 000000007322e000 CR4: 00000000003526f0 Call Trace: blk_mq_free_tag_set+0x617/0x790 block/blk-mq.c:4976 scsi_mq_free_tags+0x16/0x30 drivers/scsi/scsi_lib.c:2167 kref_put include/linux/kref.h:65 [inline] scsi_remove_host+0x243/0x730 drivers/scsi/hosts.c:193 mts_usb_disconnect+0x8e/0x100 drivers/usb/image/microtek.c:757 usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:618 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372 bus_remove_device+0x444/0x560 drivers/base/bus.c:664 device_del+0x524/0x8f0 drivers/base/core.c:3965 usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478 usb_disconnect+0x346/0x9a0 drivers/usb/core/hub.c:2350 hub_port_connect drivers/usb/core/hub.c:5420 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x1bbb/0x4d30 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245