Extracting prog: 40m29.896281589s Minimizing prog: 1h3m54.834138058s Simplifying prog options: 0s Extracting C: 53.035600539s Simplifying C: 11m54.39924522s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-socket$tipc-socket$inet6_tcp-socket$nl_netfilter-sendmsg$NFQNL_MSG_CONFIG-sendmsg$NFQNL_MSG_CONFIG-setsockopt$TIPC_GROUP_JOIN-socket$tipc-dup3-setsockopt$TIPC_GROUP_LEAVE-connect$bt_rfcomm-setsockopt$inet_tcp_TCP_REPAIR-setns-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-openat$iommufd-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl$IOMMU_TEST_OP_CREATE_ACCESS-ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz-mmap$IORING_OFF_SQ_RING-bpf$PROG_LOAD_XDP detailed listing: executing program 0: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x14, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount$tmpfs-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket-semget-add_key-mkdirat-mount-openat-openat$cgroup_ro-write-socket$nl_netfilter-socket$nl_netfilter-socket$inet6_tcp-setsockopt$inet6_tcp_TCP_CONGESTION-bind$inet6-sendto$inet6-setsockopt$inet6_tcp_TCP_CONGESTION-setsockopt$inet6_tcp_TCP_CONGESTION detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$uinput_user_dev-openat$kvm-openat$kvm-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-ioctl$KVM_CREATE_VM-openat$cuse-ioctl$KVM_SET_USER_MEMORY_REGION-sendmsg$nl_generic-ioctl$KVM_SET_REGS-openat$kvm-sendmsg$nl_route-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN detailed listing: executing program 0: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$uinput_user_dev-openat$kvm-openat$kvm-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$cuse-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-openat$cachefiles-openat$kvm-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN detailed listing: executing program 0: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800024000000002090001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000540), 0x6040, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$amidi-ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_usb_connect$printer-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED-sendmmsg$inet6-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_S_FMT-ppoll-syz_usb_control_io$printer-syz_open_dev$char_usb-pwritev2-close_range detailed listing: executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)={0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c0000904000002070101000905010200"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendmmsg$inet6(r3, &(0x7f0000000100)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = syz_open_dev$video4linux(&(0x7f0000000240), 0xffffffffffffffff, 0xb00) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x0, 0x0, {0xb51, 0xfffffffa, 0x0, 0x3, 0x8, 0x9, 0x5, 0x3}}) ppoll(&(0x7f0000000300)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r5, &(0x7f00000005c0)=[{&(0x7f0000000600)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 15, 25, 25, 6, 14, 18, 20, 20, 16, 15, 27, 25, 20, 25, 6, 29, 18, 24, 14, 29, 25, 16, 14, 20, 25, 6, 20, 27, 29] detailed listing: executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000640), r1) sendmsg$WG_CMD_GET_DEVICE(r1, 0x0, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="bf1600000000000018010000696c6c2500000000002020207b1af8ff00000000bfa1000000000000070100000dffffffb702000008000000b7030000020000008500000006000000bf61000000000000bfa200000000000007020000f0ffffffb70300000c000000b704000000000000b70500000000000085000000630000001500020000000000bf01000000000000850000005600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r1, 0x0, 0x1e, 0x0, &(0x7f0000000480)="06000000de00000022334456e55e16cbb83588efd1a320bd4496dc7a0800", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6}, 0x50) r2 = timerfd_create(0x0, 0x0) ioctl$TFD_IOC_SET_TICKS(r2, 0x40085400, &(0x7f00000000c0)=0x81) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000040)={0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="205aea4fd09e452c7a3d4b6c22020200000231260bf069f9124686b032a72052b9ced47225973ae29ab48b72ffa7c7f23e4a1fb4843af5d637ecc142a712a3c8b6d0f21c25274329d84ca2ffc712a8531a2b2ba6cbcd9a681bf0692be95d6ce16a51f6d81f8ccc7162bc8033c46aa275ac89ffef6eab18220219b6b64aeea3"], 0x0}, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000540)={0x1d, r4}, 0x18) connect$can_j1939(r3, &(0x7f0000000580)={0x1d, r4}, 0x18) writev(r3, &(0x7f00000005c0)=[{&(0x7f0000000600)="3874517c2edc", 0xfdef}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1f, 0x6, &(0x7f0000000280)=ANY=[@ANYBLOB="b700000000000000bf1600000000000079617e00000000001501010000000000850000005f00000095"], &(0x7f0000000640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000000000000000000000050019"], 0x24}}, 0x0) r3 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r3, &(0x7f0000000940)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c02000019000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000800000000000000000000000000000000000000000000000000000008000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000010100000000000084010500fc010000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000800000000fb0000000000493f0d512000000000000000000000000000000000000001000004d22b00000002000000fc020000000000000000000000000001000000000000000000000000000000000000000000000001000000000000000000000001000000003c00000002000000ffffffff000000000000000000000000000000000103000000000000d62c000000000000ff020000000000000000000000000001000004d23c00000002000000ac1414bb00000000000000000000000000000000020000000100000003000000000000007f00000100000000000000000000000000000000320000000200000000000000000000000000000000000001ffffffff00000000fdffffff000000000000000064010100000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000082ae86ac41e84f962b98c7f100000001028000000000000200000000000000edd742b65b3fb7253442a681c49583c96fe81a729f1d1c62ef7e67b91c541b14fe5291305c178a3355069fa6d470c784c7d3c70cb48f3fb72a5e06ba33592817ced668116e5fe77c4a302e0177fbd69489e8cf7bf6d0e3192be99cb2e455ebd58e31730ffad864595ca273ac564db62a5e154813d976a175308256d1bd8f2ba5981ae2ce3b13e6ff0214ae2704b75091815e"], 0x23c}, 0x1, 0x0, 0x0, 0x60004000}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_NET_NS_FD={0x8, 0x1c, r5}]}, 0x44}}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000008000000000afc8000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001000000085000000860000008500000050000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f0000000380)) write(r7, &(0x7f0000000100)='1', 0x1) r8 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_ep_write(r8, 0x4, 0x0, &(0x7f0000000b00)) syz_usb_control_io$hid(r8, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r6}, 0xc) executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b02a91c74e4"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="090000000400000004000000100000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000fa690000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) preadv(0xffffffffffffffff, &(0x7f0000000b40)=[{&(0x7f0000000b80)=""/160, 0xa0}], 0x1, 0xc03, 0x0) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2", 0xd4}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)={0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c0000904000002070101000905010200"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendmmsg$inet6(r3, &(0x7f0000000100)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = syz_open_dev$video4linux(&(0x7f0000000240), 0xffffffffffffffff, 0xb00) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x0, 0x0, {0xb51, 0xfffffffa, 0x0, 0x3, 0x8, 0x9, 0x5, 0x3}}) ppoll(&(0x7f0000000300)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r5, &(0x7f00000005c0)=[{&(0x7f0000000600)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f00004d3000/0x3000)=nil, 0x3000, 0xb635773f07ebbeea, 0x20010, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) sendfile(r2, r1, &(0x7f0000002e00)=0x64, 0x12) openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) epoll_create(0x409) executing program 3: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 2: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800024000000002090001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000540), 0x6040, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000640), r1) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x26008089}, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 4: mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000000000000000000000050019"], 0x24}}, 0x0) r3 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r3, &(0x7f0000000940)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c02000019000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000800000000000000000000000000000000000000000000000000000008000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000010100000000000084010500fc010000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000800000000fb0000000000493f0d512000000000000000000000000000000000000001000004d22b00000002000000fc020000000000000000000000000001000000000000000000000000000000000000000000000001000000000000000000000001000000003c00000002000000ffffffff000000000000000000000000000000000103000000000000d62c000000000000ff020000000000000000000000000001000004d23c00000002000000ac1414bb00000000000000000000000000000000020000000100000003000000000000007f00000100000000000000000000000000000000320000000200000000000000000000000000000000000001ffffffff00000000fdffffff000000000000000064010100000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000082ae86ac41e84f962b98c7f100000001028000000000000200000000000000edd742b65b3fb7253442a681c49583c96fe81a729f1d1c62ef7e67b91c541b14fe5291305c178a3355069fa6d470c784c7d3c70cb48f3fb72a5e06ba33592817ced668116e5fe77c4a302e0177fbd69489e8cf7bf6d0e3192be99cb2e455ebd58e31730ffad864595ca273ac564db62a5e154813d976a175308256d1bd8f2ba5981ae2ce3b13e6ff0214ae2704b75091815e"], 0x23c}, 0x1, 0x0, 0x0, 0x60004000}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_NET_NS_FD={0x8, 0x1c, r5}]}, 0x44}}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000008000000000afc8000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001000000085000000860000008500000050000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f0000000380)) write(r7, &(0x7f0000000100)='1', 0x1) r8 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_ep_write(r8, 0x4, 0x0, &(0x7f0000000b00)) syz_usb_control_io$hid(r8, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r6}, 0xc) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f00004d3000/0x3000)=nil, 0x3000, 0xb635773f07ebbeea, 0x20010, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) sendfile(r2, r1, &(0x7f0000002e00)=0x64, 0x12) openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) epoll_create(0x409) executing program 2: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@delqdisc={0x2c, 0x25, 0x200, 0x70bc28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x2}, {0x0, 0xc}, {0xf, 0x6}}, [@TCA_EGRESS_BLOCK={0xffffffffffffffb4, 0xe, 0xa0ea}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000001}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x40080, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141102) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x63) syz_emit_ethernet(0x42, 0x0, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) mount$9p_virtio(0x0, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x176) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x1a, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0xffffff0a, &(0x7f0000000180)=[{&(0x7f00000001c0)="c01803002d000b12d25a80648c2594f90224fc60100c024002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000b40)='./proc\x00', &(0x7f0000000d00)='proc\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) read$FUSE(0xffffffffffffffff, &(0x7f0000000dc0)={0x2020}, 0x2020) sendfile(r1, r0, &(0x7f0000002e00)=0x64, 0x12) r2 = openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000d80)='6', 0x1) epoll_create(0x409) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x28, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x7}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x1, 0x1}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000440)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, r8, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, r8, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b02a91c74e4"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="090000000400000004000000100000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000fa690000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) preadv(0xffffffffffffffff, &(0x7f0000000b40)=[{&(0x7f0000000b80)=""/160, 0xa0}], 0x1, 0xc03, 0x0) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 1: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000640), r1) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x26008089}, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)={0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c0000904000002070101000905010200"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendmmsg$inet6(r3, &(0x7f0000000100)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = syz_open_dev$video4linux(&(0x7f0000000240), 0xffffffffffffffff, 0xb00) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x0, 0x0, {0xb51, 0xfffffffa, 0x0, 0x3, 0x8, 0x9, 0x5, 0x3}}) ppoll(&(0x7f0000000300)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r5, &(0x7f00000005c0)=[{&(0x7f0000000600)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) executing program 0: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800024000000002090001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000540), 0x6040, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x14, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON-socket$tipc-socket$inet6_tcp-socket$nl_netfilter-sendmsg$NFQNL_MSG_CONFIG-sendmsg$NFQNL_MSG_CONFIG-setsockopt$TIPC_GROUP_JOIN-socket$tipc-dup3-setsockopt$TIPC_GROUP_LEAVE-connect$bt_rfcomm-setsockopt$inet_tcp_TCP_REPAIR-setns-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-openat$iommufd-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl$IOMMU_TEST_OP_CREATE_ACCESS-ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz-mmap$IORING_OFF_SQ_RING-bpf$PROG_LOAD_XDP detailed listing: executing program 0: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x14, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount$tmpfs-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket-semget-add_key-mkdirat-mount-openat-openat$cgroup_ro-write-socket$nl_netfilter-socket$nl_netfilter-socket$inet6_tcp-setsockopt$inet6_tcp_TCP_CONGESTION-bind$inet6-sendto$inet6-setsockopt$inet6_tcp_TCP_CONGESTION-setsockopt$inet6_tcp_TCP_CONGESTION detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$uinput_user_dev-openat$kvm-openat$kvm-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-ioctl$KVM_CREATE_VM-openat$cuse-ioctl$KVM_SET_USER_MEMORY_REGION-sendmsg$nl_generic-ioctl$KVM_SET_REGS-openat$kvm-sendmsg$nl_route-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN detailed listing: executing program 0: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$uinput_user_dev-openat$kvm-openat$kvm-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$cuse-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS-openat$cachefiles-openat$kvm-ioctl$KVM_RUN-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN detailed listing: executing program 0: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800024000000002090001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000540), 0x6040, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$amidi-ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_usb_connect$printer-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED-sendmmsg$inet6-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_S_FMT-ppoll-syz_usb_control_io$printer-syz_open_dev$char_usb-pwritev2-close_range detailed listing: executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)={0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c0000904000002070101000905010200"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendmmsg$inet6(r3, &(0x7f0000000100)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = syz_open_dev$video4linux(&(0x7f0000000240), 0xffffffffffffffff, 0xb00) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x0, 0x0, {0xb51, 0xfffffffa, 0x0, 0x3, 0x8, 0x9, 0x5, 0x3}}) ppoll(&(0x7f0000000300)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r5, &(0x7f00000005c0)=[{&(0x7f0000000600)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 1m40s testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 15, 25, 25, 6, 14, 18, 20, 20, 16, 15, 27, 25, 20, 25, 6, 29, 18, 24, 14, 29, 25, 16, 14, 20, 25, 6, 20, 27, 29] detailed listing: executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000640), r1) sendmsg$WG_CMD_GET_DEVICE(r1, 0x0, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="bf1600000000000018010000696c6c2500000000002020207b1af8ff00000000bfa1000000000000070100000dffffffb702000008000000b7030000020000008500000006000000bf61000000000000bfa200000000000007020000f0ffffffb70300000c000000b704000000000000b70500000000000085000000630000001500020000000000bf01000000000000850000005600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r1, 0x0, 0x1e, 0x0, &(0x7f0000000480)="06000000de00000022334456e55e16cbb83588efd1a320bd4496dc7a0800", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6}, 0x50) r2 = timerfd_create(0x0, 0x0) ioctl$TFD_IOC_SET_TICKS(r2, 0x40085400, &(0x7f00000000c0)=0x81) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000040)={0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="205aea4fd09e452c7a3d4b6c22020200000231260bf069f9124686b032a72052b9ced47225973ae29ab48b72ffa7c7f23e4a1fb4843af5d637ecc142a712a3c8b6d0f21c25274329d84ca2ffc712a8531a2b2ba6cbcd9a681bf0692be95d6ce16a51f6d81f8ccc7162bc8033c46aa275ac89ffef6eab18220219b6b64aeea3"], 0x0}, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000540)={0x1d, r4}, 0x18) connect$can_j1939(r3, &(0x7f0000000580)={0x1d, r4}, 0x18) writev(r3, &(0x7f00000005c0)=[{&(0x7f0000000600)="3874517c2edc", 0xfdef}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1f, 0x6, &(0x7f0000000280)=ANY=[@ANYBLOB="b700000000000000bf1600000000000079617e00000000001501010000000000850000005f00000095"], &(0x7f0000000640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000000000000000000000050019"], 0x24}}, 0x0) r3 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r3, &(0x7f0000000940)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c02000019000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000800000000000000000000000000000000000000000000000000000008000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000010100000000000084010500fc010000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000800000000fb0000000000493f0d512000000000000000000000000000000000000001000004d22b00000002000000fc020000000000000000000000000001000000000000000000000000000000000000000000000001000000000000000000000001000000003c00000002000000ffffffff000000000000000000000000000000000103000000000000d62c000000000000ff020000000000000000000000000001000004d23c00000002000000ac1414bb00000000000000000000000000000000020000000100000003000000000000007f00000100000000000000000000000000000000320000000200000000000000000000000000000000000001ffffffff00000000fdffffff000000000000000064010100000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000082ae86ac41e84f962b98c7f100000001028000000000000200000000000000edd742b65b3fb7253442a681c49583c96fe81a729f1d1c62ef7e67b91c541b14fe5291305c178a3355069fa6d470c784c7d3c70cb48f3fb72a5e06ba33592817ced668116e5fe77c4a302e0177fbd69489e8cf7bf6d0e3192be99cb2e455ebd58e31730ffad864595ca273ac564db62a5e154813d976a175308256d1bd8f2ba5981ae2ce3b13e6ff0214ae2704b75091815e"], 0x23c}, 0x1, 0x0, 0x0, 0x60004000}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_NET_NS_FD={0x8, 0x1c, r5}]}, 0x44}}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000008000000000afc8000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001000000085000000860000008500000050000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f0000000380)) write(r7, &(0x7f0000000100)='1', 0x1) r8 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_ep_write(r8, 0x4, 0x0, &(0x7f0000000b00)) syz_usb_control_io$hid(r8, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r6}, 0xc) executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b02a91c74e4"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="090000000400000004000000100000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000fa690000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) preadv(0xffffffffffffffff, &(0x7f0000000b40)=[{&(0x7f0000000b80)=""/160, 0xa0}], 0x1, 0xc03, 0x0) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2", 0xd4}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)={0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c0000904000002070101000905010200"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendmmsg$inet6(r3, &(0x7f0000000100)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = syz_open_dev$video4linux(&(0x7f0000000240), 0xffffffffffffffff, 0xb00) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x0, 0x0, {0xb51, 0xfffffffa, 0x0, 0x3, 0x8, 0x9, 0x5, 0x3}}) ppoll(&(0x7f0000000300)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r5, &(0x7f00000005c0)=[{&(0x7f0000000600)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f00004d3000/0x3000)=nil, 0x3000, 0xb635773f07ebbeea, 0x20010, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) sendfile(r2, r1, &(0x7f0000002e00)=0x64, 0x12) openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) epoll_create(0x409) executing program 3: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 2: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800024000000002090001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000540), 0x6040, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000640), r1) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x26008089}, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 4: mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000000000000000000000050019"], 0x24}}, 0x0) r3 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r3, &(0x7f0000000940)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c02000019000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000800000000000000000000000000000000000000000000000000000008000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000010100000000000084010500fc010000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000800000000fb0000000000493f0d512000000000000000000000000000000000000001000004d22b00000002000000fc020000000000000000000000000001000000000000000000000000000000000000000000000001000000000000000000000001000000003c00000002000000ffffffff000000000000000000000000000000000103000000000000d62c000000000000ff020000000000000000000000000001000004d23c00000002000000ac1414bb00000000000000000000000000000000020000000100000003000000000000007f00000100000000000000000000000000000000320000000200000000000000000000000000000000000001ffffffff00000000fdffffff000000000000000064010100000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000082ae86ac41e84f962b98c7f100000001028000000000000200000000000000edd742b65b3fb7253442a681c49583c96fe81a729f1d1c62ef7e67b91c541b14fe5291305c178a3355069fa6d470c784c7d3c70cb48f3fb72a5e06ba33592817ced668116e5fe77c4a302e0177fbd69489e8cf7bf6d0e3192be99cb2e455ebd58e31730ffad864595ca273ac564db62a5e154813d976a175308256d1bd8f2ba5981ae2ce3b13e6ff0214ae2704b75091815e"], 0x23c}, 0x1, 0x0, 0x0, 0x60004000}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_NET_NS_FD={0x8, 0x1c, r5}]}, 0x44}}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000008000000000afc8000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001000000085000000860000008500000050000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f0000000380)) write(r7, &(0x7f0000000100)='1', 0x1) r8 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_ep_write(r8, 0x4, 0x0, &(0x7f0000000b00)) syz_usb_control_io$hid(r8, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r6}, 0xc) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f00004d3000/0x3000)=nil, 0x3000, 0xb635773f07ebbeea, 0x20010, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) sendfile(r2, r1, &(0x7f0000002e00)=0x64, 0x12) openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) epoll_create(0x409) executing program 2: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@delqdisc={0x2c, 0x25, 0x200, 0x70bc28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x2}, {0x0, 0xc}, {0xf, 0x6}}, [@TCA_EGRESS_BLOCK={0xffffffffffffffb4, 0xe, 0xa0ea}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000001}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x40080, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141102) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x63) syz_emit_ethernet(0x42, 0x0, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) mount$9p_virtio(0x0, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x176) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x1a, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0xffffff0a, &(0x7f0000000180)=[{&(0x7f00000001c0)="c01803002d000b12d25a80648c2594f90224fc60100c024002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000b40)='./proc\x00', &(0x7f0000000d00)='proc\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) read$FUSE(0xffffffffffffffff, &(0x7f0000000dc0)={0x2020}, 0x2020) sendfile(r1, r0, &(0x7f0000002e00)=0x64, 0x12) r2 = openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000d80)='6', 0x1) epoll_create(0x409) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x28, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x7}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x1, 0x1}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000440)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, r8, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, r8, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b02a91c74e4"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="090000000400000004000000100000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000fa690000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) preadv(0xffffffffffffffff, &(0x7f0000000b40)=[{&(0x7f0000000b80)=""/160, 0xa0}], 0x1, 0xc03, 0x0) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 1: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000640), r1) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x26008089}, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)={0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c0000904000002070101000905010200"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendmmsg$inet6(r3, &(0x7f0000000100)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = syz_open_dev$video4linux(&(0x7f0000000240), 0xffffffffffffffff, 0xb00) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x0, 0x0, {0xb51, 0xfffffffa, 0x0, 0x3, 0x8, 0x9, 0x5, 0x3}}) ppoll(&(0x7f0000000300)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r5, &(0x7f00000005c0)=[{&(0x7f0000000600)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) executing program 0: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800024000000002090001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000540), 0x6040, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x14, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: bisecting 30 programs bisect: split chunks (needed=false): <30> bisect: split chunk #0 of len 30 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 27, 25, 20, 25, 6, 29, 18, 24, 14, 29, 25, 16, 14, 20, 25, 6, 20, 27, 29] detailed listing: executing program 4: mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000000000000000000000050019"], 0x24}}, 0x0) r3 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r3, &(0x7f0000000940)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c02000019000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000800000000000000000000000000000000000000000000000000000008000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000010100000000000084010500fc010000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000800000000fb0000000000493f0d512000000000000000000000000000000000000001000004d22b00000002000000fc020000000000000000000000000001000000000000000000000000000000000000000000000001000000000000000000000001000000003c00000002000000ffffffff000000000000000000000000000000000103000000000000d62c000000000000ff020000000000000000000000000001000004d23c00000002000000ac1414bb00000000000000000000000000000000020000000100000003000000000000007f00000100000000000000000000000000000000320000000200000000000000000000000000000000000001ffffffff00000000fdffffff000000000000000064010100000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000082ae86ac41e84f962b98c7f100000001028000000000000200000000000000edd742b65b3fb7253442a681c49583c96fe81a729f1d1c62ef7e67b91c541b14fe5291305c178a3355069fa6d470c784c7d3c70cb48f3fb72a5e06ba33592817ced668116e5fe77c4a302e0177fbd69489e8cf7bf6d0e3192be99cb2e455ebd58e31730ffad864595ca273ac564db62a5e154813d976a175308256d1bd8f2ba5981ae2ce3b13e6ff0214ae2704b75091815e"], 0x23c}, 0x1, 0x0, 0x0, 0x60004000}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_NET_NS_FD={0x8, 0x1c, r5}]}, 0x44}}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000008000000000afc8000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001000000085000000860000008500000050000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f0000000380)) write(r7, &(0x7f0000000100)='1', 0x1) r8 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_ep_write(r8, 0x4, 0x0, &(0x7f0000000b00)) syz_usb_control_io$hid(r8, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r6}, 0xc) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f00004d3000/0x3000)=nil, 0x3000, 0xb635773f07ebbeea, 0x20010, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) sendfile(r2, r1, &(0x7f0000002e00)=0x64, 0x12) openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) epoll_create(0x409) executing program 2: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@delqdisc={0x2c, 0x25, 0x200, 0x70bc28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x2}, {0x0, 0xc}, {0xf, 0x6}}, [@TCA_EGRESS_BLOCK={0xffffffffffffffb4, 0xe, 0xa0ea}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000001}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x40080, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141102) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x63) syz_emit_ethernet(0x42, 0x0, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) mount$9p_virtio(0x0, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x176) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x1a, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0xffffff0a, &(0x7f0000000180)=[{&(0x7f00000001c0)="c01803002d000b12d25a80648c2594f90224fc60100c024002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000b40)='./proc\x00', &(0x7f0000000d00)='proc\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) read$FUSE(0xffffffffffffffff, &(0x7f0000000dc0)={0x2020}, 0x2020) sendfile(r1, r0, &(0x7f0000002e00)=0x64, 0x12) r2 = openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000d80)='6', 0x1) epoll_create(0x409) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x28, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x7}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x1, 0x1}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000440)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, r8, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, r8, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b02a91c74e4"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="090000000400000004000000100000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000fa690000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) preadv(0xffffffffffffffff, &(0x7f0000000b40)=[{&(0x7f0000000b80)=""/160, 0xa0}], 0x1, 0xc03, 0x0) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 1: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000640), r1) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x26008089}, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)={0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c0000904000002070101000905010200"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendmmsg$inet6(r3, &(0x7f0000000100)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = syz_open_dev$video4linux(&(0x7f0000000240), 0xffffffffffffffff, 0xb00) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x0, 0x0, {0xb51, 0xfffffffa, 0x0, 0x3, 0x8, 0x9, 0x5, 0x3}}) ppoll(&(0x7f0000000300)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r5, &(0x7f00000005c0)=[{&(0x7f0000000600)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) executing program 0: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800024000000002090001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000540), 0x6040, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x14, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) program crashed: WARNING: ODEBUG bug in vub300_disconnect bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 25, 16, 14, 20, 25, 6, 20, 27, 29] detailed listing: executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x28, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x7}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x1, 0x1}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000440)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, r8, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, r8, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r9, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b02a91c74e4"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="090000000400000004000000100000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000fa690000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) preadv(0xffffffffffffffff, &(0x7f0000000b40)=[{&(0x7f0000000b80)=""/160, 0xa0}], 0x1, 0xc03, 0x0) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 1: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000640), r1) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x26008089}, 0x24008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x181) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000040)={0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c0000904000002070101000905010200"], 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x1}, 0x8) sendmmsg$inet6(r3, &(0x7f0000000100)=[{{&(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = syz_open_dev$video4linux(&(0x7f0000000240), 0xffffffffffffffff, 0xb00) ioctl$VIDIOC_SUBDEV_S_FMT(r4, 0xc0585605, &(0x7f0000000280)={0x0, 0x0, {0xb51, 0xfffffffa, 0x0, 0x3, 0x8, 0x9, 0x5, 0x3}}) ppoll(&(0x7f0000000300)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r5, &(0x7f00000005c0)=[{&(0x7f0000000600)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) executing program 0: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800024000000002090001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000540), 0x6040, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x6, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x14, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 27, 25, 20, 25, 6, 29, 18, 24, 14] detailed listing: executing program 4: mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000000000000000000000050019"], 0x24}}, 0x0) r3 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r3, &(0x7f0000000940)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c02000019000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000800000000000000000000000000000000000000000000000000000008000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000010100000000000084010500fc010000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000800000000fb0000000000493f0d512000000000000000000000000000000000000001000004d22b00000002000000fc020000000000000000000000000001000000000000000000000000000000000000000000000001000000000000000000000001000000003c00000002000000ffffffff000000000000000000000000000000000103000000000000d62c000000000000ff020000000000000000000000000001000004d23c00000002000000ac1414bb00000000000000000000000000000000020000000100000003000000000000007f00000100000000000000000000000000000000320000000200000000000000000000000000000000000001ffffffff00000000fdffffff000000000000000064010100000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000082ae86ac41e84f962b98c7f100000001028000000000000200000000000000edd742b65b3fb7253442a681c49583c96fe81a729f1d1c62ef7e67b91c541b14fe5291305c178a3355069fa6d470c784c7d3c70cb48f3fb72a5e06ba33592817ced668116e5fe77c4a302e0177fbd69489e8cf7bf6d0e3192be99cb2e455ebd58e31730ffad864595ca273ac564db62a5e154813d976a175308256d1bd8f2ba5981ae2ce3b13e6ff0214ae2704b75091815e"], 0x23c}, 0x1, 0x0, 0x0, 0x60004000}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_NET_NS_FD={0x8, 0x1c, r5}]}, 0x44}}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000008000000000afc8000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001000000085000000860000008500000050000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f0000000380)) write(r7, &(0x7f0000000100)='1', 0x1) r8 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_ep_write(r8, 0x4, 0x0, &(0x7f0000000b00)) syz_usb_control_io$hid(r8, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r6}, 0xc) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f00004d3000/0x3000)=nil, 0x3000, 0xb635773f07ebbeea, 0x20010, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) sendfile(r2, r1, &(0x7f0000002e00)=0x64, 0x12) openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) epoll_create(0x409) executing program 2: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@delqdisc={0x2c, 0x25, 0x200, 0x70bc28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x2}, {0x0, 0xc}, {0xf, 0x6}}, [@TCA_EGRESS_BLOCK={0xffffffffffffffb4, 0xe, 0xa0ea}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000001}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x40080, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141102) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x63) syz_emit_ethernet(0x42, 0x0, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) mount$9p_virtio(0x0, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x176) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x1a, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0xffffff0a, &(0x7f0000000180)=[{&(0x7f00000001c0)="c01803002d000b12d25a80648c2594f90224fc60100c024002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000b40)='./proc\x00', &(0x7f0000000d00)='proc\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) read$FUSE(0xffffffffffffffff, &(0x7f0000000dc0)={0x2020}, 0x2020) sendfile(r1, r0, &(0x7f0000002e00)=0x64, 0x12) r2 = openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000d80)='6', 0x1) epoll_create(0x409) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 29, 18, 24, 14] detailed listing: executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x20a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="ea012351ddc58332fdb2081dbbbe1e347aaa8ec7d8c9738c1a2ab4412ce01f0daf", 0x21}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000280)="b3", 0x1}, {0x0}, {&(0x7f00000002c0)="3b914a21e572121d61fdf40d84c51934835536d4f18e68b73bc5849cdbb99a8f94749dc76d905998086bf6294ede8a856a80a22abe2dbe28e663b68cf0f66220380680f2f5a1497cf47ee7078ed5e31644130ed83b56abc93e4a7e5a0cd66741d14303fe304d081d673bf7b3089d8b9661ab8442729e5662099b6e72a00f71a73f38144336a52fbdccd7c971e00581709e9cbc5f76960dcb023a5fac0e06cb81312fcbe7400e3db720906f3aca52e799fd2215848393cbd6c12bb82a02874c5d60bfac879813816048971f995d79e4003b7136a2cee6", 0xd6}, {&(0x7f0000000640)="5752f110dea01f736c54bd8156adca303243093e415b2221795387428b3f75eca7f339bd8d0f4e842593c2555c1b48f2aa8c3e9532700b39559bc20fbd9d3f1043acb63a2d1f422d90d192994d34b023020452d5de55e3618091c235c5143340a9f7aa0953cff1b0db96d3d041e0", 0x6e}, {&(0x7f0000001640)="2b6ae48f4296cf2b8ad3356c2ad4f060648fb1799f29db52139693d0baa4b2ed37c20f6b8f4e7d48e804ad5cb846accd678b8d0c76713e69e7a82c1fb5da6d0317e1573301f89879647a72300007a36006cde6b495fc8893163f5640394b310bfd769870c5dc28031cde7f6eb0c70646abf481881c7161a68f0cb0b279f5318c54d949a4419606c45c98cded701900dffdd83216ce38ae9bfa490ea5b0e614242c29992abc85dd3de88bacddc59364ee63e451d5528666d79b0a412069ed57ce1d528498e2a45046d53ef5aa49f4aca371f5f08d52a81c3bcd3243cb858806a476ee2e75196b4a70a744247b73af94d41ec5cc5c328204615d47", 0xfa}, {0x0}], 0x6}}], 0x2, 0x4004084) executing program 2: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000480)={0x28, 0x6, 0x0, 0x0, &(0x7f000068e000/0x1000)=nil, 0x1000, 0x7ffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f00004d3000/0x3000)=nil, 0x3000, 0xb635773f07ebbeea, 0x20010, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r4, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) sendfile(r2, r1, &(0x7f0000002e00)=0x64, 0x12) openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) epoll_create(0x409) executing program 2: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@delqdisc={0x2c, 0x25, 0x200, 0x70bc28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x2}, {0x0, 0xc}, {0xf, 0x6}}, [@TCA_EGRESS_BLOCK={0xffffffffffffffb4, 0xe, 0xa0ea}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000001}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x40080, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x141102) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="94", 0xf000}, {0x0}], 0x2) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x63) syz_emit_ethernet(0x42, 0x0, 0x0) openat2$dir(0xffffff9c, 0x0, 0x0, 0x0) mount$9p_virtio(0x0, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x176) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000002d0013472d"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) unshare(0x22020600) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x1a, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x4008800) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0xffffff0a, &(0x7f0000000180)=[{&(0x7f00000001c0)="c01803002d000b12d25a80648c2594f90224fc60100c024002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000b40)='./proc\x00', &(0x7f0000000d00)='proc\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./sec\x00', 0x1ff) read$FUSE(0xffffffffffffffff, &(0x7f0000000dc0)={0x2020}, 0x2020) sendfile(r1, r0, &(0x7f0000002e00)=0x64, 0x12) r2 = openat(0xffffffffffffff9c, &(0x7f0000000d40)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r2, &(0x7f0000000d80)='6', 0x1) epoll_create(0x409) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 27, 25, 20, 25] detailed listing: executing program 4: mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x10106, 0x2, 0x0) socket(0x6, 0x2, 0x0) semget(0x0, 0x0, 0x1f3f25a7ee159e73) add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="ae", 0x1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000014c0)='./proc\x00', &(0x7f0000001500)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/bus/pci/00/00.0\x00', 0x80100, 0x28) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001580)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write(r3, &(0x7f00000015c0)="4ff66fbe", 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000240)='dctcp', 0x5) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000001380)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000013c0)='bbr', 0x3) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000001400)='dctcp', 0x5) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="240000002100010000000000000000000a0000000000000000000000050019"], 0x24}}, 0x0) r3 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r3, &(0x7f0000000940)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c02000019000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000800000000000000000000000000000000000000000000000000000008000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000010100000000000084010500fc010000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000800000000fb0000000000493f0d512000000000000000000000000000000000000001000004d22b00000002000000fc020000000000000000000000000001000000000000000000000000000000000000000000000001000000000000000000000001000000003c00000002000000ffffffff000000000000000000000000000000000103000000000000d62c000000000000ff020000000000000000000000000001000004d23c00000002000000ac1414bb00000000000000000000000000000000020000000100000003000000000000007f00000100000000000000000000000000000000320000000200000000000000000000000000000000000001ffffffff00000000fdffffff000000000000000064010100000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000082ae86ac41e84f962b98c7f100000001028000000000000200000000000000edd742b65b3fb7253442a681c49583c96fe81a729f1d1c62ef7e67b91c541b14fe5291305c178a3355069fa6d470c784c7d3c70cb48f3fb72a5e06ba33592817ced668116e5fe77c4a302e0177fbd69489e8cf7bf6d0e3192be99cb2e455ebd58e31730ffad864595ca273ac564db62a5e154813d976a175308256d1bd8f2ba5981ae2ce3b13e6ff0214ae2704b75091815e"], 0x23c}, 0x1, 0x0, 0x0, 0x60004000}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r5 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_NET_NS_FD={0x8, 0x1c, r5}]}, 0x44}}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000008000000000afc8000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001000000085000000860000008500000050000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000dc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r7 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f0000000380)) write(r7, &(0x7f0000000100)='1', 0x1) r8 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r8, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_ep_write(r8, 0x4, 0x0, &(0x7f0000000b00)) syz_usb_control_io$hid(r8, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r6}, 0xc) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 25] detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$MAP_CREATE-prlimit64-sched_setscheduler-getsockopt-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-gettid-setsockopt$sock_int-socket-write-close_range-mmap$xdp-mremap-openat$audio-syz_init_net_socket$x25-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT detailed listing: executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3-syz_usb_control_io$hid-syz_usb_ep_write-bpf$PROG_BIND_MAP detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3-syz_usb_control_io$hid-syz_usb_ep_write-bpf$PROG_BIND_MAP detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r4, &(0x7f0000000100)='1', 0x1) r5 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_ep_write(r5, 0x4, 0x0, &(0x7f0000000b00)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000e00)={r3}, 0xc) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: concatenation succeeded found reproducer with 20 syscalls minimizing guilty program testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3-syz_usb_control_io$hid-syz_usb_ep_write detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='1', 0x1) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$uac3(r4, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_ep_write(r4, 0x4, 0x0, &(0x7f0000000b00)) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3-syz_usb_control_io$hid detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='1', 0x1) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$uac3(r4, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r4, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='1', 0x1) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$uac3(r4, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='1', 0x1) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, 0x0) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='1', 0x1) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r4, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='1', 0x1) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$uac3(r4, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-write-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r3, &(0x7f0000000100)='1', 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-openat-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) r3 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-mkdirat-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000340)='./proc\x00', 0x24) r3 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-mount-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r3 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-mkdirat-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r3 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-bpf$PROG_LOAD-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-sendmsg$nl_route-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x2040000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_NET_NS_FD={0x8, 0x1c, r2}]}, 0x44}}, 0x0) r3 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$uac3(r3, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_open_procfs$userns-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000300)) r2 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac3(r2, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-ioctl$sock_SIOCGIFINDEX-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r1, 0x0, 0x0, 0x800, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r2 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac3(r2, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-sendto$inet6-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0x10, 0x800, 0xfffffffd) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$uac3(r1, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-socket$inet6-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0x10, 0x800, 0xfffffffd) r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_xfrm-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash extracting C reproducer testing compiled C program (duration=2m15.331453734s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 program crashed: BUG: sleeping function called from invalid context in mmc_free_host simplifying C reproducer testing compiled C program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 program did not crash testing compiled C program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true testing program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true testing program (duration=2m15.331453734s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$uac3 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000009c0)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000ac0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true reproducing took 2h4m32.585972034s repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 28, name: ktimers/1 preempt_count: 0, expected: 0 RCU nest depth: 2, expected: 0 locks held by ktimers/1/28: 5, last CPU#1: #0: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186 #1: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186 #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: timer_base_lock_expiry kernel/time/timer.c:1502 [inline] #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: __run_timer_base+0x11a/0x9b0 kernel/time/timer.c:2384 #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57 #4: ffffc90000a2fa80 ((&vub300->inactivity_timer)){+...}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 CPU: 1 UID: 0 PID: 28 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x31b/0x470 kernel/sched/core.c:9264 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] run_ktimerd+0x6a/0x100 kernel/softirq.c:1174 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W ----------------------------- kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 locks held by ktimers/1/28: 5, last CPU#1: #0: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186 #1: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186 #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: timer_base_lock_expiry kernel/time/timer.c:1502 [inline] #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: __run_timer_base+0x11a/0x9b0 kernel/time/timer.c:2384 #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57 #4: ffffc90000a2fa80 ((&vub300->inactivity_timer)){+...}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 stack backtrace: CPU: 1 UID: 0 PID: 28 Comm: ktimers/1 Tainted: G W syzkaller #0 PREEMPT_{RT,(full)} Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972 __synchronize_srcu+0x157/0x2f0 kernel/rcu/srcutree.c:1464 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x127/0x3d0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] run_ktimerd+0x6a/0x100 kernel/softirq.c:1174 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ------------[ cut here ]------------ Voluntary context switch within RCU read-side critical section! WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0xc1d/0xe70 kernel/rcu/tree_plugin.h:332, CPU#1: ktimers/1/28 Modules linked in: CPU: 1 UID: 0 PID: 28 Comm: ktimers/1 Tainted: G W syzkaller #0 PREEMPT_{RT,(full)} Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:rcu_note_context_switch+0xc1d/0xe70 kernel/rcu/tree_plugin.h:332 Code: 48 c1 e8 03 0f b6 04 28 84 c0 0f 85 30 02 00 00 41 80 3f 00 0f 84 18 f5 ff ff 90 0f 0b 90 e9 0f f5 ff ff 48 8d 3d 03 85 09 0f <67> 48 0f b9 3a e9 ab f4 ff ff 90 0f 0b 90 45 84 ed 0f 84 79 f4 ff RSP: 0018:ffffc90000a2f2c0 EFLAGS: 00010002 RAX: 0000000000000000 RBX: ffff88801e2be960 RCX: 8000000000000002 RDX: 0000000000000000 RSI: ffffffff8bcc6a60 RDI: ffffffff90b58f30 RBP: dffffc0000000000 R08: ffffffff90b23c7f R09: 1ffffffff216478f R10: dffffc0000000000 R11: fffffbfff2164790 R12: ffff88801e2bddc0 R13: 0000000000000000 R14: ffff8880b853d340 R15: ffff88801e2be284 FS: 0000000000000000(0000) GS:ffff888124ab9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc7a4156d8 CR3: 000000003e56a000 CR4: 00000000003526f0 Call Trace: __schedule+0x28f/0x5700 kernel/sched/core.c:7138 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 __synchronize_srcu+0x23b/0x2f0 kernel/rcu/srcutree.c:1477 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x127/0x3d0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] run_ktimerd+0x6a/0x100 kernel/softirq.c:1174 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: 48 c1 e8 03 shr $0x3,%rax 4: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax 8: 84 c0 test %al,%al a: 0f 85 30 02 00 00 jne 0x240 10: 41 80 3f 00 cmpb $0x0,(%r15) 14: 0f 84 18 f5 ff ff je 0xfffff532 1a: 90 nop 1b: 0f 0b ud2 1d: 90 nop 1e: e9 0f f5 ff ff jmp 0xfffff532 23: 48 8d 3d 03 85 09 0f lea 0xf098503(%rip),%rdi # 0xf09852d * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: e9 ab f4 ff ff jmp 0xfffff4df 34: 90 nop 35: 0f 0b ud2 37: 90 nop 38: 45 84 ed test %r13b,%r13b 3b: 0f .byte 0xf 3c: 84 79 f4 test %bh,-0xc(%rcx) 3f: ff .byte 0xff final repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 28, name: ktimers/1 preempt_count: 0, expected: 0 RCU nest depth: 2, expected: 0 locks held by ktimers/1/28: 5, last CPU#1: #0: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186 #1: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186 #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: timer_base_lock_expiry kernel/time/timer.c:1502 [inline] #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: __run_timer_base+0x11a/0x9b0 kernel/time/timer.c:2384 #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57 #4: ffffc90000a2fa80 ((&vub300->inactivity_timer)){+...}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 CPU: 1 UID: 0 PID: 28 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x31b/0x470 kernel/sched/core.c:9264 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] run_ktimerd+0x6a/0x100 kernel/softirq.c:1174 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W ----------------------------- kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 locks held by ktimers/1/28: 5, last CPU#1: #0: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186 #1: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186 #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: timer_base_lock_expiry kernel/time/timer.c:1502 [inline] #2: ffff8880b8526360 (&base->expiry_lock){+...}-{3:3}, at: __run_timer_base+0x11a/0x9b0 kernel/time/timer.c:2384 #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #3: ffffffff8f1c3d40 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57 #4: ffffc90000a2fa80 ((&vub300->inactivity_timer)){+...}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 stack backtrace: CPU: 1 UID: 0 PID: 28 Comm: ktimers/1 Tainted: G W syzkaller #0 PREEMPT_{RT,(full)} Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972 __synchronize_srcu+0x157/0x2f0 kernel/rcu/srcutree.c:1464 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x127/0x3d0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] run_ktimerd+0x6a/0x100 kernel/softirq.c:1174 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ------------[ cut here ]------------ Voluntary context switch within RCU read-side critical section! WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0xc1d/0xe70 kernel/rcu/tree_plugin.h:332, CPU#1: ktimers/1/28 Modules linked in: CPU: 1 UID: 0 PID: 28 Comm: ktimers/1 Tainted: G W syzkaller #0 PREEMPT_{RT,(full)} Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:rcu_note_context_switch+0xc1d/0xe70 kernel/rcu/tree_plugin.h:332 Code: 48 c1 e8 03 0f b6 04 28 84 c0 0f 85 30 02 00 00 41 80 3f 00 0f 84 18 f5 ff ff 90 0f 0b 90 e9 0f f5 ff ff 48 8d 3d 03 85 09 0f <67> 48 0f b9 3a e9 ab f4 ff ff 90 0f 0b 90 45 84 ed 0f 84 79 f4 ff RSP: 0018:ffffc90000a2f2c0 EFLAGS: 00010002 RAX: 0000000000000000 RBX: ffff88801e2be960 RCX: 8000000000000002 RDX: 0000000000000000 RSI: ffffffff8bcc6a60 RDI: ffffffff90b58f30 RBP: dffffc0000000000 R08: ffffffff90b23c7f R09: 1ffffffff216478f R10: dffffc0000000000 R11: fffffbfff2164790 R12: ffff88801e2bddc0 R13: 0000000000000000 R14: ffff8880b853d340 R15: ffff88801e2be284 FS: 0000000000000000(0000) GS:ffff888124ab9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc7a4156d8 CR3: 000000003e56a000 CR4: 00000000003526f0 Call Trace: __schedule+0x28f/0x5700 kernel/sched/core.c:7138 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 __synchronize_srcu+0x23b/0x2f0 kernel/rcu/srcutree.c:1477 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x127/0x3d0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] run_ktimerd+0x6a/0x100 kernel/softirq.c:1174 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: 48 c1 e8 03 shr $0x3,%rax 4: 0f b6 04 28 movzbl (%rax,%rbp,1),%eax 8: 84 c0 test %al,%al a: 0f 85 30 02 00 00 jne 0x240 10: 41 80 3f 00 cmpb $0x0,(%r15) 14: 0f 84 18 f5 ff ff je 0xfffff532 1a: 90 nop 1b: 0f 0b ud2 1d: 90 nop 1e: e9 0f f5 ff ff jmp 0xfffff532 23: 48 8d 3d 03 85 09 0f lea 0xf098503(%rip),%rdi # 0xf09852d * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: e9 ab f4 ff ff jmp 0xfffff4df 34: 90 nop 35: 0f 0b ud2 37: 90 nop 38: 45 84 ed test %r13b,%r13b 3b: 0f .byte 0xf 3c: 84 79 f4 test %bh,-0xc(%rcx) 3f: ff .byte 0xff