Extracting prog: 35m54.250461863s Minimizing prog: 51m41.621876222s Simplifying prog options: 0s Extracting C: 1m10.506229041s Simplifying C: 11m19.858717652s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioprio_set$pid-io_setup-eventfd-bpf$PROG_LOAD-io_submit detailed listing: executing program 0: ioprio_set$pid(0x2, 0x0, 0x6000) io_setup(0x2, &(0x7f0000000080)=0x0) eventfd(0x800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000d80), 0x0, 0x10, &(0x7f0000000dc0), 0xfffffffffffffdbb}, 0x48) io_submit(r0, 0x0, &(0x7f00000000c0)) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_genetlink_get_family_id$nl80211-socket$nl_route-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0xd000, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r1, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r3, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-recvmmsg detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_SET_LEDBIT-ioctl$UI_SET_EVBIT-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-socket-socket$tipc-socket$netlink-socket$netlink-syz_open_dev$video-socketpair$unix-sendmsg$nl_generic-socket$inet6_udp-socket$nl_crypto-syz_usb_connect-ioctl$EVIOCSKEYCODE-ioctl$EVIOCSKEYCODE-sendmmsg$unix-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_STREAMON-ioctl$VIDIOC_STREAMON-ioctl$VIDIOC_DQBUF-sendmsg$nl_route detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_SET_LEDBIT-ioctl$UI_SET_EVBIT-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-socket-socket$tipc-socket$netlink-socket$netlink-syz_open_dev$video-socketpair$unix-sendmsg$nl_generic-socket$inet6_udp-socket$nl_crypto-syz_usb_connect-ioctl$EVIOCSKEYCODE-ioctl$EVIOCSKEYCODE-sendmmsg$unix-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_STREAMON-ioctl$VIDIOC_STREAMON-ioctl$VIDIOC_DQBUF-sendmsg$nl_route detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 40, 25, 5, 2, 30, 30, 12, 30, 14, 30, 2, 2, 7, 3, 4, 25, 4, 10, 3, 2, 30, 29, 27, 27, 4, 3, 4, 6, 5] detailed listing: executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='mand\x00', &(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0x0) bind$inet(r0, &(0x7f0000000300)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000340)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000440)="59eb6e0919e9a92b1c845775c88c82cdb081611b6380af47cf87716ba25897c99ce341fa16fe26031af4cf681679fc96be745b77dee8bad8bc4a3e53fa64a35f4e360eb79605c1c4ee0d87860851de0378ccd75cf01fd0f4150191d7fbe2d9e7985f5ffb05e5fd9e0f40083b771dab9b59cde20e06b315b28c96f77d27279cf61c85b174c78b865750dddf177e699c06cc6febb8c7df93693a561b8fee74f0409127e4e0219049687cbdd4938fd377723bf11a23ce2954294598a95e7658bdda41c22d59beabf4dca34a343e87a9f715eb4240709e5912356616c43b51e30769168b408b660d83f3f9b9af49653ae15572eda6d455c8dbcf91aacef7c76d0c34b2024addd9790bd611e6a4a6dde25ad5b3a15eb251f7110872f0cd22ba468a8ff5c0abcc282e939a65b6a13c33358989003435f7f4747d52f1bc68e3afbca6c7edc3e3e95af13498e8ae5a6e00b027b536d61aa22df1cb272162bef205c45ce635666667bc70106d27fd527d92c8b90623cac454fb9a266fa91db8c974c65ae6bceac90fcbb5", 0x186, 0x400480c, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) sendto$inet6(r4, 0x0, 0x0, 0x4040054, 0x0, 0x0) execveat(0xffffffffffffffff, 0x0, &(0x7f0000000180)={[0x0, 0x0]}, &(0x7f00000001c0)={[0x0]}, 0x800) syz_usb_connect$midi(0x0, 0x4e, 0x0, 0x0) add_key(&(0x7f0000000200)='asymmetric\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00'}) recvmmsg(r2, &(0x7f0000000380), 0x8000000000001ac, 0x2140, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='yeah', 0x4) recvfrom$inet(r0, &(0x7f0000000400)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xffffffffec100f4b, 0xd, 0xe000, 0xf, 0x2, 0x0, 0x0, 0x40, 0x20ffff}}, 0x50) (async) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xffffffffec100f4b, 0xd, 0xe000, 0xf, 0x2, 0x0, 0x0, 0x40, 0x20ffff}}, 0x50) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x8, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x44, 0x3, 0x1, 0x801, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_TUPLE_MASTER={0x30, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @remote}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040004}, 0x1) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000300)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000340), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000380)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvmsg(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000004c0)=""/133, 0x85}], 0x1}, 0xa15ca00d7db50300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x275a, 0x0) write$tun(r6, &(0x7f00000005c0)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000600)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r5, &(0x7f0000000640)=[{&(0x7f0000000680)="3f2a6a1bc4", 0x5}], 0x1) recvfrom(r5, &(0x7f0000001340)=""/4059, 0xfdb, 0x17, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002340)='memory.events\x00', 0x275a, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002340)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x4, 0x12, r7, 0x7a656000) (async) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x4, 0x12, r7, 0x7a656000) writev(r5, &(0x7f0000002380)=[{&(0x7f0000002400)="58ddb007a47a8b1f458ab677d557ca50006fcb5d15966b46ca64f7e76268cd64007095adfef77465b69ec03139854d6f07d5f9bd01000046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f00000024c0)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000002580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000002640)="de21cff472aa580c2ee9f858", 0xc}, {&(0x7f0000002680)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a085852456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd7", 0x845}], 0x5) (async) writev(r5, &(0x7f0000002380)=[{&(0x7f0000002400)="58ddb007a47a8b1f458ab677d557ca50006fcb5d15966b46ca64f7e76268cd64007095adfef77465b69ec03139854d6f07d5f9bd01000046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f00000024c0)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000002580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000002640)="de21cff472aa580c2ee9f858", 0xc}, {&(0x7f0000002680)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a085852456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd7", 0x845}], 0x5) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000002f00)=0xffff1884, 0x4) (async) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000002f00)=0xffff1884, 0x4) executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r3, r1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r3, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) r6 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r6, 0x0, &(0x7f00000005c0)={0x84, &(0x7f0000000680)=ANY=[@ANYBLOB="20c81e0000004d61501d01000000000000001000000400008007000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f00000006c0)={0x44, &(0x7f0000000740)={0x20, 0x7, 0xd, "650b400823c7c084f67ad7d101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000540)={0x48, 0x3, r5, 0x0, 0x80000001, 0xb1, &(0x7f0000000480)="7dfbe2820e6c213f50aba30a6f1611223b16adadcd6f51dbe396f24fcb027faa452377f5cc06242e50a72069d6e6d0caf6aee54846f1b75025601d2ec29eb4b5c2a538929edab42cc47001719fea14de87044a288c1e567aa06fc9e45183fb4c19ac0d165f81fc8d2569f32d1d23ba3f9905a6d90741196f7f6964ce8669433132c07257db9e67b00090147669f3b21b75c9d90e6b02c4f5b43779ef61bfdb61e47abcc47d09b67ea2c4dbe68dfb376fb3"}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r0, 0x3b8d, &(0x7f0000000280)={0x20, r5, &(0x7f00000002c0)=[{}], 0xdeadbeef, 0x8, 0x1}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000300)={0x8, r5}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x3, r3, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000040)}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000340)={0x8, r4}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000780)={0x1, &(0x7f00000007c0)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) r7 = add_key$user(&(0x7f0000000800), &(0x7f0000000840)={'syz', 0x0}, &(0x7f0000000880)="166ec4b1", 0x4, 0xfffffffffffffffe) r8 = add_key$user(&(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000980)={r7, r8, r7}, 0x0, 0x0, 0x0) ioctl$IOMMU_GET_HW_INFO(r0, 0x3b8a, &(0x7f0000000380)={0x24, 0x0, r3, 0x1c, &(0x7f00000003c0)=""/28}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000940), 0xffffffffffffffff) bind$netlink(r9, &(0x7f0000000ac0)={0x10, 0x0, 0x25dfdbfc, 0x1000000}, 0xc) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000000000020001070000003000018014000400fe880000000000000000000000000001060005004e22000008000700", @ANYRES32=0x0, @ANYBLOB="060001000a"], 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$IOMMU_DESTROY$stdev(r0, 0x3b80, &(0x7f0000000400)={0x8, r2}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000440)={0x8, r1}) close(r0) executing program 0: sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) fsopen(&(0x7f0000001840)='adfs\x00', 0x0) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000005bc0)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000005c40)=@updpolicy={0x17c, 0x19, 0xfd3649826d894c67, 0x270bd28, 0x7000000, {{@in6=@mcast1, @in=@multicast1, 0xffbe, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x100}, {0x0, 0x0, 0xfffffffffffffffe}}, [@tmpl={0xc4, 0x5, [{{@in6=@private2, 0x4d6, 0x2b}, 0xa, @in=@loopback, 0x3507, 0x4, 0x1, 0x6, 0x4, 0x9, 0x1}, {{@in6=@empty, 0x4d5, 0x3c}, 0xa, @in=@broadcast, 0x3502, 0x5, 0x0, 0xff, 0xe2, 0x5, 0x8}, {{@in=@local, 0x4d5, 0x6c}, 0x2, @in6=@mcast2, 0x0, 0x4, 0x0, 0xcb, 0x8, 0x4, 0x7fffffff}]}]}, 0x17c}}, 0x0) executing program 2: setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000300)='syz_tun\x00', 0x8) r0 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201100100000008ace8cc0200000000000109022400010000a0020904000502030084000921010040012218009505810340a8e51587"], 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) bind$inet6(0xffffffffffffffff, &(0x7f0000000340)={0xa, 0x4e20, 0x7, @local}, 0x1c) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a3100000000140004800800024000000000080001400000000058000000060a010400000000000000000100000008000b4000000000300004802c000180090001007866726d000400001c0002800500030000000000080001400000000c08000240000000050900010073797a30"], 0xe0}}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$pptp(0x18, 0x1, 0x2) syz_usb_connect(0x5, 0x46, &(0x7f0000000580)=ANY=[@ANYBLOB="120110038e3ac6209406010013780102030109023400170e0610030904e40503b956da020905080000040112fc09050b00200007029a0705d15b89f26d0905090340007a0a84"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) ioctl$XFS_IOC_FSCOUNTS(r2, 0x80205871, &(0x7f00000000c0)) r3 = socket$inet6(0xa, 0x805, 0x0) r4 = fsopen(0x0, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000003e80)={0x8, 0x2, 0x8004, 0x7, 0x401, 0x7, 0xfffffffc, 0x3}, 0x20) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='gidO\xcb%R\xff\xf0~>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\x00\x00\x00\x00\x00', 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f00000007c0), 0x400000000a882, 0x0) io_uring_setup(0x7059, &(0x7f0000000280)={0x0, 0x55bf, 0x8, 0x3, 0x336}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000440), 0x651, 0x0) close(0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, 0xffffffffffffffff, 0x7c1f1000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) getsockopt$bt_hci(r3, 0x84, 0x85, &(0x7f0000001a00)=""/4060, &(0x7f00000001c0)=0xfdc) socket$inet(0x2, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xc000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setuid(0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) executing program 0: syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r2 = socket$netlink(0x10, 0x3, 0x6) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x10}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, 0x43, 0x107, 0x70bd2a, 0x25dfdbfc, {0x2, 0x7c}, [@nested={0x8, 0x145, 0x0, 0x1, [@typed={0x4, 0x4}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8}, 0x2004c000) bind$netlink(r2, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000380)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f00000003c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x2, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x401, 0xffeffffffffffffe}, {0x0, 0x2000000000000}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x0, 0x32}, 0x0, @in6=@mcast2, 0x10001, 0x0, 0x2, 0xb7, 0xc4, 0xfffffffe}}, 0xe8) sendmmsg(r5, &(0x7f00000004c0), 0x800001d, 0x1c) gettid() close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000500), 0x242, 0x0) write$dsp(r6, &(0x7f0000000540)='`', 0x1) r7 = syz_open_dev$sndctrl(&(0x7f0000000580), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r7, 0xc0505510, 0x0) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000600)={0x0, 0xa1, &(0x7f0000000640)={&(0x7f0000000680)={0x2c, r8, 0x705, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40008d0}, 0x0) r9 = syz_usb_connect(0x0, 0x24, &(0x7f00000006c0)=ANY=[@ANYBLOB="12010000b5403340861a2275363501020301090212"], 0x0) syz_usb_control_io$sierra_net(r9, 0x0, &(0x7f0000000700)={0x1c, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r9, 0x0, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000240)={[{0x6, 0x5, 0x93, 0x1, 0x0, 0x5f, 0xb, 0x20, 0xa6, 0x2, 0x5, 0x9, 0xfffffffe}, {0xfffffffd, 0xfffa, 0x0, 0x4, 0xfa, 0xf6, 0xce, 0x8, 0x4, 0xff, 0x1, 0xa6, 0x800000000000000}, {0xffffff01, 0x35, 0x80, 0x0, 0x4, 0x1, 0x19, 0xe, 0x7, 0x8, 0xfe, 0x4, 0x1000000000000004}], 0x7f}) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r3, 0xf502, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x2e, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000240)={[{0x6, 0x8, 0x93, 0x1, 0x0, 0x5f, 0xb, 0x20, 0xa6, 0x2, 0x5, 0x9, 0xfffffffe}, {0xfffffffd, 0xfffa, 0x0, 0x4, 0xfa, 0xf6, 0xce, 0x8, 0x4, 0xff, 0x1, 0xa6, 0x800000000000000}, {0xffffff01, 0x35, 0x80, 0x0, 0x4, 0x1, 0x19, 0xe, 0x7, 0x8, 0xfe, 0x4, 0x1000000000000004}], 0x7f}) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r3, 0xf502, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000019c0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000001a00)={0x0, "4fcb813dd28b42bee2b094a3de6dbfd30a74457bcd1cfd5feffe5c019f45d57f", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000001a40)={"000000149c0286e08ffad43c40fc0a000000ab65a29e23546aad0281b3aff5eb", r6, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r7, 0x40103e05, &(0x7f0000001a80)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r4, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000500)=""/4081, 0xff1}, {&(0x7f0000001500)=""/209, 0xd1}, {&(0x7f0000001600)=""/172, 0xac}, {&(0x7f00000016c0)=""/161, 0xa1}, {&(0x7f0000001780)=""/93, 0x5d}], 0x5}, 0x9}], 0x4, 0x0, 0x0) sendmsg$NL80211_CMD_GET_KEY(r4, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001880)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="1000000050ae1cdcc911182efbe62669e86121cff40b3c936bf368cc4c8116ba33c71985a8824637d1d93b3501000000000000009c23abafb404b18112a69acbd78d66", @ANYRES16=0x0, @ANYBLOB="010625bd7000fcdbdf25090000000500080000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4804}, 0x4044004) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x2e, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) mknod(&(0x7f0000001840)='./file0\x00', 0x0, 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001b40), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000001b80)='./file0\x00', &(0x7f0000001bc0), 0x0, &(0x7f0000001c00)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r8, &(0x7f0000001c80)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f0000003cc0)='./file0\x00', 0x0, 0x0) write$FUSE_INIT(r8, &(0x7f0000003d00)={0x50, 0xfffffffffffffffe, r9, {0x7, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0x50) read$FUSE(r8, &(0x7f0000003d80)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r8, &(0x7f0000005dc0)={0x10, 0xffffffffffffffda, r10}, 0x10) r11 = open$dir(&(0x7f0000005e00)='./file0\x00', 0x0, 0x0) fcntl$lock(r11, 0x7, &(0x7f0000005e40)={0x0, 0x0, 0x0, 0x200000}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000001900)=[{0x6, 0x1, 0x83, 0x7fff0000}]}) executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001040)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x5, 0x248, &(0x7f0000000440)=ANY=[], 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x3, 0x0, 0x7fff0006}]}) mknod(&(0x7f0000000080)='./file0\x00', 0x0, 0xffffffff) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x101001, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000240)=ANY=[@ANYBLOB="02171a00000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 4: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$inet6(0xa, 0x3, 0x7) r2 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x20040400) unshare(0x4000000) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x200, 0x0}, 0x8) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000010b80)={0x9, 0x4, &(0x7f00000009c0)=ANY=[@ANYRES32=r1, @ANYRES16=r3, @ANYBLOB="1d1e8f89a21e905bb76276f19121343c66341f30cd823c84501eab50f9ad0c675c2d1675a05a0ee6dc4b468a4977e937c2ba3dc82ffc03877e3ba8156457d96aa96d368599c835041e73a2f62112d9514a8e98f2792737e9e52e726055d8c737886150b5599625a502645f611a0adc0bd7f22d059d0a459385ca2cfd64ecceefec45954bf0ec633d6de4cf746852c63d5664b4352eda6c15de6c977e91192485e2c837ce2f9953544210a0729ffd8bee28442a7dfa6a433f25d6f17853f8a15d7f5ddfe82ee16e0dbe3526d5182adf660cd650530e99f090cbd260f9f1bb47133b6e858bac6ffd5b8de9b483b1642dcd4de8914905e3eed0faef326937001e9c66bf0f41d0152ef7ef1f6c9db8fe02b934094c8c282382938339ec7df6c5da", @ANYRES64=0x0, @ANYRESDEC=r0, @ANYRESHEX=r3, @ANYRES8=r2], &(0x7f00000001c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) syz_usb_connect(0x2, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0) r6 = fsopen(&(0x7f0000000080)='smb3\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='vers\x00', &(0x7f0000000600)='-\xf2B\xd3\xd1]\xc4\x85RB \x9a,\x03\xe9\x1e\xfb\x88\xd8g\x1f\xe2\xfaWy\xf8\x82\xe3\x8b\x05 2\"/\x9b\xad>\xe54Z \xd2\x84F\xf6\xb9\x06Yc\xdfIGQ\xa0B\xb1*0\xd0\xe2\x91\x92\xe3\xd4V&\x8bS\x85\xab\x93\x02\xc9\xe5\xd8mZ\x03\xee\xd3\x1e\xf6)`s\xe5\xe5\xd3A\xedk!\x1dO\x8dw\xeb\xec\xd8\r\xe5\xeb\xb6z\x81\xaa\xbb\xf4\b\xaa\x89\x0f\"\xf5\xb0R\xe3L\xc6L\a\xf1\xb0\x1e\x04|Zu\bWG4\x0e\b&\xde\xba\xb2\x1d\xe1[G\r', 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r4, 0x0, 0x0, r7, &(0x7f0000000300)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000280)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000400)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f00000006c0)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f0000000940)={{@my=0x0}, 0x1, 0x0, 0x10001}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r8, 0x7a6, &(0x7f0000000980)={0xc, 0xf7fffffffffffffc, 0x240000, 0x7fffffffffffffff, 0x80000f, 0x9}) r9 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000380), 0x88002, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000003c0)=0xd) open(&(0x7f0000000140)='./file0\x00', 0x143142, 0xc0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x40a903, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r10, 0x3b85, &(0x7f00000004c0)={0x28, 0x7, r11, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r10, 0x3ba0, &(0x7f0000000500)={0x48, 0x5, r11, 0x0, 0xffffffffffffffff, 0x1}) executing program 0: r0 = fsopen(&(0x7f0000001840)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xa9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c4000000190001000000000000004000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000053260e130000000000000000000000fbfffffffff5ffff00000000001b00000000000000000000000000000000000200000000000000b912"], 0xc4}, 0x1, 0x0, 0x0, 0x40100}, 0x2c000010) syz_usb_connect(0x0, 0x147, &(0x7f0000000180)=ANY=[@ANYRES64=0x0, @ANYRESOCT], 0x0) executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000180)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x3, 0x279, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x10000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0xb0d, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x103}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r1, r7, &(0x7f0000000540)={0x0, 0x80002, 0x0, 0x3, 0x1fffc, 0x0, r2}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4465, 0x1, 0x0, 0x220, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x0, 0xfffffffd, 0x68, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2fdf, 0x4, 0x1, 0x18}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x40006252, 0x0, 0x1, 0xfffffffa}}], 0x1, &(0x7f00000003c0)={0x2e, 0x4c, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r6, '\x00', {0x6, 0xfb9, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) executing program 3: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000980)={0x8b28, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r0, 0x0, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000005c0)={0x0, 0xd00, &(0x7f0000000600)={&(0x7f0000000640)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0xc0c4) executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) request_key(&(0x7f00000002c0)='rxrpc_s\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)='y\xa9rustV\x1eS=\xd4\x16\x95:\x00\x01\x00\x00', 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$CLEAR(r3, 0x3b88, &(0x7f0000000040)={0xc, 0x0, 0x2, 0xfdfd}) sendmsg$nl_generic(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f00000007c0)={0x18, 0x26, 0x101, 0x70bd26, 0xfffffffc, {0x1d}, [@nested={0x4, 0x12b}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000000400)=""/4084, 0xff4}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000014c0)=""/256, 0x100}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x5}, 0x1}], 0x4, 0x2000, 0x0) executing program 1: r0 = fsopen(&(0x7f0000001840)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xa9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) executing program 1: syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "c800002000", "fff600"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000180)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000880)=""/65, 0x41}], 0x1}, 0xfff}, {{0x0, 0xfffffcbf, 0x0}, 0x1}], 0x2, 0x0, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f00000003c0)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59e", 0x4a}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000440)=0xffff1884, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x47) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000280)=0x4008, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYRES32=r0], 0x50}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000540)={'syzkaller0\x00', 0x1}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r3, 0x8040942d, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000200c8"], 0x2c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)=ANY=[], 0x20}, 0x1, 0x100000000000, 0x0, 0x40001}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x22040085}, 0x11) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000740)) unshare(0x64000600) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xf, 0xf, 0xfffffdfffffffffd, 0x2, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, &(0x7f00000007c0)) r0 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x5, 0x155081) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000040)={0x0, 0x0, {0x1, 0xfffffffc, 0x1}}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f000063b000/0x4000)=nil, 0x4000, 0x2, 0x13, r1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_connect(0x3, 0x32, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x9, 0x3, 0x238, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1a0, 0xffffffff, 0xffffffff, 0x1a0, 0xffffffff, 0x3, &(0x7f0000000180), {[{{@ip={@empty, @empty, 0xff, 0xff000000, 'bond0\x00', 'veth1_vlan\x00', {0xff}, {}, 0x84, 0x1, 0x74}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x4, 0x5, 0xffff, 'netbios-ns\x00', {0xdd0fdaa}}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0xe}, @multicast2, 0xffffffff, 0xffffffff, 'macvtap0\x00', 'veth0_to_team\x00', {}, {0xff}, 0x1, 0x2, 0x19}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x8, 0x1, 0x2}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fffffff, 0x6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x298) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=ANY=[@ANYBLOB="5c0000000206010800000000efff0000000000000900020073797a310000000005000400000000001400078005001500090000000800114000000000050001000600000005000500000000000d000300686173683a6d616300"], 0x5c}}, 0x404c804) sendmmsg$inet(r3, &(0x7f0000000740)=[{{&(0x7f0000000780)={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, &(0x7f00000007c0)=[@ip_pktinfo={{0x1c, 0x0, 0x34, {0x0, @empty, @remote}}}], 0x20}}], 0x1, 0x40000) socket(0x2d, 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000800)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000880)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000008c0), 0x3) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000900), 0xc0803, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r7, 0x4068aea3, &(0x7f0000000940)={0x8f, 0x0, 0x2}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000009c0)=[@text64={0x40, &(0x7f0000000100)="b9100400000f320f5ee2b98a0a0000b800000000ba000000800f30ad660fc77496176426660f388173df410fc733640f4363963e0f381e812500000066ba4300ed", 0x41}], 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000a00)=[@textreal={0x8, 0x0}], 0x1, 0x32, 0x0, 0x0) executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) executing program 0: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000008400)=[@in6={0xa, 0x4e24, 0x7fff, @empty, 0x19f4d29}], 0x1c) listen(r0, 0x100) sendmsg$inet_sctp(r0, &(0x7f0000008440)={&(0x7f0000008480)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, &(0x7f00000084c0)=[{&(0x7f0000008500)="b2", 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x20048844) (fail_nth: 43) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000002100)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) openat$kvm(0xffffffffffffff9c, 0x0, 0x81, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200000e00000000000008004500007000670000fb019078ac1e0001ac1414aa03006f78032400004500000000010004000100077f00000164010102863dffffffff000808c82ce8da6e0502000b7434954373561de5840205cf0a0006040000071173bc23f9ffffffa30900a301c846000008c8f46976e79e0000006da410bda30c86bef56a22d089f3f2ccf120"], 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0xd000, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r1, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r3, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) executing program 3: ioprio_set$pid(0x2, 0x0, 0x6000) io_setup(0x2, &(0x7f0000000080)=0x0) eventfd(0x800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000d80), 0x0, 0x10, &(0x7f0000000dc0), 0xfffffffffffffdbb}, 0x48) io_submit(r0, 0x0, &(0x7f00000000c0)) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioprio_set$pid-io_setup-eventfd-bpf$PROG_LOAD-io_submit detailed listing: executing program 0: ioprio_set$pid(0x2, 0x0, 0x6000) io_setup(0x2, &(0x7f0000000080)=0x0) eventfd(0x800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000d80), 0x0, 0x10, &(0x7f0000000dc0), 0xfffffffffffffdbb}, 0x48) io_submit(r0, 0x0, &(0x7f00000000c0)) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_genetlink_get_family_id$nl80211-socket$nl_route-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0xd000, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r1, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r3, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-recvmmsg detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_SET_LEDBIT-ioctl$UI_SET_EVBIT-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-socket-socket$tipc-socket$netlink-socket$netlink-syz_open_dev$video-socketpair$unix-sendmsg$nl_generic-socket$inet6_udp-socket$nl_crypto-syz_usb_connect-ioctl$EVIOCSKEYCODE-ioctl$EVIOCSKEYCODE-sendmmsg$unix-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_STREAMON-ioctl$VIDIOC_STREAMON-ioctl$VIDIOC_DQBUF-sendmsg$nl_route detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uinput-ioctl$UI_SET_LEDBIT-ioctl$UI_SET_EVBIT-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-socket-socket$tipc-socket$netlink-socket$netlink-syz_open_dev$video-socketpair$unix-sendmsg$nl_generic-socket$inet6_udp-socket$nl_crypto-syz_usb_connect-ioctl$EVIOCSKEYCODE-ioctl$EVIOCSKEYCODE-sendmmsg$unix-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_STREAMON-ioctl$VIDIOC_STREAMON-ioctl$VIDIOC_DQBUF-sendmsg$nl_route detailed listing: executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 1m40s testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 40, 25, 5, 2, 30, 30, 12, 30, 14, 30, 2, 2, 7, 3, 4, 25, 4, 10, 3, 2, 30, 29, 27, 27, 4, 3, 4, 6, 5] detailed listing: executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='mand\x00', &(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0x0) bind$inet(r0, &(0x7f0000000300)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000340)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000440)="59eb6e0919e9a92b1c845775c88c82cdb081611b6380af47cf87716ba25897c99ce341fa16fe26031af4cf681679fc96be745b77dee8bad8bc4a3e53fa64a35f4e360eb79605c1c4ee0d87860851de0378ccd75cf01fd0f4150191d7fbe2d9e7985f5ffb05e5fd9e0f40083b771dab9b59cde20e06b315b28c96f77d27279cf61c85b174c78b865750dddf177e699c06cc6febb8c7df93693a561b8fee74f0409127e4e0219049687cbdd4938fd377723bf11a23ce2954294598a95e7658bdda41c22d59beabf4dca34a343e87a9f715eb4240709e5912356616c43b51e30769168b408b660d83f3f9b9af49653ae15572eda6d455c8dbcf91aacef7c76d0c34b2024addd9790bd611e6a4a6dde25ad5b3a15eb251f7110872f0cd22ba468a8ff5c0abcc282e939a65b6a13c33358989003435f7f4747d52f1bc68e3afbca6c7edc3e3e95af13498e8ae5a6e00b027b536d61aa22df1cb272162bef205c45ce635666667bc70106d27fd527d92c8b90623cac454fb9a266fa91db8c974c65ae6bceac90fcbb5", 0x186, 0x400480c, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) sendto$inet6(r4, 0x0, 0x0, 0x4040054, 0x0, 0x0) execveat(0xffffffffffffffff, 0x0, &(0x7f0000000180)={[0x0, 0x0]}, &(0x7f00000001c0)={[0x0]}, 0x800) syz_usb_connect$midi(0x0, 0x4e, 0x0, 0x0) add_key(&(0x7f0000000200)='asymmetric\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00'}) recvmmsg(r2, &(0x7f0000000380), 0x8000000000001ac, 0x2140, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='yeah', 0x4) recvfrom$inet(r0, &(0x7f0000000400)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xffffffffec100f4b, 0xd, 0xe000, 0xf, 0x2, 0x0, 0x0, 0x40, 0x20ffff}}, 0x50) (async) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xffffffffec100f4b, 0xd, 0xe000, 0xf, 0x2, 0x0, 0x0, 0x40, 0x20ffff}}, 0x50) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x8, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x44, 0x3, 0x1, 0x801, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_TUPLE_MASTER={0x30, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @remote}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040004}, 0x1) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000300)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000340), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000380)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvmsg(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000004c0)=""/133, 0x85}], 0x1}, 0xa15ca00d7db50300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x275a, 0x0) write$tun(r6, &(0x7f00000005c0)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r6, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000600)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r5, &(0x7f0000000640)=[{&(0x7f0000000680)="3f2a6a1bc4", 0x5}], 0x1) recvfrom(r5, &(0x7f0000001340)=""/4059, 0xfdb, 0x17, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002340)='memory.events\x00', 0x275a, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002340)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x4, 0x12, r7, 0x7a656000) (async) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x4, 0x12, r7, 0x7a656000) writev(r5, &(0x7f0000002380)=[{&(0x7f0000002400)="58ddb007a47a8b1f458ab677d557ca50006fcb5d15966b46ca64f7e76268cd64007095adfef77465b69ec03139854d6f07d5f9bd01000046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f00000024c0)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000002580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000002640)="de21cff472aa580c2ee9f858", 0xc}, {&(0x7f0000002680)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a085852456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd7", 0x845}], 0x5) (async) writev(r5, &(0x7f0000002380)=[{&(0x7f0000002400)="58ddb007a47a8b1f458ab677d557ca50006fcb5d15966b46ca64f7e76268cd64007095adfef77465b69ec03139854d6f07d5f9bd01000046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f00000024c0)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000002580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000002640)="de21cff472aa580c2ee9f858", 0xc}, {&(0x7f0000002680)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a085852456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd7", 0x845}], 0x5) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000002f00)=0xffff1884, 0x4) (async) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000002f00)=0xffff1884, 0x4) executing program 4: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r3, r1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r3, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) r6 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r6, 0x0, &(0x7f00000005c0)={0x84, &(0x7f0000000680)=ANY=[@ANYBLOB="20c81e0000004d61501d01000000000000001000000400008007000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f00000006c0)={0x44, &(0x7f0000000740)={0x20, 0x7, 0xd, "650b400823c7c084f67ad7d101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r0, 0x3ba0, &(0x7f0000000540)={0x48, 0x3, r5, 0x0, 0x80000001, 0xb1, &(0x7f0000000480)="7dfbe2820e6c213f50aba30a6f1611223b16adadcd6f51dbe396f24fcb027faa452377f5cc06242e50a72069d6e6d0caf6aee54846f1b75025601d2ec29eb4b5c2a538929edab42cc47001719fea14de87044a288c1e567aa06fc9e45183fb4c19ac0d165f81fc8d2569f32d1d23ba3f9905a6d90741196f7f6964ce8669433132c07257db9e67b00090147669f3b21b75c9d90e6b02c4f5b43779ef61bfdb61e47abcc47d09b67ea2c4dbe68dfb376fb3"}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r0, 0x3b8d, &(0x7f0000000280)={0x20, r5, &(0x7f00000002c0)=[{}], 0xdeadbeef, 0x8, 0x1}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000300)={0x8, r5}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000001c0)={0x28, 0x3, r3, r1, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000040)}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000340)={0x8, r4}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000780)={0x1, &(0x7f00000007c0)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) r7 = add_key$user(&(0x7f0000000800), &(0x7f0000000840)={'syz', 0x0}, &(0x7f0000000880)="166ec4b1", 0x4, 0xfffffffffffffffe) r8 = add_key$user(&(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000980)={r7, r8, r7}, 0x0, 0x0, 0x0) ioctl$IOMMU_GET_HW_INFO(r0, 0x3b8a, &(0x7f0000000380)={0x24, 0x0, r3, 0x1c, &(0x7f00000003c0)=""/28}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000940), 0xffffffffffffffff) bind$netlink(r9, &(0x7f0000000ac0)={0x10, 0x0, 0x25dfdbfc, 0x1000000}, 0xc) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000000000020001070000003000018014000400fe880000000000000000000000000001060005004e22000008000700", @ANYRES32=0x0, @ANYBLOB="060001000a"], 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$IOMMU_DESTROY$stdev(r0, 0x3b80, &(0x7f0000000400)={0x8, r2}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000440)={0x8, r1}) close(r0) executing program 0: sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) fsopen(&(0x7f0000001840)='adfs\x00', 0x0) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000005bc0)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000005c40)=@updpolicy={0x17c, 0x19, 0xfd3649826d894c67, 0x270bd28, 0x7000000, {{@in6=@mcast1, @in=@multicast1, 0xffbe, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x100}, {0x0, 0x0, 0xfffffffffffffffe}}, [@tmpl={0xc4, 0x5, [{{@in6=@private2, 0x4d6, 0x2b}, 0xa, @in=@loopback, 0x3507, 0x4, 0x1, 0x6, 0x4, 0x9, 0x1}, {{@in6=@empty, 0x4d5, 0x3c}, 0xa, @in=@broadcast, 0x3502, 0x5, 0x0, 0xff, 0xe2, 0x5, 0x8}, {{@in=@local, 0x4d5, 0x6c}, 0x2, @in6=@mcast2, 0x0, 0x4, 0x0, 0xcb, 0x8, 0x4, 0x7fffffff}]}]}, 0x17c}}, 0x0) executing program 2: setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000300)='syz_tun\x00', 0x8) r0 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201100100000008ace8cc0200000000000109022400010000a0020904000502030084000921010040012218009505810340a8e51587"], 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) bind$inet6(0xffffffffffffffff, &(0x7f0000000340)={0xa, 0x4e20, 0x7, @local}, 0x1c) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a3100000000140004800800024000000000080001400000000058000000060a010400000000000000000100000008000b4000000000300004802c000180090001007866726d000400001c0002800500030000000000080001400000000c08000240000000050900010073797a30"], 0xe0}}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$pptp(0x18, 0x1, 0x2) syz_usb_connect(0x5, 0x46, &(0x7f0000000580)=ANY=[@ANYBLOB="120110038e3ac6209406010013780102030109023400170e0610030904e40503b956da020905080000040112fc09050b00200007029a0705d15b89f26d0905090340007a0a84"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) ioctl$XFS_IOC_FSCOUNTS(r2, 0x80205871, &(0x7f00000000c0)) r3 = socket$inet6(0xa, 0x805, 0x0) r4 = fsopen(0x0, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000003e80)={0x8, 0x2, 0x8004, 0x7, 0x401, 0x7, 0xfffffffc, 0x3}, 0x20) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000180)='gidO\xcb%R\xff\xf0~>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\x00\x00\x00\x00\x00', 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f00000007c0), 0x400000000a882, 0x0) io_uring_setup(0x7059, &(0x7f0000000280)={0x0, 0x55bf, 0x8, 0x3, 0x336}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000440), 0x651, 0x0) close(0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, 0xffffffffffffffff, 0x7c1f1000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) getsockopt$bt_hci(r3, 0x84, 0x85, &(0x7f0000001a00)=""/4060, &(0x7f00000001c0)=0xfdc) socket$inet(0x2, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0xc000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setuid(0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) executing program 0: syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r2 = socket$netlink(0x10, 0x3, 0x6) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x10}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, 0x43, 0x107, 0x70bd2a, 0x25dfdbfc, {0x2, 0x7c}, [@nested={0x8, 0x145, 0x0, 0x1, [@typed={0x4, 0x4}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8}, 0x2004c000) bind$netlink(r2, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000380)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f00000003c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x2, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x401, 0xffeffffffffffffe}, {0x0, 0x2000000000000}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x0, 0x32}, 0x0, @in6=@mcast2, 0x10001, 0x0, 0x2, 0xb7, 0xc4, 0xfffffffe}}, 0xe8) sendmmsg(r5, &(0x7f00000004c0), 0x800001d, 0x1c) gettid() close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000500), 0x242, 0x0) write$dsp(r6, &(0x7f0000000540)='`', 0x1) r7 = syz_open_dev$sndctrl(&(0x7f0000000580), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r7, 0xc0505510, 0x0) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000600)={0x0, 0xa1, &(0x7f0000000640)={&(0x7f0000000680)={0x2c, r8, 0x705, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40008d0}, 0x0) r9 = syz_usb_connect(0x0, 0x24, &(0x7f00000006c0)=ANY=[@ANYBLOB="12010000b5403340861a2275363501020301090212"], 0x0) syz_usb_control_io$sierra_net(r9, 0x0, &(0x7f0000000700)={0x1c, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r9, 0x0, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000240)={[{0x6, 0x5, 0x93, 0x1, 0x0, 0x5f, 0xb, 0x20, 0xa6, 0x2, 0x5, 0x9, 0xfffffffe}, {0xfffffffd, 0xfffa, 0x0, 0x4, 0xfa, 0xf6, 0xce, 0x8, 0x4, 0xff, 0x1, 0xa6, 0x800000000000000}, {0xffffff01, 0x35, 0x80, 0x0, 0x4, 0x1, 0x19, 0xe, 0x7, 0x8, 0xfe, 0x4, 0x1000000000000004}], 0x7f}) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r3, 0xf502, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x2e, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000240)={[{0x6, 0x8, 0x93, 0x1, 0x0, 0x5f, 0xb, 0x20, 0xa6, 0x2, 0x5, 0x9, 0xfffffffe}, {0xfffffffd, 0xfffa, 0x0, 0x4, 0xfa, 0xf6, 0xce, 0x8, 0x4, 0xff, 0x1, 0xa6, 0x800000000000000}, {0xffffff01, 0x35, 0x80, 0x0, 0x4, 0x1, 0x19, 0xe, 0x7, 0x8, 0xfe, 0x4, 0x1000000000000004}], 0x7f}) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r3, 0xf502, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000019c0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000001a00)={0x0, "4fcb813dd28b42bee2b094a3de6dbfd30a74457bcd1cfd5feffe5c019f45d57f", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000001a40)={"000000149c0286e08ffad43c40fc0a000000ab65a29e23546aad0281b3aff5eb", r6, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r7, 0x40103e05, &(0x7f0000001a80)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r4, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000500)=""/4081, 0xff1}, {&(0x7f0000001500)=""/209, 0xd1}, {&(0x7f0000001600)=""/172, 0xac}, {&(0x7f00000016c0)=""/161, 0xa1}, {&(0x7f0000001780)=""/93, 0x5d}], 0x5}, 0x9}], 0x4, 0x0, 0x0) sendmsg$NL80211_CMD_GET_KEY(r4, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001880)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="1000000050ae1cdcc911182efbe62669e86121cff40b3c936bf368cc4c8116ba33c71985a8824637d1d93b3501000000000000009c23abafb404b18112a69acbd78d66", @ANYRES16=0x0, @ANYBLOB="010625bd7000fcdbdf25090000000500080000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4804}, 0x4044004) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x2e, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) mknod(&(0x7f0000001840)='./file0\x00', 0x0, 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001b40), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000001b80)='./file0\x00', &(0x7f0000001bc0), 0x0, &(0x7f0000001c00)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r8, &(0x7f0000001c80)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f0000003cc0)='./file0\x00', 0x0, 0x0) write$FUSE_INIT(r8, &(0x7f0000003d00)={0x50, 0xfffffffffffffffe, r9, {0x7, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0x50) read$FUSE(r8, &(0x7f0000003d80)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r8, &(0x7f0000005dc0)={0x10, 0xffffffffffffffda, r10}, 0x10) r11 = open$dir(&(0x7f0000005e00)='./file0\x00', 0x0, 0x0) fcntl$lock(r11, 0x7, &(0x7f0000005e40)={0x0, 0x0, 0x0, 0x200000}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000001900)=[{0x6, 0x1, 0x83, 0x7fff0000}]}) executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001040)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x5, 0x248, &(0x7f0000000440)=ANY=[], 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x3, 0x0, 0x7fff0006}]}) mknod(&(0x7f0000000080)='./file0\x00', 0x0, 0xffffffff) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x101001, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000240)=ANY=[@ANYBLOB="02171a00000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 4: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$inet6(0xa, 0x3, 0x7) r2 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x20040400) unshare(0x4000000) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x200, 0x0}, 0x8) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000010b80)={0x9, 0x4, &(0x7f00000009c0)=ANY=[@ANYRES32=r1, @ANYRES16=r3, @ANYBLOB="1d1e8f89a21e905bb76276f19121343c66341f30cd823c84501eab50f9ad0c675c2d1675a05a0ee6dc4b468a4977e937c2ba3dc82ffc03877e3ba8156457d96aa96d368599c835041e73a2f62112d9514a8e98f2792737e9e52e726055d8c737886150b5599625a502645f611a0adc0bd7f22d059d0a459385ca2cfd64ecceefec45954bf0ec633d6de4cf746852c63d5664b4352eda6c15de6c977e91192485e2c837ce2f9953544210a0729ffd8bee28442a7dfa6a433f25d6f17853f8a15d7f5ddfe82ee16e0dbe3526d5182adf660cd650530e99f090cbd260f9f1bb47133b6e858bac6ffd5b8de9b483b1642dcd4de8914905e3eed0faef326937001e9c66bf0f41d0152ef7ef1f6c9db8fe02b934094c8c282382938339ec7df6c5da", @ANYRES64=0x0, @ANYRESDEC=r0, @ANYRESHEX=r3, @ANYRES8=r2], &(0x7f00000001c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) syz_usb_connect(0x2, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0) r6 = fsopen(&(0x7f0000000080)='smb3\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='vers\x00', &(0x7f0000000600)='-\xf2B\xd3\xd1]\xc4\x85RB \x9a,\x03\xe9\x1e\xfb\x88\xd8g\x1f\xe2\xfaWy\xf8\x82\xe3\x8b\x05 2\"/\x9b\xad>\xe54Z \xd2\x84F\xf6\xb9\x06Yc\xdfIGQ\xa0B\xb1*0\xd0\xe2\x91\x92\xe3\xd4V&\x8bS\x85\xab\x93\x02\xc9\xe5\xd8mZ\x03\xee\xd3\x1e\xf6)`s\xe5\xe5\xd3A\xedk!\x1dO\x8dw\xeb\xec\xd8\r\xe5\xeb\xb6z\x81\xaa\xbb\xf4\b\xaa\x89\x0f\"\xf5\xb0R\xe3L\xc6L\a\xf1\xb0\x1e\x04|Zu\bWG4\x0e\b&\xde\xba\xb2\x1d\xe1[G\r', 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r4, 0x0, 0x0, r7, &(0x7f0000000300)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000280)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000400)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f00000006c0)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f0000000940)={{@my=0x0}, 0x1, 0x0, 0x10001}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r8, 0x7a6, &(0x7f0000000980)={0xc, 0xf7fffffffffffffc, 0x240000, 0x7fffffffffffffff, 0x80000f, 0x9}) r9 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000380), 0x88002, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000003c0)=0xd) open(&(0x7f0000000140)='./file0\x00', 0x143142, 0xc0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x40a903, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r10, 0x3b85, &(0x7f00000004c0)={0x28, 0x7, r11, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r10, 0x3ba0, &(0x7f0000000500)={0x48, 0x5, r11, 0x0, 0xffffffffffffffff, 0x1}) executing program 0: r0 = fsopen(&(0x7f0000001840)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xa9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c4000000190001000000000000004000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000053260e130000000000000000000000fbfffffffff5ffff00000000001b00000000000000000000000000000000000200000000000000b912"], 0xc4}, 0x1, 0x0, 0x0, 0x40100}, 0x2c000010) syz_usb_connect(0x0, 0x147, &(0x7f0000000180)=ANY=[@ANYRES64=0x0, @ANYRESOCT], 0x0) executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000180)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x3, 0x279, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x10000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0xb0d, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x103}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r1, r7, &(0x7f0000000540)={0x0, 0x80002, 0x0, 0x3, 0x1fffc, 0x0, r2}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4465, 0x1, 0x0, 0x220, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x0, 0xfffffffd, 0x68, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2fdf, 0x4, 0x1, 0x18}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x40006252, 0x0, 0x1, 0xfffffffa}}], 0x1, &(0x7f00000003c0)={0x2e, 0x4c, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r6, '\x00', {0x6, 0xfb9, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) executing program 3: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000980)={0x8b28, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r0, 0x0, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000005c0)={0x0, 0xd00, &(0x7f0000000600)={&(0x7f0000000640)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0xc0c4) executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) request_key(&(0x7f00000002c0)='rxrpc_s\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)='y\xa9rustV\x1eS=\xd4\x16\x95:\x00\x01\x00\x00', 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$CLEAR(r3, 0x3b88, &(0x7f0000000040)={0xc, 0x0, 0x2, 0xfdfd}) sendmsg$nl_generic(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f00000007c0)={0x18, 0x26, 0x101, 0x70bd26, 0xfffffffc, {0x1d}, [@nested={0x4, 0x12b}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000000400)=""/4084, 0xff4}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000014c0)=""/256, 0x100}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x5}, 0x1}], 0x4, 0x2000, 0x0) executing program 1: r0 = fsopen(&(0x7f0000001840)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xa9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) executing program 1: syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "c800002000", "fff600"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000180)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000880)=""/65, 0x41}], 0x1}, 0xfff}, {{0x0, 0xfffffcbf, 0x0}, 0x1}], 0x2, 0x0, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f00000003c0)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59e", 0x4a}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000440)=0xffff1884, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x47) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000280)=0x4008, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYRES32=r0], 0x50}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000540)={'syzkaller0\x00', 0x1}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r3, 0x8040942d, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000200c8"], 0x2c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)=ANY=[], 0x20}, 0x1, 0x100000000000, 0x0, 0x40001}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x22040085}, 0x11) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000740)) unshare(0x64000600) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xf, 0xf, 0xfffffdfffffffffd, 0x2, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, &(0x7f00000007c0)) r0 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x5, 0x155081) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000040)={0x0, 0x0, {0x1, 0xfffffffc, 0x1}}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f000063b000/0x4000)=nil, 0x4000, 0x2, 0x13, r1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_connect(0x3, 0x32, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x9, 0x3, 0x238, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1a0, 0xffffffff, 0xffffffff, 0x1a0, 0xffffffff, 0x3, &(0x7f0000000180), {[{{@ip={@empty, @empty, 0xff, 0xff000000, 'bond0\x00', 'veth1_vlan\x00', {0xff}, {}, 0x84, 0x1, 0x74}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x4, 0x5, 0xffff, 'netbios-ns\x00', {0xdd0fdaa}}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0xe}, @multicast2, 0xffffffff, 0xffffffff, 'macvtap0\x00', 'veth0_to_team\x00', {}, {0xff}, 0x1, 0x2, 0x19}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x8, 0x1, 0x2}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fffffff, 0x6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x298) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=ANY=[@ANYBLOB="5c0000000206010800000000efff0000000000000900020073797a310000000005000400000000001400078005001500090000000800114000000000050001000600000005000500000000000d000300686173683a6d616300"], 0x5c}}, 0x404c804) sendmmsg$inet(r3, &(0x7f0000000740)=[{{&(0x7f0000000780)={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, &(0x7f00000007c0)=[@ip_pktinfo={{0x1c, 0x0, 0x34, {0x0, @empty, @remote}}}], 0x20}}], 0x1, 0x40000) socket(0x2d, 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000800)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000880)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000008c0), 0x3) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000900), 0xc0803, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r7, 0x4068aea3, &(0x7f0000000940)={0x8f, 0x0, 0x2}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000009c0)=[@text64={0x40, &(0x7f0000000100)="b9100400000f320f5ee2b98a0a0000b800000000ba000000800f30ad660fc77496176426660f388173df410fc733640f4363963e0f381e812500000066ba4300ed", 0x41}], 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000a00)=[@textreal={0x8, 0x0}], 0x1, 0x32, 0x0, 0x0) executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) executing program 0: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000008400)=[@in6={0xa, 0x4e24, 0x7fff, @empty, 0x19f4d29}], 0x1c) listen(r0, 0x100) sendmsg$inet_sctp(r0, &(0x7f0000008440)={&(0x7f0000008480)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, &(0x7f00000084c0)=[{&(0x7f0000008500)="b2", 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x20048844) (fail_nth: 43) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000002100)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) openat$kvm(0xffffffffffffff9c, 0x0, 0x81, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200000e00000000000008004500007000670000fb019078ac1e0001ac1414aa03006f78032400004500000000010004000100077f00000164010102863dffffffff000808c82ce8da6e0502000b7434954373561de5840205cf0a0006040000071173bc23f9ffffffa30900a301c846000008c8f46976e79e0000006da410bda30c86bef56a22d089f3f2ccf120"], 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0xd000, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r1, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r3, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) executing program 3: ioprio_set$pid(0x2, 0x0, 0x6000) io_setup(0x2, &(0x7f0000000080)=0x0) eventfd(0x800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000d80), 0x0, 0x10, &(0x7f0000000dc0), 0xfffffffffffffdbb}, 0x48) io_submit(r0, 0x0, &(0x7f00000000c0)) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: bisecting 30 programs bisect: split chunks (needed=false): <30> bisect: split chunk #0 of len 30 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 2, 2, 7, 3, 4, 25, 4, 10, 3, 2, 30, 29, 27, 27, 4, 3, 4, 6, 5] detailed listing: executing program 4: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$inet6(0xa, 0x3, 0x7) r2 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x20040400) unshare(0x4000000) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x200, 0x0}, 0x8) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000010b80)={0x9, 0x4, &(0x7f00000009c0)=ANY=[@ANYRES32=r1, @ANYRES16=r3, @ANYBLOB="1d1e8f89a21e905bb76276f19121343c66341f30cd823c84501eab50f9ad0c675c2d1675a05a0ee6dc4b468a4977e937c2ba3dc82ffc03877e3ba8156457d96aa96d368599c835041e73a2f62112d9514a8e98f2792737e9e52e726055d8c737886150b5599625a502645f611a0adc0bd7f22d059d0a459385ca2cfd64ecceefec45954bf0ec633d6de4cf746852c63d5664b4352eda6c15de6c977e91192485e2c837ce2f9953544210a0729ffd8bee28442a7dfa6a433f25d6f17853f8a15d7f5ddfe82ee16e0dbe3526d5182adf660cd650530e99f090cbd260f9f1bb47133b6e858bac6ffd5b8de9b483b1642dcd4de8914905e3eed0faef326937001e9c66bf0f41d0152ef7ef1f6c9db8fe02b934094c8c282382938339ec7df6c5da", @ANYRES64=0x0, @ANYRESDEC=r0, @ANYRESHEX=r3, @ANYRES8=r2], &(0x7f00000001c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) syz_usb_connect(0x2, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0) r6 = fsopen(&(0x7f0000000080)='smb3\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='vers\x00', &(0x7f0000000600)='-\xf2B\xd3\xd1]\xc4\x85RB \x9a,\x03\xe9\x1e\xfb\x88\xd8g\x1f\xe2\xfaWy\xf8\x82\xe3\x8b\x05 2\"/\x9b\xad>\xe54Z \xd2\x84F\xf6\xb9\x06Yc\xdfIGQ\xa0B\xb1*0\xd0\xe2\x91\x92\xe3\xd4V&\x8bS\x85\xab\x93\x02\xc9\xe5\xd8mZ\x03\xee\xd3\x1e\xf6)`s\xe5\xe5\xd3A\xedk!\x1dO\x8dw\xeb\xec\xd8\r\xe5\xeb\xb6z\x81\xaa\xbb\xf4\b\xaa\x89\x0f\"\xf5\xb0R\xe3L\xc6L\a\xf1\xb0\x1e\x04|Zu\bWG4\x0e\b&\xde\xba\xb2\x1d\xe1[G\r', 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r4, 0x0, 0x0, r7, &(0x7f0000000300)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000280)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000400)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f00000006c0)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f0000000940)={{@my=0x0}, 0x1, 0x0, 0x10001}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r8, 0x7a6, &(0x7f0000000980)={0xc, 0xf7fffffffffffffc, 0x240000, 0x7fffffffffffffff, 0x80000f, 0x9}) r9 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000380), 0x88002, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000003c0)=0xd) open(&(0x7f0000000140)='./file0\x00', 0x143142, 0xc0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x40a903, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r10, 0x3b85, &(0x7f00000004c0)={0x28, 0x7, r11, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r10, 0x3ba0, &(0x7f0000000500)={0x48, 0x5, r11, 0x0, 0xffffffffffffffff, 0x1}) executing program 0: r0 = fsopen(&(0x7f0000001840)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xa9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c4000000190001000000000000004000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000053260e130000000000000000000000fbfffffffff5ffff00000000001b00000000000000000000000000000000000200000000000000b912"], 0xc4}, 0x1, 0x0, 0x0, 0x40100}, 0x2c000010) syz_usb_connect(0x0, 0x147, &(0x7f0000000180)=ANY=[@ANYRES64=0x0, @ANYRESOCT], 0x0) executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000180)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x3, 0x279, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x10000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0xb0d, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x103}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r1, r7, &(0x7f0000000540)={0x0, 0x80002, 0x0, 0x3, 0x1fffc, 0x0, r2}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4465, 0x1, 0x0, 0x220, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x0, 0xfffffffd, 0x68, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2fdf, 0x4, 0x1, 0x18}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x40006252, 0x0, 0x1, 0xfffffffa}}], 0x1, &(0x7f00000003c0)={0x2e, 0x4c, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r6, '\x00', {0x6, 0xfb9, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) executing program 3: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000980)={0x8b28, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r0, 0x0, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000005c0)={0x0, 0xd00, &(0x7f0000000600)={&(0x7f0000000640)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0xc0c4) executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) request_key(&(0x7f00000002c0)='rxrpc_s\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)='y\xa9rustV\x1eS=\xd4\x16\x95:\x00\x01\x00\x00', 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$CLEAR(r3, 0x3b88, &(0x7f0000000040)={0xc, 0x0, 0x2, 0xfdfd}) sendmsg$nl_generic(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f00000007c0)={0x18, 0x26, 0x101, 0x70bd26, 0xfffffffc, {0x1d}, [@nested={0x4, 0x12b}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000000400)=""/4084, 0xff4}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000014c0)=""/256, 0x100}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x5}, 0x1}], 0x4, 0x2000, 0x0) executing program 1: r0 = fsopen(&(0x7f0000001840)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xa9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) executing program 1: syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "c800002000", "fff600"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000180)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000880)=""/65, 0x41}], 0x1}, 0xfff}, {{0x0, 0xfffffcbf, 0x0}, 0x1}], 0x2, 0x0, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f00000003c0)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59e", 0x4a}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000440)=0xffff1884, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x47) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000280)=0x4008, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYRES32=r0], 0x50}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000540)={'syzkaller0\x00', 0x1}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r3, 0x8040942d, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000200c8"], 0x2c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)=ANY=[], 0x20}, 0x1, 0x100000000000, 0x0, 0x40001}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x22040085}, 0x11) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000740)) unshare(0x64000600) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xf, 0xf, 0xfffffdfffffffffd, 0x2, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, &(0x7f00000007c0)) r0 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x5, 0x155081) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000040)={0x0, 0x0, {0x1, 0xfffffffc, 0x1}}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f000063b000/0x4000)=nil, 0x4000, 0x2, 0x13, r1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_connect(0x3, 0x32, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x9, 0x3, 0x238, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1a0, 0xffffffff, 0xffffffff, 0x1a0, 0xffffffff, 0x3, &(0x7f0000000180), {[{{@ip={@empty, @empty, 0xff, 0xff000000, 'bond0\x00', 'veth1_vlan\x00', {0xff}, {}, 0x84, 0x1, 0x74}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x4, 0x5, 0xffff, 'netbios-ns\x00', {0xdd0fdaa}}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0xe}, @multicast2, 0xffffffff, 0xffffffff, 'macvtap0\x00', 'veth0_to_team\x00', {}, {0xff}, 0x1, 0x2, 0x19}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x8, 0x1, 0x2}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fffffff, 0x6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x298) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=ANY=[@ANYBLOB="5c0000000206010800000000efff0000000000000900020073797a310000000005000400000000001400078005001500090000000800114000000000050001000600000005000500000000000d000300686173683a6d616300"], 0x5c}}, 0x404c804) sendmmsg$inet(r3, &(0x7f0000000740)=[{{&(0x7f0000000780)={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, &(0x7f00000007c0)=[@ip_pktinfo={{0x1c, 0x0, 0x34, {0x0, @empty, @remote}}}], 0x20}}], 0x1, 0x40000) socket(0x2d, 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000800)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000880)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000008c0), 0x3) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000900), 0xc0803, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r7, 0x4068aea3, &(0x7f0000000940)={0x8f, 0x0, 0x2}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000009c0)=[@text64={0x40, &(0x7f0000000100)="b9100400000f320f5ee2b98a0a0000b800000000ba000000800f30ad660fc77496176426660f388173df410fc733640f4363963e0f381e812500000066ba4300ed", 0x41}], 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000a00)=[@textreal={0x8, 0x0}], 0x1, 0x32, 0x0, 0x0) executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) executing program 0: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000008400)=[@in6={0xa, 0x4e24, 0x7fff, @empty, 0x19f4d29}], 0x1c) listen(r0, 0x100) sendmsg$inet_sctp(r0, &(0x7f0000008440)={&(0x7f0000008480)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, &(0x7f00000084c0)=[{&(0x7f0000008500)="b2", 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x20048844) (fail_nth: 43) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000002100)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) openat$kvm(0xffffffffffffff9c, 0x0, 0x81, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200000e00000000000008004500007000670000fb019078ac1e0001ac1414aa03006f78032400004500000000010004000100077f00000164010102863dffffffff000808c82ce8da6e0502000b7434954373561de5840205cf0a0006040000071173bc23f9ffffffa30900a301c846000008c8f46976e79e0000006da410bda30c86bef56a22d089f3f2ccf120"], 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0xd000, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r1, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r3, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) executing program 3: ioprio_set$pid(0x2, 0x0, 0x6000) io_setup(0x2, &(0x7f0000000080)=0x0) eventfd(0x800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000d80), 0x0, 0x10, &(0x7f0000000dc0), 0xfffffffffffffdbb}, 0x48) io_submit(r0, 0x0, &(0x7f00000000c0)) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 30, 29, 27, 27, 4, 3, 4, 6, 5] detailed listing: executing program 1: r0 = fsopen(&(0x7f0000001840)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xa9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) executing program 1: syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "c800002000", "fff600"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000180)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) recvmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000880)=""/65, 0x41}], 0x1}, 0xfff}, {{0x0, 0xfffffcbf, 0x0}, 0x1}], 0x2, 0x0, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f00000003c0)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59e", 0x4a}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000440)=0xffff1884, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x47) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000280)=0x4008, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYRES32=r0], 0x50}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000540)={'syzkaller0\x00', 0x1}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r3, 0x8040942d, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000200c8"], 0x2c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)=ANY=[], 0x20}, 0x1, 0x100000000000, 0x0, 0x40001}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x22040085}, 0x11) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000740)) unshare(0x64000600) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) executing program 3: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xf, 0xf, 0xfffffdfffffffffd, 0x2, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, &(0x7f00000007c0)) r0 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x5, 0x155081) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000040)={0x0, 0x0, {0x1, 0xfffffffc, 0x1}}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f000063b000/0x4000)=nil, 0x4000, 0x2, 0x13, r1, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_connect(0x3, 0x32, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x9, 0x3, 0x238, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1a0, 0xffffffff, 0xffffffff, 0x1a0, 0xffffffff, 0x3, &(0x7f0000000180), {[{{@ip={@empty, @empty, 0xff, 0xff000000, 'bond0\x00', 'veth1_vlan\x00', {0xff}, {}, 0x84, 0x1, 0x74}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x4, 0x5, 0xffff, 'netbios-ns\x00', {0xdd0fdaa}}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0xe}, @multicast2, 0xffffffff, 0xffffffff, 'macvtap0\x00', 'veth0_to_team\x00', {}, {0xff}, 0x1, 0x2, 0x19}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x8, 0x1, 0x2}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7fffffff, 0x6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x298) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=ANY=[@ANYBLOB="5c0000000206010800000000efff0000000000000900020073797a310000000005000400000000001400078005001500090000000800114000000000050001000600000005000500000000000d000300686173683a6d616300"], 0x5c}}, 0x404c804) sendmmsg$inet(r3, &(0x7f0000000740)=[{{&(0x7f0000000780)={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, &(0x7f00000007c0)=[@ip_pktinfo={{0x1c, 0x0, 0x34, {0x0, @empty, @remote}}}], 0x20}}], 0x1, 0x40000) socket(0x2d, 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000800)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000880)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000008c0), 0x3) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000900), 0xc0803, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r7, 0x4068aea3, &(0x7f0000000940)={0x8f, 0x0, 0x2}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000009c0)=[@text64={0x40, &(0x7f0000000100)="b9100400000f320f5ee2b98a0a0000b800000000ba000000800f30ad660fc77496176426660f388173df410fc733640f4363963e0f381e812500000066ba4300ed", 0x41}], 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000a00)=[@textreal={0x8, 0x0}], 0x1, 0x32, 0x0, 0x0) executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x100, 0x1, 0x8}, 'syz1\x00', 0x19}) ioctl$UI_DEV_CREATE(r0, 0x5501) socket(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_open_dev$video(&(0x7f0000000280), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) syz_usb_connect(0x2, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f00000003c0)=[0x1, 0xef]) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000400)=[0x1, 0xb]) sendmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0xc}}], 0x2, 0x20000040) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000580)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000000600)}, 0x400000}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000640)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000680)=@userptr={0x0, 0x1, 0x4, 0x20, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x8, "cbe0c5dc"}, 0x0, 0x2, {&(0x7f0000000700)}, 0x9, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000740)=0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000780)=0x1) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f00000007c0)=@multiplanar_mmap={0x8bd, 0x1, 0x4, 0x4000, 0x7, {}, {0x3, 0x8, 0x80, 0x1, 0x1, 0x1, "cd5c9d4a"}, 0x3ff, 0x1, {0x0}, 0x4, 0x0, r4}) sendmsg$nl_route(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="200000653a9d3681000c000280000000c86c3c85b96401a8402bcd2c620315c4b6a8b0b1ebc3c3d4d25cfa381577ff7186180ef08959faf25856e4124eb71d1751e78337eed1ee3a01e783fc7e579e21e34adfb5612beaf110c0c6cb39867e867f864a8eb45717cfca3e5e56cfd54bedac450c5ef7a7affcaed2ba27361d837494ccdeead6a89f239a7d427622b21959e88ed11e6b64209559cd40be4a47086cd86f4ccb04135757cac9b2fe266e82e62435c977a9a8e98a6c4fb7c0c3ecb32875d0d38dce424c00000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) executing program 0: r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000008400)=[@in6={0xa, 0x4e24, 0x7fff, @empty, 0x19f4d29}], 0x1c) listen(r0, 0x100) sendmsg$inet_sctp(r0, &(0x7f0000008440)={&(0x7f0000008480)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, &(0x7f00000084c0)=[{&(0x7f0000008500)="b2", 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x20048844) (fail_nth: 43) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000002100)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) openat$kvm(0xffffffffffffff9c, 0x0, 0x81, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200000e00000000000008004500007000670000fb019078ac1e0001ac1414aa03006f78032400004500000000010004000100077f00000164010102863dffffffff000808c82ce8da6e0502000b7434954373561de5840205cf0a0006040000071173bc23f9ffffffa30900a301c846000008c8f46976e79e0000006da410bda30c86bef56a22d089f3f2ccf120"], 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0xd000, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r1, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r3, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) executing program 3: ioprio_set$pid(0x2, 0x0, 0x6000) io_setup(0x2, &(0x7f0000000080)=0x0) eventfd(0x800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="b70000000100000bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000007f44000000000000630a04fe000000007933ff80000000009f030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fba1e3587b9d9e878c86ba9b66c4491fcff607d9cbf156f3fc0fb8c827d4e6cac493a3e2746bd5f0f8bc024352200a4250785cdca4fe3c546972d0a56e3905d1e72c33d64f6591fe25f312f47e7ec6b4640f1f6dc4efee4b8d3cfbfcbf77bfd52f0a99adc7d359233cfea0a11f5dcb87603885f08d633e842644988d2f45a1824361b5df707f726fad22d53727b4396b3d05df34933262fdb09f19837fdc2af1c721b17d54076e25ab625ae0a4c9cd900"/3002], &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000d80), 0x0, 0x10, &(0x7f0000000dc0), 0xfffffffffffffdbb}, 0x48) io_submit(r0, 0x0, &(0x7f00000000c0)) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 2, 2, 7, 3, 4, 25, 4, 10, 3] detailed listing: executing program 4: r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$inet6(0xa, 0x3, 0x7) r2 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x20040400) unshare(0x4000000) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x200, 0x0}, 0x8) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000010b80)={0x9, 0x4, &(0x7f00000009c0)=ANY=[@ANYRES32=r1, @ANYRES16=r3, @ANYBLOB="1d1e8f89a21e905bb76276f19121343c66341f30cd823c84501eab50f9ad0c675c2d1675a05a0ee6dc4b468a4977e937c2ba3dc82ffc03877e3ba8156457d96aa96d368599c835041e73a2f62112d9514a8e98f2792737e9e52e726055d8c737886150b5599625a502645f611a0adc0bd7f22d059d0a459385ca2cfd64ecceefec45954bf0ec633d6de4cf746852c63d5664b4352eda6c15de6c977e91192485e2c837ce2f9953544210a0729ffd8bee28442a7dfa6a433f25d6f17853f8a15d7f5ddfe82ee16e0dbe3526d5182adf660cd650530e99f090cbd260f9f1bb47133b6e858bac6ffd5b8de9b483b1642dcd4de8914905e3eed0faef326937001e9c66bf0f41d0152ef7ef1f6c9db8fe02b934094c8c282382938339ec7df6c5da", @ANYRES64=0x0, @ANYRESDEC=r0, @ANYRESHEX=r3, @ANYRES8=r2], &(0x7f00000001c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) syz_usb_connect(0x2, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0) r6 = fsopen(&(0x7f0000000080)='smb3\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='vers\x00', &(0x7f0000000600)='-\xf2B\xd3\xd1]\xc4\x85RB \x9a,\x03\xe9\x1e\xfb\x88\xd8g\x1f\xe2\xfaWy\xf8\x82\xe3\x8b\x05 2\"/\x9b\xad>\xe54Z \xd2\x84F\xf6\xb9\x06Yc\xdfIGQ\xa0B\xb1*0\xd0\xe2\x91\x92\xe3\xd4V&\x8bS\x85\xab\x93\x02\xc9\xe5\xd8mZ\x03\xee\xd3\x1e\xf6)`s\xe5\xe5\xd3A\xedk!\x1dO\x8dw\xeb\xec\xd8\r\xe5\xeb\xb6z\x81\xaa\xbb\xf4\b\xaa\x89\x0f\"\xf5\xb0R\xe3L\xc6L\a\xf1\xb0\x1e\x04|Zu\bWG4\x0e\b&\xde\xba\xb2\x1d\xe1[G\r', 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r4, 0x0, 0x0, r7, &(0x7f0000000300)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000280)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000400)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f00000006c0)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r8, 0x7a5, &(0x7f0000000940)={{@my=0x0}, 0x1, 0x0, 0x10001}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r8, 0x7a6, &(0x7f0000000980)={0xc, 0xf7fffffffffffffc, 0x240000, 0x7fffffffffffffff, 0x80000f, 0x9}) r9 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000380), 0x88002, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000003c0)=0xd) open(&(0x7f0000000140)='./file0\x00', 0x143142, 0xc0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x40a903, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r10, 0x3b85, &(0x7f00000004c0)={0x28, 0x7, r11, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r10, 0x3ba0, &(0x7f0000000500)={0x48, 0x5, r11, 0x0, 0xffffffffffffffff, 0x1}) executing program 0: r0 = fsopen(&(0x7f0000001840)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000200)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xa9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) executing program 0: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c4000000190001000000000000004000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000053260e130000000000000000000000fbfffffffff5ffff00000000001b00000000000000000000000000000000000200000000000000b912"], 0xc4}, 0x1, 0x0, 0x0, 0x40100}, 0x2c000010) syz_usb_connect(0x0, 0x147, &(0x7f0000000180)=ANY=[@ANYRES64=0x0, @ANYRESOCT], 0x0) executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000180)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x3, 0x279, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x10000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0xb0d, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x103}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r1, r7, &(0x7f0000000540)={0x0, 0x80002, 0x0, 0x3, 0x1fffc, 0x0, r2}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4465, 0x1, 0x0, 0x220, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x0, 0xfffffffd, 0x68, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2fdf, 0x4, 0x1, 0x18}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x40006252, 0x0, 0x1, 0xfffffffa}}], 0x1, &(0x7f00000003c0)={0x2e, 0x4c, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r6, '\x00', {0x6, 0xfb9, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x3}, 0x1}], 0x4, 0x2000, 0x0) executing program 3: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000980)={0x8b28, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r0, 0x0, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000005c0)={0x0, 0xd00, &(0x7f0000000600)={&(0x7f0000000640)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0xc0c4) executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) request_key(&(0x7f00000002c0)='rxrpc_s\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)='y\xa9rustV\x1eS=\xd4\x16\x95:\x00\x01\x00\x00', 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$CLEAR(r3, 0x3b88, &(0x7f0000000040)={0xc, 0x0, 0x2, 0xfdfd}) sendmsg$nl_generic(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f00000007c0)={0x18, 0x26, 0x101, 0x70bd26, 0xfffffffc, {0x1d}, [@nested={0x4, 0x12b}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000000400)=""/4084, 0xff4}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000014c0)=""/256, 0x100}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x5}, 0x1}], 0x4, 0x2000, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 25, 4, 10, 3] detailed listing: executing program 3: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000980)={0x8b28, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r0, 0x0, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000005c0)={0x0, 0xd00, &(0x7f0000000600)={&(0x7f0000000640)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0xc0c4) executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) request_key(&(0x7f00000002c0)='rxrpc_s\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)='y\xa9rustV\x1eS=\xd4\x16\x95:\x00\x01\x00\x00', 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$CLEAR(r3, 0x3b88, &(0x7f0000000040)={0xc, 0x0, 0x2, 0xfdfd}) sendmsg$nl_generic(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f00000007c0)={0x18, 0x26, 0x101, 0x70bd26, 0xfffffffc, {0x1d}, [@nested={0x4, 0x12b}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000000400)=""/4084, 0xff4}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000014c0)=""/256, 0x100}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x5}, 0x1}], 0x4, 0x2000, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 3] detailed listing: executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) request_key(&(0x7f00000002c0)='rxrpc_s\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)='y\xa9rustV\x1eS=\xd4\x16\x95:\x00\x01\x00\x00', 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_VFIO_IOAS$CLEAR(r3, 0x3b88, &(0x7f0000000040)={0xc, 0x0, 0x2, 0xfdfd}) sendmsg$nl_generic(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f00000007c0)={0x18, 0x26, 0x101, 0x70bd26, 0xfffffffc, {0x1d}, [@nested={0x4, 0x12b}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)=""/162, 0xa2}, {&(0x7f0000000400)=""/4084, 0xff4}, {&(0x7f0000001400)=""/158, 0x9e}, {&(0x7f00000014c0)=""/256, 0x100}, {&(0x7f00000015c0)=""/191, 0xbf}], 0x5}, 0x1}], 0x4, 0x2000, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 25, 4] detailed listing: executing program 3: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000980)={0x8b28, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r0, 0x0, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000005c0)={0x0, 0xd00, &(0x7f0000000600)={&(0x7f0000000640)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0xc0c4) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE detailed listing: executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000005c0)={0x0, 0xd00, &(0x7f0000000600)={&(0x7f0000000640)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x24}}, 0xc0c4) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 25] detailed listing: executing program 3: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000980)={0x8b28, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r0, 0x0, 0x0) executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-ioctl$UFFDIO_COPY-syz_usb_control_io-prctl$PR_SET_SPECULATION_CTRL-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_write detailed listing: executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 4: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-ioctl$UFFDIO_COPY-syz_usb_control_io-prctl$PR_SET_SPECULATION_CTRL-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: concatenation succeeded found reproducer with 25 syscalls minimizing guilty program testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-ioctl$UFFDIO_COPY-syz_usb_control_io-prctl$PR_SET_SPECULATION_CTRL-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-ioctl$UFFDIO_COPY-syz_usb_control_io-prctl$PR_SET_SPECULATION_CTRL-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-ioctl$UFFDIO_COPY-syz_usb_control_io-prctl$PR_SET_SPECULATION_CTRL-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-ioctl$UFFDIO_COPY-syz_usb_control_io-prctl$PR_SET_SPECULATION_CTRL detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-ioctl$UFFDIO_COPY-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-ioctl$UFFDIO_COPY-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000001640)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-ioctl$KVM_IOEVENTFD-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000440)={0x5, 0x3000, 0x0, r5, 0x4}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-ioctl$KVM_IOEVENTFD-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000400)={0x7c, 0x3000, 0x0, r5}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-eventfd-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) eventfd(0x3) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-ioctl$KVM_CREATE_VM-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) r3 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-openat$kvm-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000366000/0x2000)=nil, 0x2000}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-ioctl$UFFDIO_API-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000015c0)={0xaa, 0x1a5}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-userfaultfd-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) userfaultfd(0x80001) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000340)=[{&(0x7f00000005c0)=""/4095, 0x440000}], 0x100000000000011a) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-io_uring_setup-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0x3454, &(0x7f00000002c0)={0x0, 0x0, 0x8000, 0x2, 0x295}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-madvise-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-timer_settime-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mprotect-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-fcntl$lock-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-timer_create-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f00000001c0)) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash extracting C reproducer testing compiled C program (duration=1m19.508577792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host simplifying C reproducer testing compiled C program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program did not crash testing compiled C program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash validation run: crashed=false testing program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash validation run: crashed=false testing program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true testing program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash validation run: crashed=false testing program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash validation run: crashed=false testing program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash validation run: crashed=false testing program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true testing program (duration=1m19.508577792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mremap-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true reproducing took 1h59m1.580985802s repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 locks held by swapper/1/0: 1, last CPU#1: #0: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 1b 8b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 d5 20 00 fb f4 0c 09 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffc90000197e40 EFLAGS: 00000246 RAX: 00000000000d634b RBX: ffffffff819becec RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e469c7a RDI: ffffffff8c6ddc80 RBP: ffffc90000197f10 R08: ffff8880b8533a1b R09: 1ffff110170a6743 R10: dffffc0000000000 R11: ffffed10170a6744 R12: 0000000000000000 R13: 1ffff11003e5b000 R14: 1ffff92000032fd0 R15: dffffc0000000000 arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1cc/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157 ODEBUG: object ffffc90000a08a80 is NOT on stack ffffc90000190000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: swapper/1/0 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#1: swapper/1/0 WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#1: swapper/1/0 Modules linked in: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline] RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798 Code: ff 06 cc 41 ff c7 44 89 3d 69 85 e7 16 48 c7 c1 80 e5 6d 8c 48 c7 c7 e0 e5 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 ed 6d 3b fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 01 84 6c 0b 3b 05 ff RSP: 0018:ffffc90000a089b8 EFLAGS: 00010046 RAX: 0000000000000050 RBX: ffffc90000a08a80 RCX: 0e2b6c59b9985300 RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffff88801f2d8020 R08: 0000000000000100 R09: 1ffff110170a48e2 R10: dffffc0000000000 R11: ffffed10170a48e3 R12: 1ffff9200014114c R13: ffff88807339c460 R14: dffffc0000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888123bbf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000038166cde4000 CR3: 000000006c8b6000 CR4: 00000000003526f0 Call Trace: __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 1b 8b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 d5 20 00 fb f4 0c 09 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffc90000197e40 EFLAGS: 00000246 RAX: 00000000000d634b RBX: ffffffff819becec RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e469c7a RDI: ffffffff8c6ddc80 RBP: ffffc90000197f10 R08: ffff8880b8533a1b R09: 1ffff110170a6743 R10: dffffc0000000000 R11: ffffed10170a6744 R12: 0000000000000000 R13: 1ffff11003e5b000 R14: 1ffff92000032fd0 R15: dffffc0000000000 arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1cc/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157 ---------------- Code disassembly (best guess): 0: 1b 8b 02 c3 cc cc sbb -0x33333cfe(%rbx),%ecx 6: cc int3 7: cc int3 8: cc int3 9: cc int3 a: cc int3 b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: f3 0f 1e fa endbr64 1f: 66 90 xchg %ax,%ax 21: 0f 00 2d 33 d5 20 00 verw 0x20d533(%rip) # 0x20d55b 28: fb sti 29: f4 hlt * 2a: e9 0c 09 03 00 jmp 0x3093b <-- trapping instruction 2f: cc int3 30: cc int3 31: cc int3 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: cc int3 37: cc int3 38: cc int3 39: cc int3 3a: cc int3 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop final repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 locks held by swapper/1/0: 1, last CPU#1: #0: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 1b 8b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 d5 20 00 fb f4 0c 09 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffc90000197e40 EFLAGS: 00000246 RAX: 00000000000d634b RBX: ffffffff819becec RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e469c7a RDI: ffffffff8c6ddc80 RBP: ffffc90000197f10 R08: ffff8880b8533a1b R09: 1ffff110170a6743 R10: dffffc0000000000 R11: ffffed10170a6744 R12: 0000000000000000 R13: 1ffff11003e5b000 R14: 1ffff92000032fd0 R15: dffffc0000000000 arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1cc/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157 ODEBUG: object ffffc90000a08a80 is NOT on stack ffffc90000190000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: swapper/1/0 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#1: swapper/1/0 WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#1: swapper/1/0 Modules linked in: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline] RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798 Code: ff 06 cc 41 ff c7 44 89 3d 69 85 e7 16 48 c7 c1 80 e5 6d 8c 48 c7 c7 e0 e5 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 ed 6d 3b fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 01 84 6c 0b 3b 05 ff RSP: 0018:ffffc90000a089b8 EFLAGS: 00010046 RAX: 0000000000000050 RBX: ffffc90000a08a80 RCX: 0e2b6c59b9985300 RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffff88801f2d8020 R08: 0000000000000100 R09: 1ffff110170a48e2 R10: dffffc0000000000 R11: ffffed10170a48e3 R12: 1ffff9200014114c R13: ffff88807339c460 R14: dffffc0000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888123bbf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000038166cde4000 CR3: 000000006c8b6000 CR4: 00000000003526f0 Call Trace: __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 1b 8b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 d5 20 00 fb f4 0c 09 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffc90000197e40 EFLAGS: 00000246 RAX: 00000000000d634b RBX: ffffffff819becec RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e469c7a RDI: ffffffff8c6ddc80 RBP: ffffc90000197f10 R08: ffff8880b8533a1b R09: 1ffff110170a6743 R10: dffffc0000000000 R11: ffffed10170a6744 R12: 0000000000000000 R13: 1ffff11003e5b000 R14: 1ffff92000032fd0 R15: dffffc0000000000 arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1cc/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157 ---------------- Code disassembly (best guess): 0: 1b 8b 02 c3 cc cc sbb -0x33333cfe(%rbx),%ecx 6: cc int3 7: cc int3 8: cc int3 9: cc int3 a: cc int3 b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: f3 0f 1e fa endbr64 1f: 66 90 xchg %ax,%ax 21: 0f 00 2d 33 d5 20 00 verw 0x20d533(%rip) # 0x20d55b 28: fb sti 29: f4 hlt * 2a: e9 0c 09 03 00 jmp 0x3093b <-- trapping instruction 2f: cc int3 30: cc int3 31: cc int3 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: cc int3 37: cc int3 38: cc int3 39: cc int3 3a: cc int3 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop