last executing test programs: 8.472257611s ago: executing program 2 (id=5): r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f00005f5000/0x2000)=nil, &(0x7f0000b95000/0x1000)=nil, 0x2000, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CHANNEL(r1, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000ec0)={0x1c, r3, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x24000080}, 0x0) 7.83872604s ago: executing program 1 (id=6): r0 = syz_open_dev$swradio(&(0x7f00000001c0), 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x99b, @dev={0xfe, 0x80, '\x00', 0xb}, 0x4}, 0x1c}, 0x48053) r3 = dup(r1) syz_emit_vhci(&(0x7f00000002c0)=@HCI_EVENT_PKT={0x4, @hci_ev_link_key_notify={{}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, "2d1cc967f6f6661360e795c004488acf", 0x2}}}, 0xfa) write$binfmt_elf64(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f454c460008fcff00000000000000000300060009000000d50200000000000040000000000000005a01000000000000008003000000380001005d000400010003c60000070000000200000000000000b00d00000000000003000000000000000700000000c51515010000000000000019a65f78000000003d615368056b4131b805a38a746176f89c5671c306be9cc73e43264f1e4d97a2b36d1f9b3a4bf376cef1980348a97bed34d6f54497ecc6ce1aac3d2e25301bd19db040e6be5b08ef8ef266c648eda19f915d86123b80e81d79de4e49ce8840cce60f96ad881032cdc98b3388"], 0x78) write$cgroup_pid(r3, &(0x7f0000000780), 0x12) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="640000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000000000008001240000000000500050002000000050004000000000016000300686173683a6e6574"], 0x64}}, 0x0) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0x2, 0x2, 0x0, 0x5}}) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0xa00, 0xff01, 0x101, 0x100}}) r6 = openat2(r2, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x480001, 0x80, 0x28}, 0x18) ioctl$VHOST_VDPA_GET_CONFIG(r6, 0x8008af73, &(0x7f00000004c0)={0x0, 0x65, ""/101}) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fb, 0x8001, 0xffff1896, 0xe3, 0x24, 0xffffffb7, 0x1a}, 0x9c) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000040)=ANY=[@ANYRESHEX=r0, @ANYRESDEC=r0]) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000880)={0x5, 0x69d6, 0x4, {0xb, @raw_data="616fa8361b7fa93561c400938f14c41d3bd191813e929d579bad0eaba395302440b14def72a702854f733eda8f928678dfbf64ef5bc4e4d18a228a8a9a94a320e3ca4138412fe4daa706888ef9a9976100e40f9bea5b0cb85b8534155ee1fe6538a721ba54a94f262eee3fa8451b1e74495748751ca719653d7c1d08bd329a323d37594e15f6f0d2c4eee52d24ef8811d0b881cfd1c2b17dee80151d29174c9a793402c7236e126d1582f15af6c5006bcce501ab94a656c99aa8d34c5964fd0912580b6f42723a2a"}, 0xb}) 7.5521336s ago: executing program 2 (id=7): unshare(0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) ioctl$SNDCTL_SEQ_NRMIDIS(r0, 0x8004510b, &(0x7f0000000200)) ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000080)) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000240)={{0x1, 0x1, 0x18, r0, {0x6}}, './file0\x00'}) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$SOUND_OLD_MIXER_INFO(r2, 0x80304d65, &(0x7f00000006c0)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x14, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xe8}}, 0x0) 7.30822764s ago: executing program 1 (id=8): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x14, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0xa}}, 0x14}}, 0x0) (async) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f000009058303", @ANYRESDEC], 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x3b, &(0x7f00000000c0)=ANY=[]) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x84, 0x7f, &(0x7f0000000040)="02007f000980ffff", 0x8) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000540)=ANY=[@ANYBLOB="120100004bec0220a20603008cb4010203010902120001000000000904"], 0x0) (async) rt_sigprocmask(0x0, &(0x7f0000000000)={[0x1200000000000000]}, &(0x7f0000000140), 0x8) 7.115284609s ago: executing program 2 (id=9): socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) mount_setattr(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000040)={0x100005, 0x200086, 0x80000, {r0}}, 0x20) socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x98, &(0x7f0000000100)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2c}}, @in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x4e24, 0xffffffff, @local, 0x3}, @in={0x2, 0x4e23, @remote}, @in6={0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, '\x00', 0x2a}, 0xdcb4}, @in={0x2, 0x4e21, @remote}, @in={0x2, 0x4e22, @rand_addr=0x64010101}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x74, &(0x7f00000000c0)={r2, 0x1, 0x10, 0xaf9, 0x100}, &(0x7f00000010c0)=0x18) syz_usb_connect(0x5, 0xe4, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000017ffd340b1134200bbdf000000010902d200010000400009046a00067af4190009050f102000050801060c8b631b7507250102020700090501", @ANYBLOB="9f652d3125c208"], 0x0) 6.142133182s ago: executing program 0 (id=1): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14, 0x80800) r5 = accept$alg(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP_VS_SO_GET_INFO(r5, 0x0, 0x481, &(0x7f0000000bc0), &(0x7f0000000c00)=0xc) r6 = syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d0101890f0000030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c24020000000300000000000924060006010000000924030000000005000b2406050001", @ANYRESOCT=0x0], 0x0) syz_usb_control_io(r6, &(0x7f00000003c0)={0x2c, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x80a}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r6, &(0x7f0000000600)={0x2c, &(0x7f0000000380)={0x0, 0x21, 0x4a, {0x4a, 0x22, "82781cf5f22e140a1f4d23c973acf0cd0442af5488c64424ed5a886acc27bdc10cf9f7d0ea46f1889aac57b29162f1d6788a02833627a9f6d6fc6b1751a8df879e1c4b4992b951bb"}}, &(0x7f0000000480)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1442}}, &(0x7f00000004c0)={0x0, 0xf, 0x38, {0x5, 0xf, 0x38, 0x6, [@ext_cap={0x7, 0x10, 0x2, 0xb5247f8a1dc94220, 0x3, 0xf, 0x9}, @ext_cap={0x7, 0x10, 0x2, 0x16, 0x5, 0x5, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "3d984666b453af3334e0580b85ed7a00"}, @ptm_cap={0x3}, @ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x4, 0x3c, 0xff, 0x8, 0xfffc, 0x4}]}}, &(0x7f0000000580)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x80, 0xed, 0xff, "fc3c65e9", "8cd215c2"}}, &(0x7f00000005c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x95, 0x0, 0x3, 0x2, 0x9, 0x4, 0x7}}}, &(0x7f0000000b00)={0x84, &(0x7f0000000640)={0x40, 0x0, 0xc2, "3cab2b8d13758fcfc4d23302d65783225817e4d489a15ebbe8b17eda10de65c75875f9326ce45c70339971feec18ba86cb63adbb8df1355124f9384032a91960604e55eba21a212c34121658d2153329771bff4bfa94f1cde206d48b619156eb5c409a227f164a69875d0b1b6006fc79170aa00d4b0512067a931c361dcffca1aa59d795f2db9b1c1d0c4c7466e3c352eb39f00adba1c64c1b7214a7ce9e8e4a9104e307004fbb9f5d09e5da61c6fb6a90ce2104613ddf0b867e7d60274ad045c36a"}, &(0x7f0000000740)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000780)={0x0, 0x8, 0x1, 0x5}, &(0x7f00000007c0)={0x20, 0x0, 0x4, {0x1, 0x3}}, &(0x7f0000000800)={0x20, 0x0, 0x4, {0x100, 0x10}}, &(0x7f0000000840)={0x40, 0x7, 0x2, 0x9}, &(0x7f0000000880)={0x40, 0x9, 0x1, 0x6}, &(0x7f00000008c0)={0x40, 0xb, 0x2, 'j\x00'}, &(0x7f0000000900)={0x40, 0xf, 0x2, 0x1}, &(0x7f0000000940)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000980)={0x40, 0x17, 0x6, @random="3a6e7ff8f403"}, &(0x7f00000009c0)={0x40, 0x19, 0x2, "b87a"}, &(0x7f0000000a00)={0x40, 0x1a, 0x2, 0x2}, &(0x7f0000000a40)={0x40, 0x1c, 0x1, 0xd}, &(0x7f0000000a80)={0x40, 0x1e, 0x1}, &(0x7f0000000ac0)={0x40, 0x21, 0x1, 0x4}}) getpeername$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000340)=0x14) r7 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r7, &(0x7f0000000c40)={0x1d, r4}, 0x10) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="310200000000fcdbdf250f00000005002a000000000008000300", @ANYRES32=r2, @ANYBLOB], 0x24}, 0x1, 0x100000000000000}, 0x0) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r0) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000200)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r8, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20006050}, 0x44) syz_usb_connect$uac2(0x3, 0x8b, &(0x7f0000000000)=ANY=[@ANYBLOB="12011e0300000020532b2300400001020301090279000301fb4004080b02010103200109040000000101200009240108000c1900e508240a00040b060308260a0901030602090401000001022000090401010101022000090501090002080706082501800f07000009040201000102"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) 3.679916761s ago: executing program 2 (id=10): r0 = socket$inet6(0xa, 0x2, 0x0) (async) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)=ANY=[@ANYBLOB="68020000000201030000000000000000020000107c000a800800014000000000000002800000018000000100ffffffff00000200ac1414aa0800014000000000600002800c000280050001003a0000000c0002800500010084000000060003400003000014000180080001000a010101080002000000000088fd0180080001006401010208000200ac1414120c0002800500010088000000060003400001000048010a80900002800c00028005000100000000002c0001801400030000000000000000000000ffff640101001400040000000000000000000000ffffac1414bb2c0001801400030000000000000000000000ffff7f00000114000400fc0000000000000000000000000000000c000280050001002f00000006000340000400001400018008000100ac1414bb08000200ac1e01015c0002800c0002800500010011000000060003400002000006000340000400002c00018014000300fe80000000000000000000000000003014000400fc00000000000000000000000000000006000340000300000600034000030000580002800c000280050001002f0000002c00018014000300fe8000000000000000000000000000bb14000400fc0100000000000000000000000000001400018008000100ac14140b08000200e000000206000340000100009000028006000340000300002c00018014000300fe88000000000000000000000000010114000400fe8000000000000000000000000000aa0c000280050001002f0000002c00018014000300fc02000000000000000000000000000114000400fc0000000000000000000000000000000c0002800500010011000000140001800800010064010102080002007f0000017298a45c371cc51d5a9a3cc65b"], 0x268}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) (async) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x1401, 0x1, 0x70bd25, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x8040) (async) r3 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="3101000009005e08cb06030000e8160000010902240001000064000904340102d486100009058acf", @ANYRESOCT=0x0], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) (async) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r4, 0x1, 0xd, &(0x7f0000000080)=0x8, 0x4) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000140)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r5, &(0x7f0000000080)="0b000300010001", 0x7) (async) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, 0x0, 0x8) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000280)=0x10001) (async) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f00000000c0)) (async) ioctl$SNDCTL_DSP_SYNC(r6, 0x5001, 0x0) (async) sendmsg$inet6(r0, &(0x7f0000000b80)={&(0x7f0000000000)={0xa, 0x4e21, 0x5, @local, 0x800}, 0x1c, &(0x7f0000000a00)=[{&(0x7f00000006c0)="e22bfc441fe9b0d4e67cf4f9d574118c1e4d1467a0b40a89561c23b997b53757ada9a341cbef412800dad2646bee2802bdfadc936145fca8203681fdf4cc8c15672aebfb8ade0dff28f2e0d96196f304b2392f46430edc91b51a066af947998834dc60afb3b0203b4c8a246d823a2ed7ffa0617e4661685094b08603c5fc3e89199ca919d00eba77a0b1e3b52cc405822bb189d78864e7f09197cf061f721a00709ff87825a03dfbbb0947c48c6eadcdf5a4a260fbf976e5f4ac452d32a177df6edd9fae35", 0xc5}, {&(0x7f0000000880)="6d09680aca3fe177802bd0f1b11cfb659a9bb35869a0144180ca202c2dac031b0e7a1d6792a369e1bcbd5699a5a70daf40371c7a9ea3a6b2c9a7e4db54ae547b62802cccbcda0a21847f9374e9c2ea209cb8f966f03c776947bb39c6530927533f6a5574e6d56d3d84f0485cc936f4f1455a05bd7accd7c421ff27cf5a7b7349f9e591b4b3a885abe637f159a1a0a911aa9fa3f20b0b54f259c5d3b42201bce2da129585a21f8523ae930696", 0xac}, {&(0x7f0000000940)="8698218b09e19a1607a301ff6fa55cdd180739ded25ac9febecd69ffd11c2a1dd8122bdb7d1f676dfbb1c5d4", 0x2c}], 0x3, &(0x7f0000000a40)=[@dontfrag={{0x14, 0x29, 0x3e, 0x5}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0x6}}, @rthdr_2292={{0x58, 0x29, 0x39, {0x2b, 0x8, 0x0, 0x1, 0x0, [@ipv4={'\x00', '\xff\xff', @local}, @ipv4={'\x00', '\xff\xff', @multicast2}, @private1={0xfc, 0x1, '\x00', 0x9}, @mcast2]}}}, @rthdr_2292={{0x88, 0x29, 0x39, {0x2c, 0xe, 0x1, 0x2, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, @private0, @private0, @local, @remote, @empty]}}}], 0x110}, 0x1) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000300)={'gretap0\x00', &(0x7f00000000c0)={'erspan0\x00', 0x0, 0x40, 0x7, 0x100, 0x10001, {{0xe, 0x4, 0x2, 0x38, 0x38, 0x68, 0x0, 0x1e, 0x29, 0x0, @loopback, @multicast1, {[@timestamp={0x44, 0x24, 0x76, 0x0, 0x4, [0x4, 0xffff, 0x2, 0x400, 0x6, 0x6, 0x5, 0x1]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000bc0)={'syztnl2\x00', &(0x7f0000000400)={'ip6gre0\x00', r7, 0x29, 0x5, 0x85, 0x6, 0x8, @mcast1, @private0={0xfc, 0x0, '\x00', 0x1}, 0x40, 0x7, 0xfffff822, 0x2}}) 2.911567332s ago: executing program 1 (id=11): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @multicast2}}) r1 = syz_open_procfs(0x0, &(0x7f0000001080)='net\x00') getdents64(r1, &(0x7f00000000c0)=""/40, 0x28) (async) getdents64(r1, &(0x7f00000000c0)=""/40, 0x28) getdents(r1, &(0x7f0000000480)=""/56, 0x38) 2.517561709s ago: executing program 3 (id=4): connect$unix(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x2, 0x4) r1 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$inet(r1, &(0x7f00000019c0)={&(0x7f00000015c0)={0x1e, 0x4e21, @broadcast}, 0x10, 0x0}, 0x4000014) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x8200, 0x0) ioctl$COMEDI_INSN(r2, 0x8028640c, &(0x7f0000000300)={0xc000003, 0xf, &(0x7f0000000040)=[0x1e, 0x1000009, 0x1002, 0xffff32eb, 0x8, 0xffffdff9, 0x2d7b, 0x401, 0x5d, 0x5, 0x2, 0xa, 0x6, 0xce, 0x2], 0x0, 0x4000003}) bind$inet(r0, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f00000002c0)=0x9, 0x4) syz_open_dev$sg(&(0x7f00000001c0), 0x508d48d4, 0x40902) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xfd, 0x2, 0x7fff7ffc}]}) syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x8100) close_range(r4, 0xffffffffffffffff, 0x200000000000000) bind$inet(r3, &(0x7f0000000000)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$printer(r6, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 2.269208737s ago: executing program 1 (id=12): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a3100000000080005400000000209000200737997310000000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c80)={0x14, 0xa, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x24048014}, 0x0) recvmmsg(r1, &(0x7f0000002880)=[{{0x0, 0x0, 0x0}, 0x400}], 0x1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a07000000000000000000020000000900010073797a300000000090000000030a01020000000000000000020000000900010073797a3000000000700003005916920a2710ed6a83134b160a839ec8909d184c57"], 0xec}}, 0x0) 1.904090439s ago: executing program 0 (id=13): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000020a4050020000000000001090224000100003005090400000903000100092109000101222c0009058103ff037f02ff"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000003c0)={0x0, 0x0, 0x1, 'queue1\x00'}) r4 = socket$inet_smc(0x2b, 0x1, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xac5) shutdown(r4, 0x0) syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="200d2d0000001f09e75bcf47a88a345a3f746fb1400590136b7103bd4f114e2a60cefa13e8bec3cd466f000000000000000053"], 0x0, 0x0, 0x0, 0x0}, 0x0) 1.508281101s ago: executing program 3 (id=14): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)=ANY=[@ANYBLOB="120100003a982a08cd0ca310a223010203010902120001000000000904"], 0x0) r1 = syz_usb_connect$cdc_ecm(0x2, 0x85, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x73, 0x1, 0x1, 0x5, 0x40, 0x5, "", [{{0x9, 0x4, 0x0, 0x6, 0x3, 0x2, 0x6, 0x0, 0x9, {{0x8, 0x24, 0x6, 0x0, 0x0, '6N}'}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x80000001, 0x1, 0x40, 0x7}, [@network_terminal={0x7, 0x24, 0xa, 0x36, 0x10, 0xfd, 0x8}, @acm={0x4, 0x24, 0x2, 0x2}, @call_mgmt={0x5, 0x24, 0x1, 0x6, 0xb}, @network_terminal={0x7, 0x24, 0xa, 0xf4, 0x6, 0x7f, 0x7}, @mdlm={0x15, 0x24, 0x12, 0x1}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0x6, 0x9, 0x9}}], {{0x9, 0x5, 0x82, 0x2, 0x0, 0xd, 0x3, 0xf8}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x36, 0x7}}}}}]}}]}}, &(0x7f0000000700)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0x2, 0x27, 0x6, 0x10, 0x5}, 0x10, &(0x7f00000001c0)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x2, 0x2, 0x1, 0x4, 0x9, 0x10}]}, 0xa, [{0xb6, &(0x7f0000000200)=@string={0xb6, 0x3, "d005be170176d41c791f44683c0c05032ca34480818877e145b551faf8c742159fb7e23fbfcfdd67282ea883a031ad90517d4a07439e1182b68d2e0c44140c3736b7f2e3de63ca2b52481aa8f1216a01d49b9906db5432007aabeb23e055fe1006bcc10c8ae9767c1be32f76d939fab18e0276af2bed90cefd467373d7f68fbb45002f76fa0870fee05f6ff711ed92d2761cc756877cb830753784423c7b47cbf7d9fcbb9a3f9d0e8c8f6bd3ac27e6833a21014f"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x81a}}, {0xba, &(0x7f0000000300)=@string={0xba, 0x3, "33c2036ab69bf7f3e1d274cb1ce974b910304091f90dc39bc461d5f505d27efe5d0e850f85f80cb300ffb956d1ad62c9e477fac218f23c3664c3e06c8fdb20259226af5e35cf225e7c13727a81fcd84873fc78efe7c54b2d1426ce996b722924eb63e9b18ddb615a120baf4f2ecafe38e7af3ec7a6f92a2cfc9e3290fa5d3eecba0980c7c3dd41ca13bb03857f474205a600f2ced5625f91b40df5c245c9013cf0555ad549c2cf5559a33906c62cec5c85d07bded3f48aa3"}}, {0xcb, &(0x7f00000003c0)=@string={0xcb, 0x3, "d182e58c765f6bb3f36f4a6ff902b0639f4ce4bfe17f92f49e2b15547535a27099c1294d687ce5cd02ebf8d4b733f1e08ff9d55f1a7111fae61b922d8b16354c7153a9c1f07539ad575637936db5b9e23efc0a805b1540770e414c6255fa9a38196ace298cea02c09fb7c7167a5749d9dc8ea7201215ceae4742ac793a16ba3e8c0cc8a0c74ce4a2e5e3f6ae08277d0db26d57ced4a43acad74a289a746fae9a0ebc1d1d4f7e291fbd1d983739a1e6b250ba780f784322f6f2853f0a2d646f459374ae36ff07e238fd"}}, {0xed, &(0x7f00000004c0)=@string={0xed, 0x3, "216fa4b0f11ade2f6a0674845345f08c5b2a9703f0f83fe032d0f78ced63d665d0861407ae060d42f482fe19ca4458cc3ae9ef58c125b49e9a7033c012b35a81e12d2ff05523173907b0e9fefab3e8817cb93e92ac91f8cc18b54ae78209781ea087eb8b41b24ab86a51816709c74d06b7ad9dccb3da2a5d2b78cebbf2a57ba30831187be72ce2bca2043c23078224233bb3ff56b2d30010165b41a6853c54d353daf9a7107cbbbb5e601e87f53e43cfaacd805d1ecb2367de0ca7ab02ddec1749a349a95fb8f0864b8605a334a09426d4a84851e3618a91d80ef166ce3e096de93acb8383762d4e8f0f23"}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x40a}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x1401}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x500a}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x413}}]}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x200, 0x0, {{@in6=@empty, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x16}, {@in6=@loopback, 0x0, 0x3c}, @in=@remote, {0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x3}, {0x0, 0xfffffffffffffffc, 0x0, 0x1}, {0x0, 0x7}, 0x0, 0x0, 0x2, 0x4}, [@coaddr={0x14}]}, 0x104}}, 0x40800) syz_usb_control_io(r1, 0x0, &(0x7f0000000000)={0x84, &(0x7f00000007c0)=ANY=[@ANYRES16, @ANYRES8=r1, @ANYRESHEX=r0, @ANYRESHEX=r1, @ANYRESHEX=r0, @ANYRES64=r0, @ANYRES16=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000e40)=0x15b3, 0x4) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000002c0)={'batadv_slave_1\x00', &(0x7f0000000040)=@ethtool_flash={0x33, 0x7, './file0\x00'}}) syz_usb_connect$hid(0x884e891aaa470db2, 0x3f, &(0x7f0000000840)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x3f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xf7, 0x80, 0x0, "", [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x1, 0x0, 0x10, {0x9, 0x21, 0xf83, 0x2f, 0x1, {0x22, 0xdba}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x81, 0x0, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0xb, 0xc}}]}}}]}}]}}, &(0x7f0000000c40)={0xa, &(0x7f0000000880)={0xa, 0x6, 0x300, 0x6, 0x9, 0x18, 0x10, 0x2}, 0x81, &(0x7f00000008c0)={0x5, 0xf, 0x81, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "68024c95159c5321a966c0f8de5cdbc7"}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "bca0d1501d32b23193030721543651ad"}, @ssp_cap={0x24, 0x10, 0xa, 0x4, 0x6, 0x7fff, 0x0, 0x8001, [0xf0, 0xffc007, 0xffc0, 0x3f00, 0x3f00, 0x0]}, @ss_container_id={0x14, 0x10, 0x4, 0xd, "1545166035f4f8bdd168582219a70d71"}, @ssp_cap={0xc, 0x10, 0xa, 0x5, 0x0, 0x0, 0xff0f, 0x5}, @ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0x1, 0xf, 0xfff7, [0x30]}]}, 0x3, [{0xfb, &(0x7f0000000c80)=ANY=[@ANYBLOB="fb03aaf21254f25f56f8f8e01232ffde333ece36eef37c7634f75211624fb56c1b174e8a23936bd1cdd0ae245f560f535ddc110d4794e569b9d370346410fdc935dd4b6afd1ce5deffeb49fde00c99185c75d3fb13f6a26e0605e6de01c965b20d6861816fd7a5193767de81624691465057aaf893589dc8888fbcfa0fcea705ab1c5165973fe47eb51031fb97bd24cd6130c460310f6ec476ae0f6c7d1d68dfdf4817fa88a5608fb1a962afcf6c8965d55d4a893b1196ce5890387514b312c9fb3bf2df40409b8b21ca1c6066d8f230541350126472f87acf3451f87bb0e162e950ec8c83734d928a1aadf9ffaf9c4fae0aec3c32ebd48adef2a6c7045adc99c667017c52fb291315a2bdb72eae5bf8022494ef077b0de6c195cb2ee6c50849ca990042161b4580f7b22a39ad5809c3c733215ad476f4a6dc3de78bef59f44b984084cf1a7bcfadc3c2e5b7817c9389e74a0091bfea1e166a17f55409e0545307d11b500b7b499b1307d272f5e77372a1ddfb0728b5dbe5d02d21464a253fbdd387c0ed30d7ed3df41818d0bf4f9fa1be40620c7557a6fa7dda6628d31a97d5fdd1"]}, {0xed, &(0x7f0000000b00)=@string={0xed, 0x3, "fecf8c5c8139b59d279acb72d5606e9b9d9a677866d994b627fb7cfa199807b1162dfcb5c19c3a9034ba0bb6de18dc340fba2b8e2567cac9f1be106d992a0f20b358b61a590adb7b883977c0370071706c7705a062a9895c5a26bfe9502d470bcddd18dff57fb27b1f907bab51bc9ac497460a8dda79586e0fae2869dddc79102ce6d183eb5696cc308adb520fac21c8ae12dd4a43f41aab8cfff0e8e3dc19888a0102147e63c1a05879b631c0b36f15e1f79967a96298f7c3658b4b224a997931c048f72427ad0e41af565dbc616ea9cfdacd8e8e1d6184e9741a88a1d3af921ca553f9b2ebde3aa000e6"}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x801}}]}) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_ADDDEF(r5, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x30, 0x0, 0x2, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_MGMT_A_DOMAIN={0x13, 0x1, 'batadv_slave_1\x00'}, @NLBL_MGMT_A_DOMAIN={0x6, 0x1, '(\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000045}, 0x4000) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) 708.060557ms ago: executing program 2 (id=15): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)}, 0x0) 668.292852ms ago: executing program 1 (id=16): r0 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f908, 0x8000, '\x00', @p_u32=&(0x7f0000000140)=0x80000000}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xd}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x84}}, 0x0) 543.058126ms ago: executing program 2 (id=17): r0 = epoll_create1(0x0) socket$unix(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = epoll_create1(0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000a80)={@in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x0, 0x0, 0x2, 0x0, "03c2c29bf71d060000000000000400000038333b0365830444820e6a87db28710cd7a9a0520137e9cc8f9dc099e726ecf50f4d2094b4733d2af1e022a74f0d66fba11c00"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000002c0)={@in6={{0xa, 0x4, 0x2, @empty, 0x1}}, 0x0, 0x0, 0x3f, 0x0, "822aaee2729b48f1845387c235d30585bf81611e13f83de0710352d17ca6203825876f84442d02faa742b77bb3ad0b6c2309dbd20dcdf18f65ea2080dc4a3c1969b6613d836e2cab1517353d8510d426"}, 0xd8) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000001c0)={0x80000000}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000000)={0xa0000001}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20241, 0x0) sendmsg$IPSET_CMD_LIST(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)={0x1c, 0x7, 0x6, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004055}, 0x48000) 0s ago: executing program 1 (id=18): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x4) ioctl$KVM_CAP_DIRTY_LOG_RING(r0, 0x4068aea3, &(0x7f00000004c0)={0xc0, 0x0, 0x1e000}) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0xb05, 0x1abe, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe8, 0xb, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f0000000000)={0x400, 0x2, 0x2, {0xa, @pix_mp={0x4, 0xffffffff, 0x31364d4e, 0x5, 0xc, [{0x0, 0x20001}, {0x5, 0xa}, {0x7, 0x985}, {0xffffffff, 0xeffffffd}, {0x408, 0xdfc}, {0x4, 0x6}, {0xe, 0x1}, {0x40003, 0xf9e}], 0xb, 0x7, 0x2, 0x1, 0x1}}, 0x7}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect$midi(0x2, 0x4c, &(0x7f0000000540)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x18d1, 0x2d05, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3a, 0x1, 0x1, 0x2, 0x0, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x30, 0x7, [@midi_out_jack={0x11, 0x24, 0x3, 0x2, 0x7, 0x5, [{0x8, 0x1}, {0x8, 0x7}, {0x44, 0xc2}, {0x2, 0x9}, {0x2, 0x85}], 0x8}, @ms_header={0x7, 0x24, 0x1, 0x1, 0x7}], [{{0x9, 0x5, 0xc, 0x3, 0x3ff, 0x8, 0x2, 0x4a, {0x7, 0x25, 0x1, 0x3, "20914c"}}}]}}}}}]}}, &(0x7f00000006c0)={0xa, &(0x7f00000005c0)={0xa, 0x6, 0x310, 0x68, 0x6, 0x0, 0x20, 0xa}, 0x37, &(0x7f0000000600)={0x5, 0xf, 0x37, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x5, "bd01d22140e5ff755b34043a8de57486"}, @ssp_cap={0x18, 0x10, 0xa, 0x34, 0x3, 0x57d, 0xf0f, 0x2, [0xff0030, 0xc0, 0x9f3f]}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x2, [{0x6, &(0x7f0000000640)=@string={0x6, 0x3, "9b7b5de2"}}, {0xf, &(0x7f0000000680)=@string={0xf, 0x3, "5fff11cd19b4b7bad22f68243b"}}]}) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x9, {0x9, 0x21, 0x3}}}, &(0x7f0000000480)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000140)={0x14, &(0x7f0000000000)={0x20, 0x9, 0x14, {0x14, 0xc, "be5a3c334816e15651814baced5ab129e3a1"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2809}}}, &(0x7f0000000400)={0x44, &(0x7f0000000180)={0x20, 0x12, 0x35, "c4ea2463a396a4ecdc1fdac8aa635bbf16b9e5490f012995477f4f743ea6dae6a0702a5e723371f8625930332ee8198f0f1a363fed"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000280)={0x20, 0x81, 0x3, "13b3bb"}, &(0x7f00000002c0)={0x20, 0x82, 0x2, "945b"}, &(0x7f0000000300)={0x20, 0x83, 0x2, 'o_'}, &(0x7f0000000340)={0x20, 0x84, 0x1, '_'}, &(0x7f0000000380)={0x20, 0x85, 0x3, "3891c0"}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.206' (ED25519) to the list of known hosts. [ 82.836664][ T5601] cgroup: Unknown subsys name 'net' [ 83.097151][ T5601] cgroup: Unknown subsys name 'cpuset' [ 83.172283][ T5601] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 85.116369][ T5601] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.863424][ T1656] cfg80211: failed to load regulatory.db [ 87.678039][ T5621] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.699285][ T5621] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.700413][ T5621] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.701217][ T5621] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.715701][ T5621] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.716749][ T5621] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.723617][ T5621] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.727313][ T5621] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.728358][ T5621] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.730958][ T5621] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.732935][ T5621] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.743483][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.744739][ T5629] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.756458][ T5627] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.758241][ T5630] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.765483][ T5630] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 87.769081][ T5626] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.811265][ T5621] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 87.816789][ T5621] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.870962][ T4929] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 89.813155][ T60] Bluetooth: hci3: command tx timeout [ 89.813169][ T4929] Bluetooth: hci1: command tx timeout [ 89.868446][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.869598][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.870020][ T5614] bridge_slave_0: entered allmulticast mode [ 89.872708][ T5614] bridge_slave_0: entered promiscuous mode [ 89.892408][ T4929] Bluetooth: hci0: command tx timeout [ 89.892574][ T60] Bluetooth: hci2: command tx timeout [ 89.932607][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.932864][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.933084][ T5614] bridge_slave_1: entered allmulticast mode [ 89.935108][ T5614] bridge_slave_1: entered promiscuous mode [ 89.947489][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.947805][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.948048][ T5613] bridge_slave_0: entered allmulticast mode [ 89.954167][ T5613] bridge_slave_0: entered promiscuous mode [ 90.020598][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.020815][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.020981][ T5613] bridge_slave_1: entered allmulticast mode [ 90.024691][ T5613] bridge_slave_1: entered promiscuous mode [ 90.106914][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.107225][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.107401][ T5616] bridge_slave_0: entered allmulticast mode [ 90.109524][ T5616] bridge_slave_0: entered promiscuous mode [ 90.146791][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.186217][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.186428][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.186982][ T5616] bridge_slave_1: entered allmulticast mode [ 90.189147][ T5616] bridge_slave_1: entered promiscuous mode [ 90.200198][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.200602][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.200917][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.201163][ T5615] bridge_slave_0: entered allmulticast mode [ 90.205915][ T5615] bridge_slave_0: entered promiscuous mode [ 90.218588][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.267744][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.267966][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.268326][ T5615] bridge_slave_1: entered allmulticast mode [ 90.270356][ T5615] bridge_slave_1: entered promiscuous mode [ 90.357148][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.427066][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.430323][ T5614] team0: Port device team_slave_0 added [ 90.470762][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.475276][ T5614] team0: Port device team_slave_1 added [ 90.486028][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.492346][ T5613] team0: Port device team_slave_0 added [ 90.528989][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.532686][ T5613] team0: Port device team_slave_1 added [ 90.601160][ T5616] team0: Port device team_slave_0 added [ 90.604753][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.604776][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.604802][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.657800][ T5616] team0: Port device team_slave_1 added [ 90.659227][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.659236][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.659253][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.673075][ T5615] team0: Port device team_slave_0 added [ 90.676203][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.676216][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.676240][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.724324][ T5615] team0: Port device team_slave_1 added [ 90.726580][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.726593][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.726618][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.804247][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.804263][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.804288][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.840871][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.840888][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.840912][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.868243][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.868259][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.868284][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.941820][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.941836][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.941862][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.960223][ T5614] hsr_slave_0: entered promiscuous mode [ 90.962982][ T5614] hsr_slave_1: entered promiscuous mode [ 91.056982][ T5613] hsr_slave_0: entered promiscuous mode [ 91.058422][ T5613] hsr_slave_1: entered promiscuous mode [ 91.059576][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 91.059644][ T5613] Cannot create hsr debugfs directory [ 91.167523][ T5616] hsr_slave_0: entered promiscuous mode [ 91.168874][ T5616] hsr_slave_1: entered promiscuous mode [ 91.170037][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 91.170063][ T5616] Cannot create hsr debugfs directory [ 91.252164][ T5615] hsr_slave_0: entered promiscuous mode [ 91.253666][ T5615] hsr_slave_1: entered promiscuous mode [ 91.255066][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 91.255091][ T5615] Cannot create hsr debugfs directory [ 91.891832][ T60] Bluetooth: hci1: command tx timeout [ 91.892945][ T60] Bluetooth: hci3: command tx timeout [ 91.971961][ T4929] Bluetooth: hci0: command tx timeout [ 91.972062][ T60] Bluetooth: hci2: command tx timeout [ 92.389056][ T5614] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.441387][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.450379][ T5614] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.496247][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.502935][ T5614] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.535991][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.559066][ T5614] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 92.598476][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.719014][ T5616] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.747141][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.750989][ T5616] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.787209][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.791163][ T5616] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.837818][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.867768][ T5616] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.907234][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 93.067580][ T5615] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.109541][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.121759][ T5615] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.146675][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.150661][ T5615] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.176666][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.206443][ T5615] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.238426][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 93.391403][ T5613] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 93.415961][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.429856][ T5613] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 93.456836][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.460275][ T5613] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 93.479995][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.491434][ T5613] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 93.535459][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 93.596389][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.706173][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.767822][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.767993][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.795431][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.830942][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.831074][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.936155][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.972631][ T4929] Bluetooth: hci1: command tx timeout [ 93.972728][ T60] Bluetooth: hci3: command tx timeout [ 93.996553][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.000588][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.000920][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.046239][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.046409][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.051784][ T4929] Bluetooth: hci0: command tx timeout [ 94.054266][ T60] Bluetooth: hci2: command tx timeout [ 94.140675][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.220079][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.220261][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.245429][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.329695][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.334726][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.449076][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.487990][ T1074] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.488140][ T1074] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.583109][ T1074] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.583297][ T1074] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.318439][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.756200][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.848772][ T5614] veth0_vlan: entered promiscuous mode [ 95.924666][ T5614] veth1_vlan: entered promiscuous mode [ 96.051868][ T60] Bluetooth: hci3: command tx timeout [ 96.051902][ T60] Bluetooth: hci1: command tx timeout [ 96.113528][ T5616] veth0_vlan: entered promiscuous mode [ 96.131963][ T60] Bluetooth: hci0: command tx timeout [ 96.132016][ T4929] Bluetooth: hci2: command tx timeout [ 96.138940][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.185966][ T5614] veth0_macvtap: entered promiscuous mode [ 96.226849][ T5614] veth1_macvtap: entered promiscuous mode [ 96.246139][ T5616] veth1_vlan: entered promiscuous mode [ 96.326291][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.356696][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.427961][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.519021][ T45] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.539871][ T5616] veth0_macvtap: entered promiscuous mode [ 96.547677][ T45] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.562274][ T45] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.567374][ T5615] veth0_vlan: entered promiscuous mode [ 96.570875][ T45] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.591378][ T5616] veth1_macvtap: entered promiscuous mode [ 96.747095][ T5615] veth1_vlan: entered promiscuous mode [ 96.930548][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.974923][ T5613] veth0_vlan: entered promiscuous mode [ 97.000120][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.073521][ T3349] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.076232][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.076252][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.079604][ T5613] veth1_vlan: entered promiscuous mode [ 97.113362][ T3349] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.134020][ T3349] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.151082][ T3349] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.274062][ T5615] veth0_macvtap: entered promiscuous mode [ 97.282685][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.282707][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.368246][ T5615] veth1_macvtap: entered promiscuous mode [ 97.670953][ T5613] veth0_macvtap: entered promiscuous mode [ 97.703638][ T1074] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.703663][ T1074] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.710430][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.747079][ T5613] veth1_macvtap: entered promiscuous mode [ 97.828849][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.951282][ T5768] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3'. [ 97.953886][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.953905][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.964204][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.996585][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.999557][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.014483][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.101501][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.284685][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.504080][ T3349] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.504134][ T3349] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.504174][ T3349] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.504211][ T3349] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.948416][ T4929] Bluetooth: hci3: unexpected event 0x18 length: 247 > 23 [ 98.969976][ T5777] tmpfs: Unknown parameter '0x000000000000000300000000000000000003' [ 99.225571][ T3384] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.225594][ T3384] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.874804][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.874826][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.286913][ T5724] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 100.301763][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 100.324013][ T3384] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.324035][ T3384] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.471828][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 100.510975][ T9] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 100.511008][ T9] usb 2-1: config 179 has no interface number 0 [ 100.511167][ T9] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 100.511198][ T9] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 100.511230][ T9] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 100.511258][ T9] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 100.511286][ T9] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 100.511317][ T9] usb 2-1: config 179 interface 65 has no altsetting 0 [ 100.511355][ T9] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 100.511380][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.520559][ T5724] usb 3-1: config 0 has an invalid interface number: 106 but max is 0 [ 100.520591][ T5724] usb 3-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 100.520609][ T5724] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 100.520628][ T5724] usb 3-1: config 0 has no interface number 0 [ 100.520689][ T5724] usb 3-1: config 0 interface 106 altsetting 0 endpoint 0x1 has an invalid bInterval 49, changing to 9 [ 100.520715][ T5724] usb 3-1: config 0 interface 106 altsetting 0 endpoint 0x1 has invalid maxpacket 9573, setting to 1024 [ 100.520742][ T5724] usb 3-1: config 0 interface 106 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 100.520787][ T5724] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 100.520809][ T5724] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.929636][ T5724] usb 3-1: config 0 descriptor?? [ 100.975146][ T5781] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 101.031373][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.031395][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.193946][ T5766] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 101.453457][ T5766] usb 1-1: Using ep0 maxpacket: 16 [ 101.470393][ T5766] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 101.470422][ T5766] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 101.496715][ T5766] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 101.496750][ T5766] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 101.496773][ T5766] usb 1-1: SerialNumber: syz [ 101.755633][ T9] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input5 [ 102.086918][ T5784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 102.136317][ T5724] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 102.187584][ T5784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.199951][ T67] usb 3-1: Failed to submit usb control message: -71 [ 102.199991][ T67] usb 3-1: unable to send the bmi data to the device: -71 [ 102.200010][ T67] usb 3-1: unable to get target info from device [ 102.200025][ T67] usb 3-1: could not get target info (-71) [ 102.200223][ T67] usb 3-1: could not probe fw (-71) [ 102.258791][ T4965] input input5: unable to receive magic message: -71 [ 102.468968][ T5766] usb 1-1: 0:2 : does not exist [ 102.631150][ T4965] input input5: unable to receive magic message: -71 [ 102.814204][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -1 [ 103.064597][ T5724] usb 3-1: USB disconnect, device number 2 [ 103.298056][ T4965] input input5: unable to receive magic message: -71 [ 103.380859][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 103.380935][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 103.399971][ T9] usb 2-1: USB disconnect, device number 2 [ 103.697628][ T5788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.759187][ T5788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 104.041868][ T5766] usb 1-1: 5:0: cannot get min/max values for control 5 (id 5) [ 104.266727][ T5766] usb 1-1: 5:0: cannot get min/max values for control 5 (id 5) [ 105.053728][ T5724] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 105.093039][ T4929] Bluetooth: hci3: command 0x0406 tx timeout [ 105.349237][ T5724] usb 3-1: config 0 has an invalid interface number: 52 but max is 0 [ 105.349266][ T5724] usb 3-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 105.349286][ T5724] usb 3-1: config 0 has no interface number 0 [ 105.349334][ T5724] usb 3-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 12336, setting to 64 [ 105.349362][ T5724] usb 3-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 105.349389][ T5724] usb 3-1: config 0 interface 52 has no altsetting 0 [ 105.369159][ T5724] usb 3-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 105.369191][ T5724] usb 3-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 105.369212][ T5724] usb 3-1: Manufacturer: syz [ 105.399429][ T5766] usb 1-1: 5:0: cannot get min/max values for control 5 (id 5) [ 105.552728][ T5724] usb 3-1: config 0 descriptor?? [ 105.637215][ T5724] hub 3-1:0.52: bad descriptor, ignoring hub [ 105.637256][ T5724] hub 3-1:0.52: probe with driver hub failed with error -5 [ 105.825397][ T5766] usb 1-1: USB disconnect, device number 2 [ 105.867118][ T5724] usb 3-1: Can not set alternate setting to 1, error: -71 [ 105.867171][ T5724] synaptics_usb 3-1:0.52: probe with driver synaptics_usb failed with error -71 [ 106.011722][ T5795] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 106.024731][ T5724] usb 3-1: USB disconnect, device number 3 [ 106.062646][ T5825] Zero length message leads to an empty skb [ 106.161908][ T5795] usb 4-1: Using ep0 maxpacket: 8 [ 106.197021][ T5795] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 106.197049][ T5795] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.197061][ T5795] usb 4-1: Product: syz [ 106.197070][ T5795] usb 4-1: Manufacturer: syz [ 106.197079][ T5795] usb 4-1: SerialNumber: syz [ 106.260419][ T5795] usb 4-1: config 0 descriptor?? [ 106.499605][ T5820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.516354][ T5820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.544650][ T5820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.545333][ T5820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.665739][ T5795] usb read operation failed. (-32) [ 107.096964][ T5827] =========================================[ 107.096964][ T5827] ================================================================== [ 107.096983][ T5827] BUG: KASAN: slab-use-after-free in clear_tfile_check_list+0x114/0x380 [ 107.097031][ T5827] Read of size 8 at addr ffff888034ebc8e8 by task syz.2.17/5827 [ 107.097050][ T5827] [ 107.097062][ T5827] CPU: 0 UID: 0 PID: 5827 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 107.097087][ T5827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 107.097101][ T5827] Call Trace: [ 107.097109][ T5827] [ 107.097118][ T5827] dump_stack_lvl+0xe8/0x150 [ 107.097146][ T5827] print_address_description+0x55/0x1e0 [ 107.097173][ T5827] ? clear_tfile_check_list+0x114/0x380 [ 107.097200][ T5827] print_report+0x58/0x70 [ 107.097222][ T5827] kasan_report+0x117/0x150 [ 107.097246][ T5827] ? clear_tfile_check_list+0x114/0x380 [ 107.097277][ T5827] clear_tfile_check_list+0x114/0x380 [ 107.097304][ T5827] ? clear_tfile_check_list+0x22/0x380 [ 107.097332][ T5827] do_epoll_ctl_file+0x8fd/0xed0 [ 107.097358][ T5827] ? do_epoll_ctl_file+0xac3/0xed0 [ 107.097384][ T5827] ? __pfx_do_epoll_ctl_file+0x10/0x10 [ 107.097411][ T5827] ? __fget_files+0x3a6/0x420 [ 107.097434][ T5827] ? __fget_files+0x2a/0x420 [ 107.097458][ T5827] __se_sys_epoll_ctl+0x14e/0x210 [ 107.097485][ T5827] ? __pfx___se_sys_epoll_ctl+0x10/0x10 [ 107.097514][ T5827] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.097535][ T5827] do_syscall_64+0x174/0x580 [ 107.097564][ T5827] ? clear_bhb_loop+0x40/0x90 [ 107.097585][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.097603][ T5827] RIP: 0033:0x7fc0aa1dce59 [ 107.097622][ T5827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.097640][ T5827] RSP: 002b:00007fc0a842e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 107.097664][ T5827] RAX: ffffffffffffffda RBX: 00007fc0aa455fa0 RCX: 00007fc0aa1dce59 [ 107.097680][ T5827] RDX: 0000000000000003 RSI: 0000000000000001 RDI: 0000000000000007 [ 107.097692][ T5827] RBP: 00007fc0aa272d6f R08: 0000000000000000 R09: 0000000000000000 [ 107.097706][ T5827] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.097719][ T5827] R13: 00007fc0aa456038 R14: 00007fc0aa455fa0 R15: 00007ffe3e5d6ca8 [ 107.097742][ T5827] [ 107.097749][ T5827] [ 107.097754][ T5827] Allocated by task 5827: [ 107.097764][ T5827] kasan_save_track+0x3e/0x80 [ 107.097795][ T5827] __kasan_slab_alloc+0x6c/0x80 [ 107.097815][ T5827] kmem_cache_alloc_noprof+0x33b/0x680 [ 107.097836][ T5827] ep_insert+0x512/0x1820 [ 107.097858][ T5827] do_epoll_ctl_file+0x8bb/0xed0 [ 107.097880][ T5827] __se_sys_epoll_ctl+0x14e/0x210 [ 107.097902][ T5827] do_syscall_64+0x174/0x580 [ 107.097927][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.097944][ T5827] [ 107.097949][ T5827] Freed by task 5826: [ 107.097958][ T5827] kasan_save_track+0x3e/0x80 [ 107.097976][ T5827] kasan_save_free_info+0x46/0x50 [ 107.098002][ T5827] __kasan_slab_free+0x5c/0x80 [ 107.098021][ T5827] kmem_cache_free+0x187/0x6c0 [ 107.098042][ T5827] eventpoll_release_file+0xc2/0x240 [ 107.098063][ T5827] __fput+0x83c/0xa70 [ 107.098082][ T5827] task_work_run+0x1d9/0x270 [ 107.098103][ T5827] exit_to_user_mode_loop+0x193/0x680 [ 107.098123][ T5827] do_syscall_64+0x353/0x580 [ 107.098149][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.098168][ T5827] [ 107.098172][ T5827] The buggy address belongs to the object at ffff888034ebc8e0 [ 107.098172][ T5827] which belongs to the cache ep_head of size 16 [ 107.098189][ T5827] The buggy address is located 8 bytes inside of [ 107.098189][ T5827] freed 16-byte region [ffff888034ebc8e0, ffff888034ebc8f0) [ 107.098210][ T5827] [ 107.098215][ T5827] The buggy address belongs to the physical page: [ 107.098227][ T5827] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034ebcb40 pfn:0x34ebc [ 107.098247][ T5827] memcg:ffff88802c5fd001 [ 107.098257][ T5827] flags: 0x80000000000200(workingset|node=0|zone=1) [ 107.098274][ T5827] page_type: f5(slab) [ 107.098293][ T5827] raw: 0080000000000200 ffff8880212d7dc0 ffff88801b757088 ffffea00006cfd50 [ 107.098313][ T5827] raw: ffff888034ebcb40 0000000800800035 00000000f5000000 ffff88802c5fd001 [ 107.098324][ T5827] page dumped because: kasan: bad access detected [ 107.098334][ T5827] page_owner tracks the page as allocated [ 107.098341][ T5827] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4988, tgid 4988 (udevd), ts 37579422711, free_ts 37555730946 [ 107.098377][ T5827] post_alloc_hook+0x1f9/0x250 [ 107.098399][ T5827] get_page_from_freelist+0x265c/0x26e0 [ 107.098425][ T5827] __alloc_frozen_pages_noprof+0x18d/0x380 [ 107.098452][ T5827] allocate_slab+0x74/0x5e0 [ 107.098480][ T5827] refill_objects+0x33c/0x3d0 [ 107.098507][ T5827] __pcs_replace_empty_main+0x373/0x720 [ 107.098537][ T5827] kmem_cache_alloc_noprof+0x433/0x680 [ 107.098557][ T5827] ep_insert+0x512/0x1820 [ 107.098576][ T5827] do_epoll_ctl_file+0x8bb/0xed0 [ 107.098600][ T5827] __se_sys_epoll_ctl+0x14e/0x210 [ 107.098626][ T5827] do_syscall_64+0x174/0x580 [ 107.098655][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.098675][ T5827] page last free pid 5026 tgid 5026 stack trace: [ 107.098686][ T5827] __free_frozen_pages+0x10af/0x1190 [ 107.098705][ T5827] __slab_free+0x252/0x2a0 [ 107.098725][ T5827] qlist_free_all+0x99/0x100 [ 107.098743][ T5827] kasan_quarantine_reduce+0x148/0x160 [ 107.098761][ T5827] __kasan_slab_alloc+0x22/0x80 [ 107.098780][ T5827] kmem_cache_alloc_noprof+0x33b/0x680 [ 107.098809][ T5827] do_getname+0x2e/0x250 [ 107.098826][ T5827] __x64_sys_execve+0x7a/0xc0 [ 107.098849][ T5827] do_syscall_64+0x174/0x580 [ 107.098874][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.098892][ T5827] [ 107.098897][ T5827] Memory state around the buggy address: [ 107.098909][ T5827] ffff888034ebc780: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 107.098923][ T5827] ffff888034ebc800: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 107.098936][ T5827] >ffff888034ebc880: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 107.098945][ T5827] ^ [ 107.098957][ T5827] ffff888034ebc900: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc [ 107.098969][ T5827] ffff888034ebc980: 00 00 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 107.098979][ T5827] ================================================================== [ 107.109908][ T5827] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 107.109931][ T5827] CPU: 1 UID: 0 PID: 5827 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 107.109956][ T5827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 107.109968][ T5827] Call Trace: [ 107.109976][ T5827] [ 107.109984][ T5827] vpanic+0x56c/0xa60 [ 107.110021][ T5827] ? __pfx_vpanic+0x10/0x10 [ 107.110048][ T5827] ? __pfx___schedule+0x10/0x10 [ 107.110077][ T5827] panic+0xc5/0xd0 [ 107.110103][ T5827] ? __pfx_panic+0x10/0x10 [ 107.110130][ T5827] ? preempt_schedule_thunk+0x16/0x40 [ 107.110164][ T5827] ? clear_tfile_check_list+0x114/0x380 [ 107.110191][ T5827] check_panic_on_warn+0x89/0xb0 [ 107.110214][ T5827] ? clear_tfile_check_list+0x114/0x380 [ 107.110241][ T5827] end_report+0x73/0x170 [ 107.110265][ T5827] ? clear_tfile_check_list+0x114/0x380 [ 107.110300][ T5827] kasan_report+0x128/0x150 [ 107.110325][ T5827] ? clear_tfile_check_list+0x114/0x380 [ 107.110355][ T5827] clear_tfile_check_list+0x114/0x380 [ 107.110383][ T5827] ? clear_tfile_check_list+0x22/0x380 [ 107.110411][ T5827] do_epoll_ctl_file+0x8fd/0xed0 [ 107.110437][ T5827] ? do_epoll_ctl_file+0xac3/0xed0 [ 107.110463][ T5827] ? __pfx_do_epoll_ctl_file+0x10/0x10 [ 107.110490][ T5827] ? __fget_files+0x3a6/0x420 [ 107.110512][ T5827] ? __fget_files+0x2a/0x420 [ 107.110537][ T5827] __se_sys_epoll_ctl+0x14e/0x210 [ 107.110564][ T5827] ? __pfx___se_sys_epoll_ctl+0x10/0x10 [ 107.110593][ T5827] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.110613][ T5827] do_syscall_64+0x174/0x580 [ 107.110642][ T5827] ? clear_bhb_loop+0x40/0x90 [ 107.110664][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.110684][ T5827] RIP: 0033:0x7fc0aa1dce59 [ 107.110701][ T5827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.110718][ T5827] RSP: 002b:00007fc0a842e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 107.110741][ T5827] RAX: ffffffffffffffda RBX: 00007fc0aa455fa0 RCX: 00007fc0aa1dce59 [ 107.110757][ T5827] RDX: 0000000000000003 RSI: 0000000000000001 RDI: 0000000000000007 [ 107.110769][ T5827] RBP: 00007fc0aa272d6f R08: 0000000000000000 R09: 0000000000000000 [ 107.110782][ T5827] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.110795][ T5827] R13: 00007fc0aa456038 R14: 00007fc0aa455fa0 R15: 00007ffe3e5d6ca8 [ 107.110816][ T5827] [ 107.110954][ T5827] Kernel Offset: disabled