last executing test programs: 5m58.246388161s ago: executing program 1 (id=700): ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010140}, {0x2, 0x0, @local}, {0x2, 0x4e24, @rand_addr=0x6}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) (async) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='fd\x00') (async) exit(0x4) fstat(r0, 0x0) (async) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) (async) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) (async) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) landlock_restrict_self(r2, 0xf) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000007c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="010000006b0300000100000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x48}}, 0x20000000) (async) syz_emit_ethernet(0x32, &(0x7f0000002180)={@multicast, @empty, @void, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @multicast1}, {{0x0, 0x22eb, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d8621b", 0x0, "2c17a9"}}}}}}, 0x0) 5m58.08629624s ago: executing program 1 (id=701): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000001000010400001f0000dcba3fdd59605d", @ANYRES32=r5, @ANYBLOB="31000200bf3f9f8008000a00", @ANYRES32=0x0, @ANYBLOB="34001280110001006272696467655f736c617665000000001c0005800500190003"], 0x5c}, 0x1, 0xc3ffffff, 0x0, 0x20040800}, 0x488c0) 5m57.996381369s ago: executing program 1 (id=703): pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80880) (async) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f0000000100)=0x3) (async) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xa8d, 0x156, 0x1, 0x2, 0xd59f80, 0x19f5, 0x4, 0x19ef, 0x40000003, 0x5, 0x27fd, 0x2800, 0x440, 0x3, 0xf, 0x7, {0xb, 0xffffffff}, 0xcd, 0x27}}) (async) write$P9_RFSYNC(r0, &(0x7f0000000180)={0x7, 0x33, 0x2}, 0x7) r2 = socket(0xa, 0x3, 0x3a) (async) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) (async, rerun: 64) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) (async) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r6, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) (async) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async, rerun: 64) r7 = getpid() (rerun: 64) process_vm_readv(r7, &(0x7f0000008400)=[{&(0x7f0000000000)=""/54, 0xfdb6}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) (async) prlimit64(r7, 0x5, &(0x7f00000001c0)={0x5, 0x3}, &(0x7f0000000200)) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f00000000c0)={0x0, 0x0, 0x3, r8, 0x230d}, 0xc) (async) setsockopt$MRT6_FLUSH(r2, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) (async) r9 = add_key$user(&(0x7f00000036c0), &(0x7f0000003700)={'syz', 0x0}, &(0x7f00000004c0)="c2", 0xf, 0xfffffffffffffffb) keyctl$setperm(0x5, r9, 0x1010) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001800000000000000000000089a9500000000000072397950000000095a81335586f1ba30e649b7298ba3424f2ae3558ba559c7f34e70f92ad153ec25e52d6a615db33113141045355bc31843f81903d115648e789e03c5d41ace589349849c5f67bd717236a571b20970e"], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xc}, 0x94) 5m57.886294355s ago: executing program 1 (id=704): r0 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x103000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') lchown(&(0x7f0000000240)='./file0\x00', 0xffffffffffffffff, 0xee01) flock(r0, 0x4) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f00000001c0)={"f2efe21e", 0x9, 0x6, 0x4e, 0x0, 0x1ff, "2179d46fd08e3c0ced34c7d0c7e6d7", "7ca24a13", '\x00\x00`\x00', '\x00', ["2408000ce61c0000c6cb00", '\x00', "d409343c60abd64f2fdc9ddf", "fc43009f621000"]}) ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000280)={0x7, 0x800, 0xf, 0x40000, 0x9, 0x5, "72a0a977db089b65fdfdc5bd97abc350", 0x78, 0x3, 0xa7, 0x7, 0xc, 0x7, 0x29}) mkdirat(0xffffffffffffffff, &(0x7f0000002040)='./file0\x00', 0x10) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x800, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x0, 0x2}, 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@userxattr}]}) chdir(&(0x7f00000003c0)='./bus\x00') ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r1}, './bus\x00'}) read$usbmon(r2, &(0x7f0000000440)=""/114, 0x72) quotactl$Q_GETFMT(0xffffffff80000402, &(0x7f0000000300)=@nbd={'/dev/nbd', 0x0}, 0x0, &(0x7f0000000540)) unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb72ff000) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x40, '\x00', 0x0, @fallback=0x30, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r3, &(0x7f0000000280)=ANY=[], 0x9) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x30, 0x9, @val=@target_btf_id=0xffffffffffffffff}, 0x14) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r3, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000020000000000000300000000040000004100"/50], 0x0, 0x32, 0x0, 0x1}, 0x28) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0/file0\x00'}) 5m57.25009113s ago: executing program 1 (id=709): bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000011"], 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000011000000010000000900010073797a30000000000900030073797a310000000070000000060a010400000000000000000100000008000b400000000048000480440001800b000100657874686472000034000280080001400000000c080003400000000008000440000000220500020007000000080006400000000308000540000000000900010073797a300000000020000000030a010300000000000000000a0000020900030073797a300000000044010000080a01080000000000000000010000073a00074032e97608c07b8f34d704cc507d07a8d4c429672a9b6841e516ce194f03354b3c46a930469ce36ee8391a02352a70d543c633dc17a9d300007900074012119f33dbd27dbba871f33b8206fc0a59dac6df96baf86f3feffa20b8a2b13fa2fbc917a33ad4b9dc903553ff1e7533cd9d1e3f6a3248b10a63552977fab38d9ad7409cbd223b094a0bb6f0884c8839890d122f9b9963668c97749b2304852a8d461ccc39dc307f41ac41688a4f2d64a916dc532d00000008000a40000000000900010073797a30000000000900020073797a31000000002c00058008000140000086dd080001400000002c080001400000001608000140000000736afd014000008100080009"], 0x248}}, 0x0) 5m56.618483627s ago: executing program 1 (id=710): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)={0x34, r3, 0x101, 0xfffffffd, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='n'}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0xf0}, 0x20004800) 5m56.477455176s ago: executing program 32 (id=710): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)={0x34, r3, 0x101, 0xfffffffd, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='n'}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0xf0}, 0x20004800) 5m11.569977081s ago: executing program 4 (id=1009): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x1000003, 0x8, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x400, 0x10001, 0x8, 0xac, 0x5, 0x401}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240040e0}, 0xc890) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller0\x00', @broadcast}) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000d000000a100010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 5m10.861417831s ago: executing program 4 (id=1012): r0 = syz_open_dev$video(0x0, 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000080)={0x9, @sdr}) openat$kvm(0xffffff9c, &(0x7f0000000000), 0x84200, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000340)={@cgroup, 0xffffffffffffffff, 0x24}, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x3, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000ffffffff0000dfb2e1da64df0000fe010000a100"/38], &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x46, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$inet6_int(r1, 0x29, 0x33, &(0x7f0000000240)=0xff, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fcntl$dupfd(0xffffffffffffffff, 0x2, 0xffffffffffffffff) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x8) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r3, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r4, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r4, 0x1000) r5 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) ioctl$HIDIOCGRAWPHYS(r5, 0x80404805, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) connect$qrtr(0xffffffffffffffff, &(0x7f0000000040), 0xc) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) fcntl$getown(0xffffffffffffffff, 0x9) 5m9.305868516s ago: executing program 4 (id=1018): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, 0x0) chdir(&(0x7f00000000c0)='./file1\x00') memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000ec0)={'batadv0\x00', 0x0}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYRES64, @ANYRES16=r4, @ANYBLOB="030300000000fcffffff0c00000008000300", @ANYRES32=r3, @ANYBLOB="8e2b68b452613d74a541fbcb3aaff82ca9c1c815f7b7390a648fab707cd54cc38b93871faa4248165bf3f2f85f0bfdb53f0670554f781bde5236f6f90bfa3e29ce43ff9944a315fa17"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsetxattr$system_posix_acl(r6, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000280)=ANY=[@ANYBLOB="020000000100000000000000040001000000000008000400", @ANYRES32, @ANYBLOB="10000700000000f7876d6051a4005849a5c3cb00fe78"], 0x2c, 0x2) syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x2, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000400000000000000080003851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff00000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xa}, 0x94) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) pipe2$watch_queue(&(0x7f0000000040), 0x80) add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) syz_open_dev$sndctrl(&(0x7f0000000300), 0x1, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) 5m8.968231846s ago: executing program 4 (id=1022): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc01cf509, &(0x7f0000000040)={0xffffffffffffffff, 0xaa, 0x68, 0x1000}) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000140)=0x4d1, 0x4) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x80000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) (async) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) (async) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc01cf509, &(0x7f0000000040)={0xffffffffffffffff, 0xaa, 0x68, 0x1000}) (async) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000140)=0x4d1, 0x4) (async) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x80000, 0x0) (async) 5m8.865623513s ago: executing program 4 (id=1024): ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000940)={{0x0, 0x2000, 0x0, 0x463}, 'syz0\x00', 0x4c}) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x20000000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe(&(0x7f0000000500)={0xffffffffffffffff}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r2, r3, 0xf3a, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="600000000206010800000000000000000100000a11000300686173683a69702c6d61726b00000000050001000700000005000500020000000900020073797a300000000005000400000000001400078008000840000000d308000b"], 0x60}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x28, 0x1c, 0x21, 0x0, 0x0, {0x7}, [@typed={0x5, 0x0, 0x0, 0x0, @str='\x00'}, @typed={0xa, 0x2, 0x0, 0x0, @str='w\xa9\xe2\x00\x00\x00'}]}, 0x28}}, 0x0) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x70bd27, 0x0, [@sadb_address={0x3, 0x6, 0x33, 0x0, 0x0, @in={0x2, 0x1000}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x5, 0xfc, 0xe0000001}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x8, 0x0, '4'}]}, 0x60}, 0x1, 0x7}, 0x0) 5m8.418900734s ago: executing program 4 (id=1028): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0xfffffff0, 0x0, 0x40000000}, 0x10) 5m7.428034831s ago: executing program 33 (id=1028): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0xfffffff0, 0x0, 0x40000000}, 0x10) 4m16.163001505s ago: executing program 5 (id=1389): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000040)={0x2}) close(0x3) read$FUSE(r0, &(0x7f0000005180)={0x2020}, 0x2020) 4m16.095301133s ago: executing program 5 (id=1390): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x4, 0x8, 0xc}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x2, &(0x7f00000004c0)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 4m16.094993132s ago: executing program 5 (id=1391): bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040f0401000604"], 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)) syz_emit_ethernet(0x22, &(0x7f00000000c0)=ANY=[], 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x180, 0x0) ioctl$SNDCTL_SYNTH_ID(r4, 0xc08c5114, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000010900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000050c0200000c0a01030000000000000000070000080900020073797a31000000000900010073797a3000000000e0010380dc010080080003400000000273000b802c0001800a0001006c696d69740000001c0002800c00014000000000000000030c000240000000000000000e14000180090001006c617374"], 0x290}}, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448ca, 0x0) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000001ff0), 0x10) syz_open_dev$ndb(0x0, 0x0, 0x8180) openat$sequencer2(0xffffff9c, &(0x7f0000000040), 0x89980, 0x0) syz_open_dev$dri(&(0x7f0000000280), 0x33f, 0x801) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x80000000}, {{0x18, 0x1, 0x1, 0x0, r7}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x20}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x19}}, [@snprintf={{0x5, 0x0, 0x7, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x90}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xf1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x9, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) 4m13.955168528s ago: executing program 5 (id=1400): r0 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e23, 0x8d, @empty, 0x4}, 0x1c) listen(r0, 0x50) syz_emit_ethernet(0x4f, &(0x7f0000000a80)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6c2d000000198401fa2441ce000000000700000000000002fe8000000000000000000000000000aaa5ba94e385673ccfd3fe184ab0643975bcc85fbf438632261b"], 0x0) 4m13.937491945s ago: executing program 5 (id=1401): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) close(r1) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) syz_usb_connect(0x5, 0x24, &(0x7f0000000c80)={{0x12, 0x1, 0x250, 0xe9, 0x97, 0x3f, 0x40, 0xc45, 0x800a, 0x5a9d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0x81, 0x90, 0x98, "", [{{0x9, 0x4, 0xf9, 0x7, 0x0, 0x6, 0xc2, 0x45, 0xe}}]}}]}}, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0}) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x2c, &(0x7f0000000040)=0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x2c, &(0x7f0000000000)={0x0, 0x0}, 0x10) sendmmsg(r3, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48815}, 0xc000) sendmsg$nl_xfrm(r6, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, 0x0) r7 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000b80)=@newqdisc={0x48, 0x14, 0xf0b, 0xfffffffe, 0x0, {0x2, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xfff1, 0x5}, {0x6, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x1ff}, @TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x3}, @TCA_FQ_QUANTUM={0x8, 0x3, 0x7}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x8000) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x100, 0x7, 0x2, 0x1000, 0xe, 0x5, 0x79, 0x3, 0x80008, 0x0, 0xffffffff, 0x1, 0x8, 0x1, 0x100, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x89, 0xca9f, 0xfffffffe, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0xa6b5, 0x0, 0xfffffff8]}) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r1, 0x390b9000) rseq(&(0x7f0000000280), 0x20, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x143b) 4m12.563779309s ago: executing program 5 (id=1411): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00') socket(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) (async) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000b80)=@delchain={0x34, 0x2e, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x6, 0x8}, {0x4, 0xffff}, {0x7, 0xd}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008051}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x5}, {0xfff1, 0xffff}, {0xfff2, 0x7}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) bind$unix(r7, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r7, 0x0) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)) (async) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)) close(0x3) (async) close(0x3) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001e00)=@deltfilter={0x34, 0x2d, 0x1, 0x78bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r6, {0xb, 0xfff2}, {0xfff2, 0xffff}, {0x0, 0xe}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x24004810) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001e00)=@deltfilter={0x34, 0x2d, 0x1, 0x78bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r6, {0xb, 0xfff2}, {0xfff2, 0xffff}, {0x0, 0xe}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x24004810) 3m57.513369315s ago: executing program 34 (id=1411): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00') socket(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) (async) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000b80)=@delchain={0x34, 0x2e, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x6, 0x8}, {0x4, 0xffff}, {0x7, 0xd}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008051}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x5}, {0xfff1, 0xffff}, {0xfff2, 0x7}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) bind$unix(r7, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r7, 0x0) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)) (async) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)) close(0x3) (async) close(0x3) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001e00)=@deltfilter={0x34, 0x2d, 0x1, 0x78bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r6, {0xb, 0xfff2}, {0xfff2, 0xffff}, {0x0, 0xe}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x24004810) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001e00)=@deltfilter={0x34, 0x2d, 0x1, 0x78bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r6, {0xb, 0xfff2}, {0xfff2, 0xffff}, {0x0, 0xe}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x24004810) 3m48.064706856s ago: executing program 2 (id=1524): chdir(&(0x7f0000000480)='./cgroup\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) listen(0xffffffffffffffff, 0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) r1 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000640)="f3", 0x1}, {&(0x7f0000000100)}], 0x2) 3m47.207732439s ago: executing program 2 (id=1525): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_PROPERTY(r0, 0x80106f53, &(0x7f00000001c0)={0x80003b, 0x0}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r3, &(0x7f0000000300)=ANY=[@ANYRESHEX], 0x10) write$P9_RGETATTR(r3, &(0x7f00000004c0)={0xa0, 0x19, 0x1, {0xc00, {0x1, 0x0, 0x5}, 0x58, 0xffffffffffffffff, 0x0, 0x100, 0x4, 0xfffffffffffffffe, 0x2, 0x8c6, 0x540b, 0x8, 0x9, 0xc, 0xf, 0x1, 0x8, 0x1, 0x6, 0x8}}, 0xa0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=[0x4], 0x0, 0x0, 0x1, 0x1}}, 0x40) socket$nl_xfrm(0x10, 0x3, 0x6) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdir(&(0x7f0000002000)='./file0/file0\x00', 0x180) r4 = socket$inet(0x2, 0x3, 0x8d) setsockopt$inet_msfilter(r4, 0x0, 0x8, &(0x7f0000000340)=ANY=[@ANYRES32], 0x1) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local, @local}, &(0x7f0000000140)=0xc) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={@rand_addr=' \x01\x00', 0x0, r5}) r6 = socket(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x4c, &(0x7f0000000000)=0x7, 0x4) ioctl(r6, 0x8916, &(0x7f0000000000)) ioctl(r6, 0x8936, &(0x7f0000000000)) read$FUSE(r1, &(0x7f0000000180)={0x2020}, 0x143b) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r1, 0xc0106441, &(0x7f0000000100)={0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_VM_GET_STATE(r1, 0xc0086444, &(0x7f00000021c0)={r7}) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000000)=""/244) 3m46.913147992s ago: executing program 2 (id=1528): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000100850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465cbf188ef10871b81ac7553358380b3a1f59916ffc9bf0bdf81524f07fb2819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6cd87cef9000000a39c15a7ef365cc27dfeac7b9b0e9048517354b0ca4f9cf8b59ee6fa003fe1f2c4c15f20a07db4583a462d8be6602186fd68ee14a19ea2eb42122b8635a66ce6b5b92356081bc0f18a0ca83dbc089a9813c1efa26001b3f486ebfaae85c4d0b96778478ae5355e6f923b11056969f486f80a35f7f2339704fa93fa915ab8e1e0d7f31ebd19455e6827cd493907bf9d0000000000000000000000004e1fa60acabcf0553910ca2e5ea499fd5889dde9261f0848a5b8af657bfc96049308e8953431b269053627a1523551c160c813969925a892d266792352ec0204596a37ce8d6d260b32239bddbce2e79f93cb5a0ad897adb53b397d07c50f84b74f2605a565ee149016aa75ea31c0087dcd821b47c8b36efc6da4fb2ea7f1f36c85856b73ac9872babc62149699b6b8c796a79d833eb4b5ca668d430db5653a2b3c5b87e17ca1"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x18000000000002a0, 0x2f9, 0xffffca88, &(0x7f0000000040)="b90103600040f000009e0ff008001fffffe100004000632f77fb7f0200017f020001be3e7d2a182fff", 0x0, 0x104, 0x6000000000000000, 0xfd, 0xfeb9, &(0x7f0000000400)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea01f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab305387aa348566d688edd291a3e9d08952adbdf60462bb7f7faebcdfccf17115708b0d73d0f3a469ce7d8374219b3f92c92bcec4958d474bb281c26691949d054b784a5866f081e53eb9cfd7"}, 0x28) 3m46.744205306s ago: executing program 2 (id=1530): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'netdevsim0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4400000010000305a10000000000100000009ad3", @ANYRES32=0x0, @ANYBLOB="01000500000000001c0012800b0001006d616373656300000c00028005000f000200000008000500", @ANYRES32=r1], 0x44}}, 0x40000) 3m46.503182306s ago: executing program 2 (id=1531): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="180800000000000000ff00000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100000000009500000000000000b7020000000000007b9af8ff00000000b509020000000000dbaaf8fff1000000bf8200000000000007080000f8ffffffbfa420000000000007090000f0ffffffc70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f1ff76000000af9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3m46.492457575s ago: executing program 2 (id=1532): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_TYPE={0x8}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x74}}, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000040)={0x0, 0x9, 0x0, 0x4}) r2 = syz_open_dev$evdev(&(0x7f0000001380), 0x1, 0x20442) r3 = epoll_create1(0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r4, 0xfffffffffffffffd, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r4, 0x7a5, &(0x7f0000000080)={{@local, 0x6}, 0x1, 0x0, 0x6}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1ba20, 0x40a38}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x4c}}, 0x8000002) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r3) mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESDEC=r7]) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x403, 0x70bd28, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINK_NETNSID={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x8044) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r2, &(0x7f0000000100)={0x9}) r10 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000017f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c0001000b080c00bdad01409bbc7a46e39a8285dcdf12176679df069163ce947ee2b49e33538afaeb2713f450ebd010a20ff27fff0000000000000000", 0x89}], 0x1}, 0xff0f000000000000) ioctl$EVIOCGMTSLOTS(r2, 0x8040450a, &(0x7f0000000000)=""/43) 3m31.438578407s ago: executing program 35 (id=1532): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_TYPE={0x8}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x74}}, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000040)={0x0, 0x9, 0x0, 0x4}) r2 = syz_open_dev$evdev(&(0x7f0000001380), 0x1, 0x20442) r3 = epoll_create1(0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r4, 0xfffffffffffffffd, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r4, 0x7a5, &(0x7f0000000080)={{@local, 0x6}, 0x1, 0x0, 0x6}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1ba20, 0x40a38}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x4c}}, 0x8000002) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r3) mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESDEC=r7]) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x403, 0x70bd28, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINK_NETNSID={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x8044) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r2, &(0x7f0000000100)={0x9}) r10 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000017f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c0001000b080c00bdad01409bbc7a46e39a8285dcdf12176679df069163ce947ee2b49e33538afaeb2713f450ebd010a20ff27fff0000000000000000", 0x89}], 0x1}, 0xff0f000000000000) ioctl$EVIOCGMTSLOTS(r2, 0x8040450a, &(0x7f0000000000)=""/43) 1m55.976601635s ago: executing program 7 (id=1964): r0 = socket(0x8, 0x80000, 0x7) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x8) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x5}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r1, 0x58, &(0x7f0000000100)}, 0x10) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r1, 0x6628) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r0) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r3, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4048084) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000340), r2) sendmsg$SEG6_CMD_SETHMAC(r2, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x40, r4, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@SEG6_ATTR_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x37}}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0xcfa}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRETLEN={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000c040}, 0xc000010) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480), r0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x20, r5, 0x8, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x8000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e20, @private=0xa010102}, @in={0x2, 0x4e22, @multicast2}], 0x20) r6 = openat$pfkey(0xffffff9c, &(0x7f00000005c0), 0x127100, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r6, 0xc01c5868, &(0x7f0000000700)={r0, &(0x7f0000000600)='\x00', 0x8000, &(0x7f0000000640)={@align=0x8ae8, {0x3, 0x775e, 0x3, 0x3}}, 0x9, &(0x7f0000000680), &(0x7f00000006c0)=0x3}) getsockopt(r7, 0x14, 0x5, &(0x7f0000000740)=""/29, &(0x7f0000000780)=0x1d) r8 = syz_open_dev$sndpcmc(&(0x7f00000007c0), 0xf7, 0x20400) ioctl$SNDRV_PCM_IOCTL_DROP(r8, 0x4143, 0x0) socket$netlink(0x10, 0x3, 0x13) fchmod(r8, 0xec) r9 = syz_open_procfs$pagemap(0x0, &(0x7f0000000800)) ioctl$PAGEMAP_SCAN(r9, 0xc0606610, &(0x7f0000000900)={0x60, 0x0, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x6, &(0x7f0000000840)=[{0x8, 0x5f2, 0x7}, {0x0, 0x7fff, 0xd5e}, {0x8, 0xd, 0x2}, {0xce, 0x4, 0x3}, {0xd6, 0xd, 0x4}, {0x1, 0x1, 0x1}, {0x6, 0x7ff, 0x7}], 0x7, 0x5, 0x40, 0x10, 0x74, 0x2}) sigaltstack(&(0x7f0000000a80)={&(0x7f0000000980)=""/244, 0x80000001, 0xf4}, &(0x7f0000001ac0)={&(0x7f0000000ac0)=""/4096, 0x0, 0x1000}) read$FUSE(r6, &(0x7f0000001b00)={0x2020}, 0x2020) setsockopt$MRT6_DONE(r0, 0x29, 0xc9, 0x0, 0x0) r10 = openat$sysfs(0xffffff9c, &(0x7f0000003b40)='/sys/power/resume', 0x101002, 0x100) ioctl$USBDEVFS_CLAIM_PORT(r10, 0x80045518, &(0x7f0000003b80)=0x1) close(r2) sendto$packet(r0, &(0x7f0000003bc0)="093082a5d7caee541dfddeb5ae61f7406926a0d5aa4d6182b4a4f5af331dd17d705817a386e54dafc95e0fda87e7e3e9ffa3688788ef11e0874f55a411a73029f45cc98552b71f94d17d07cca71b5e2864a5b2f9f6eeafb685ec16819a93aaca89c4737d58394a3e4716cd2957582d34a689f866ba3dc9f5b920094e315113b366115b9ea6a4dc7166dbfbe66f6008e4a055a64df9e19eab4370bf2f7ca36de6c6695c2369d8e9591b5a871f89364f11ae8c58ee427002e0efdae1628d3a966191c664d142cb162d", 0xc8, 0x40004, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 1m54.888714829s ago: executing program 7 (id=1965): r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000680)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) setresuid(0x0, 0xee01, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_io_uring_setup(0x38, &(0x7f0000000140)={0x0, 0x1d30, 0x13500}, &(0x7f0000000240), &(0x7f0000000480), &(0x7f0000000000)) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x21, &(0x7f0000000440), 0x1) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(0xffffffffffffffff, 0x7a9, &(0x7f0000000000)={{@local, 0x4068}, 0x7fff, 0x3, 0x1, 0x8, 0x6, 0x400, 0x0, 0x7}) r2 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40088a01, &(0x7f0000000140)) (async) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_io_uring_setup(0xd02, &(0x7f0000002900)={0x0, 0x10f24e, 0x0, 0x1, 0x290}, &(0x7f0000000440)=0x0, &(0x7f0000001080)=0x0, &(0x7f0000001040)) syz_io_uring_modify_offsets$generic(r6, r7, 0x2c, 0x10021) (async) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) (async) io_uring_enter(r5, 0x1, 0x20, 0x1, 0x0, 0x0) io_uring_enter(r5, 0x6516, 0x6d93, 0x8, 0x0, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r8, 0x4048aecb, &(0x7f0000000580)={0x6, 0x0, [{0x40000000, 0x5, 0x0, 0x7fff, 0x27, 0x7, 0x5}, {0x4, 0x8, 0x5, 0x2, 0xbb69, 0x805, 0xffff}, {0xb, 0xf5f, 0x0, 0x7, 0x0, 0x6, 0x7ffffffd}, {0x1, 0x2bb, 0x1, 0xd, 0x3, 0x62, 0x400}, {0x2, 0x1, 0x5, 0x9, 0x4, 0x4, 0x3}, {0x1, 0x8d3d, 0x6, 0x9, 0x3ff, 0x1, 0x3}]}) 1m54.179274513s ago: executing program 7 (id=1966): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000120000000000070000000900010073797a300000000084000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000838001180090001006c61737400000000280002800c00024000000000000000090800014000000ba308000140000010000800014000003f5e980000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000006c0003806800008008000340000000025c0002800c00028008000340000000024c000280080003400000000408000180fffffffd0800f1d7fffffffd0800034000000003090002"], 0x164}, 0x1, 0x0, 0x0, 0x4000819}, 0x0) 1m53.812666832s ago: executing program 7 (id=1967): socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mount(&(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000400)='.\x00', &(0x7f0000000300)='msdos\x00', 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000380)}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0) close(r2) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x10400, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0x200000}}, 0x50) syz_fuse_handle_req(r3, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x0, 0x88}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) lseek(r5, 0x8000000000000001, 0x3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8b26, &(0x7f0000000140)={'wlan1\x00', @random="000000020600"}) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200), 0x0, 0x0, 0x1) r6 = open(&(0x7f00000000c0)='./file0\x00', 0x80342, 0x4) sendfile(r6, r6, &(0x7f0000000080), 0x7f03) r7 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CLEAR_HALT(r7, 0x80045503, &(0x7f0000000340)={0x1, 0x1}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000080), 0x208e24b) 1m47.005509214s ago: executing program 7 (id=1978): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0x38, &(0x7f0000000140)={0x0, 0x1d30, 0x13500}, &(0x7f0000000240), &(0x7f0000000480), &(0x7f0000000000)) (async) r1 = syz_io_uring_setup(0x38, &(0x7f0000000140)={0x0, 0x1d30, 0x13500}, &(0x7f0000000240), &(0x7f0000000480), &(0x7f0000000000)) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000c40), 0x2) r3 = ioctl$UDMABUF_CREATE_LIST(r2, 0x40087543, &(0x7f0000000c80)={0x1, 0x1, [{0xffffffffffffffff, 0x0, 0x1000, 0x1000000000000}]}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x21, &(0x7f0000000440), 0x1) (async) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r1, 0x21, &(0x7f0000000440), 0x1) syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) (async) syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) (async) r4 = socket$unix(0x1, 0x5, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$dir(0xffffff9c, &(0x7f0000000100)='./file0\x00', 0x210082, 0x40) r8 = syz_create_resource$binfmt(&(0x7f00000001c0)='./file0\x00') execveat$binfmt(r7, r8, &(0x7f0000000540)={[&(0x7f0000000240)='-][*)-\x00', &(0x7f0000000280)='mqprio\x00', &(0x7f00000002c0)='veth0_macvtap\x00', &(0x7f00000003c0)='ethtool\x00', &(0x7f0000000400)='\x00', &(0x7f0000000440)='mqprio\x00', &(0x7f00000004c0)='ethtool\x00', &(0x7f0000000500)='veth0_macvtap\x00']}, &(0x7f0000000640)={[&(0x7f00000005c0)='/dev/kvm\x00', &(0x7f0000000600)='ethtool\x00']}, 0x80) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async) r9 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000480)={0x1, 0x0, [{0x40000102, 0x0, 0xbf}]}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c000000020605000000000000000000000000000c00078005001500267d00000500010007000000050005000a000000050004"], 0x5c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}]}}}]}]}], {0x14}}, 0xd4}}, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) socket(0x10, 0x3, 0x0) (async) r13 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x11e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0xe8, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x15}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x18, "9595f429ae08a565c9a41d416c70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c"}]}}}}}}, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x2000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socket(0x400000000010, 0x3, 0x0) (async) r14 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r14, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r12, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x10) socket$netlink(0x10, 0x3, 0xa) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r3}}, './file0\x00'}) connect$unix(r15, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) 1m45.476819918s ago: executing program 7 (id=1982): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffff}, 0x94) 1m45.286449337s ago: executing program 36 (id=1982): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffff}, 0x94) 1m35.152415927s ago: executing program 0 (id=2011): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x1200, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x30, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb4}}, 0x0) 1m35.133284964s ago: executing program 0 (id=2012): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x0, 0x18000000}, [@ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0xffe4, 0x50}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195}, 0x48) 1m35.02223398s ago: executing program 0 (id=2014): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x20010, r0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ftruncate(r0, 0x5) 1m34.327392468s ago: executing program 0 (id=2016): openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r0 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg/0:0:0:0\x00', 0x460041, 0x0) ioctl$BSG_EMULATED_HOST(r0, 0x2203, &(0x7f00000000c0)) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000040)={0x2000000000000000, 0x1, 0xe59d, 0xf, 0x1a}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f00000008c0)={'ip6gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, @empty, @empty, 0x700, 0x20}}) mlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, 0x0) openat$vimc2(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) 1m34.325149855s ago: executing program 0 (id=2017): socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, &(0x7f0000000340), 0x11000) pipe(0x0) close(0xffffffffffffffff) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x480, 0x0) r1 = getpid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(r1, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x7ffe, 0x0, 0x9, 0xffffffff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) gettid() r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r4) sendmsg$NFC_CMD_LLC_SET_PARAMS(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002dbd7400fedbdf250700e1000800010058"], 0x2c}, 0x1, 0x0, 0x0, 0x40810}, 0x40000080) r6 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r6, 0x4610, &(0x7f00000000c0)={0x2, 0xfffffffc}) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000002500)=@raw={'raw\x00', 0x3c1, 0x3, 0x5f0, 0x3b8, 0xffffff80, 0x178, 0x0, 0x178, 0x520, 0x22b, 0x258, 0x520, 0x258, 0x2034, 0x0, {[{{@uncond, 0x1d, 0x398, 0x3b8, 0x340, {0x1e0002a8, 0x7203000000000000}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1a, 0x64, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x8000}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xa}, {}, {}, {0xfffc}]}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "e22e50439abb066265e088a63e13552b8b2fec412753ac647d17d2ebca69d17a9722bd2f5be411676d5993fb4cc74168209fb9f43b63bab2a88206d7dd8158d916b865d0f713f772c59ad6e6b572e9a6c498fb6459888a281e8c071a9a7229f9fe02cb8e9ba7637a2591a5367c770c87034734be6eda195ce135517efa85da52", 0x1}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x100, 0x168, 0x0, {}, [@common=@ah={{0x30}, {[], 0x0, 0x1}}, @common=@ipv6header={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x12, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r7 = socket(0x10, 0x2, 0x0) write(r7, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r7, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') read$FUSE(r8, &(0x7f00000007c0)={0x2020}, 0x2020) sendmsg$nl_route_sched(r8, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000480)=@deltaction={0x170, 0x31, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}, @TCA_ACT_TAB={0x6c, 0x1, [{0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffc}}, {0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x14, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0x10, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}, @TCA_ACT_TAB={0x50, 0x1, [{0x10, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe19}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xde}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}, @TCA_ACT_TAB={0x60, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xc}}, {0x14, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xbb88}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3ff}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x185}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2d}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}]}, 0x170}, 0x1, 0x0, 0x0, 0x8bdc6132b197f0b6}, 0x40040) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000003c0)={'pcl818\x00', [0x4f23, 0x2, 0xfffffffd, 0x4000, 0x7, 0x5, 0x8, 0xd287, 0xa, 0xfd, 0xffeffffa, 0x23, 0x4, 0x1, 0x6, 0x101, 0xf7fffffe, 0x1ff, 0x2, 0x0, 0x10000008, 0x927, 0xeb96, 0x8401, 0x40f, 0xe69, 0x4, 0x10008, 0x3, 0x1cdc, 0xfbfffff8]}) 1m33.90228387s ago: executing program 0 (id=2020): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) request_key(0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x802, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newlink={0x74, 0x10, 0x403, 0x2, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x54, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x44, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc, 0x1f, 0x1}, @IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6, 0x27, 0xe}, @IFLA_BR_VLAN_STATS_ENABLED={0x5}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x101}, @IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0xa0}, @IFLA_BR_MCAST_HASH_MAX={0x8, 0x1b, 0xfffffffb}]}}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x8044) socket$inet_smc(0x2b, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r5 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,use', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) (async) read$FUSE(0xffffffffffffffff, &(0x7f000000c3c0)={0x2020, 0x0, 0x0}, 0x1c84) write$FUSE_INIT(r5, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x0, 0x10400, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4}}, 0x50) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) 1m33.735759442s ago: executing program 37 (id=2020): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) request_key(0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x802, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newlink={0x74, 0x10, 0x403, 0x2, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x54, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x44, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc, 0x1f, 0x1}, @IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6, 0x27, 0xe}, @IFLA_BR_VLAN_STATS_ENABLED={0x5}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x101}, @IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0xa0}, @IFLA_BR_MCAST_HASH_MAX={0x8, 0x1b, 0xfffffffb}]}}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x8044) socket$inet_smc(0x2b, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r5 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,use', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) (async) read$FUSE(0xffffffffffffffff, &(0x7f000000c3c0)={0x2020, 0x0, 0x0}, 0x1c84) write$FUSE_INIT(r5, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x0, 0x10400, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4}}, 0x50) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) 9.569134418s ago: executing program 3 (id=2373): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit$UBLK(r2, r3, r4, &(0x7f0000001a00)=@ublk_io_need_get_data_sqe={0x2e, 0x60, 0x0, 0xffffffffffffffff, 0xc0107522, 0x0, 0x0, 0x0, 0x1e0303d7fa4e9fa1, {0x7}, 0x0, 0x0, '\x00', {0x2, 0x15d, 0x3, 0x0}}) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000980)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) io_uring_enter(r1, 0x788b, 0x84b, 0x68, 0x0, 0x0) 9.094445836s ago: executing program 3 (id=2377): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x6000, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x30, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb4}}, 0x0) 9.010810526s ago: executing program 3 (id=2379): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt(r0, 0x84, 0x19, &(0x7f00000002c0)="1a00000002000000", 0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000024c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000038000000030a01040000000000000000010000010900030073797a32000000000c00024000000000000000010900010073797a30"], 0x7904}, 0x1, 0x0, 0x0, 0x4040}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newtaction={0x150, 0x30, 0x1, 0x0, 0x0, {}, [{0x13c, 0x1, [@m_ct={0x100, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0xc0, 0x6, "9d3284a8d800d31f14efeed6ca51056cdf29ba54012510187125a88afb5f6de56562f7fb34be9180c9e6d99cb4db20cec7af0abc12ef3fc689b388f8b6c5dfb1f629840f64f1e9f551f5100856086ab2b911cf64e54534309e4ab4de8b114e7c83dcf92c5090c8a4cb2241518894f2cc5306a4b3117bdd1920d51c88a0d99696b20a6aee50b3c611eb69d3b820d7e17f417bd550bc96cb1136efcac13807bca7ed724eb6607ffe62ea772e836f8455120cd6b01417ff0e0000000000"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x38, 0x1, 0x0, 0x0, {{0x8}, {0x10, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @multicast}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x150}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) gettid() getpid() r3 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffe]}, 0x8) read(r3, &(0x7f0000000740)=""/384, 0x200008c0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) close(0xffffffffffffffff) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000180), 0x10) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) 7.675742639s ago: executing program 6 (id=2389): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x0, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x800, 0x1, 0x0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x1, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x600000, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000340)=0x22) 7.33872623s ago: executing program 6 (id=2390): r0 = socket$nl_generic(0x10, 0x3, 0x10) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x108}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x34, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r10, {0xa, 0xffff}, {}, {0x8, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004c800}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000b00)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0xffff, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c0}, 0x44840) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x867, &(0x7f0000000140)={0x0, 0x9164, 0x1000, 0x1, 0x359}, &(0x7f00000002c0), &(0x7f0000ff4000), 0x0) syz_clone(0x500, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000040000100fcff0700040000000100000004004880200001801c00108018000b8008000100ac1414bb00003300060000000000000008000200", @ANYRES32=r0, @ANYBLOB="b68ddbe61cca13ef7772ea6670cb5fc25d31ecc18058e7698a7b8f77abb498436a5c6a1603a09ff843adebc1e2c36b726bb929ec5aeb4eb36fa9691db828d6ec3fbba57536c060c7b75538b25e8a308ee840e50f3a625ea3cd5c45ccf8f980d6b1660383f1fe056bca4980c92a5890986b240a25b2266d7eca236713a785bb3581ca6328e77e566d375c92243028ab5b1761ee7fee"], 0x40}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 7.104449845s ago: executing program 3 (id=2391): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002040)=ANY=[@ANYBLOB='@\r\x00\x00', @ANYRES16=r1, @ANYBLOB="05000000000000000000010000000600060000000000c40c0880e400008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b24000100000000000000000000000000000000000000000000000000000000000000000024000200fcbefe9641719404cc5c9ab2766dd4793e367b0ea55e65e2e3416ac9d4e68841240002001171ee8da334a5099295af229a5d237a7f4102f01f28b34347d6cbbe135d83ec24000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c0800030000000000240002005da952055e5857d673cddd36909746c80efa3ff95c317de1063db32bc80a0b3e0003008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0600050000000000d002098058000080060001000200000008000200ac1e00010500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ffffffff05000300000000007c000080060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200000000000500030000000000dc000080060001000a0000001400020000000000000000000000ffffac1414aa05000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200000000000500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fc0100000000000000000000000000000500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1e0001050003000000000094000080060001000a00000014000200fc0200000000000000000000000000000500030000000000060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000200000008000200e00000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000200000008000200ffffffff050003000000000088000080060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200ff020000000000000000000000000001050003000000000064000080080003000000000008000a000100000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000200379aa288b2244a5b504ba04bea45625d328fb93b62e607a1b2e4da2f7f76a5499400008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c080003000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002000000000000000000000000000000d807008000030980f4000080060001000a00000014000200000000000000000000000000000000000500030000000000060001000a00000014000200fc0000000000000000000000000000000500030000000000060001000200000008000200ffffffff0500030000000000060001000200000008000200ac1e00010500030000000000060001000200000008000200e000000105000300000000000600010002000000080002007f0000010500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000a00000014000200fc01000000000000000000000000000005000300000000004c000080060001000200000008000200ac1414bb0500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414bb05000300000000000c010080060001000a00000014000200200100000000000000000000000000010500030000000000060001000200000008000200e000000205000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ffffffff0500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fc0100000000000000000000000000000500030000000000940000800600010002000000080002000000000005000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200e00000020500030000000000060001000200000008000200ac1414000500030000000000060001000200000008000200ac14140005000300000000001c000080060001000200000008000200ffffffff0500030000000000080003000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39221d0004000a0000000000000000000000000000000000ffffac1e0001000000001c04098094000080060001000a0000001400020000000000000000000000ffffac1414bb0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000a00000014000200fe880000000000000000000000000001050003000000000064000080060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414bb0500030000000000060001000a0000001400020000000000000000000000ffffe00000020500030000000000ac000080060001000200000008000200000000000500030000000000060001000a00000014000200fe80000000000000000000000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200e0000001050003000000000064000080060001000a00000014000200fc0100000000000000000000000000000500030000000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414000500030000000000f4000080060001000200000008000200000000000500030000000000060001000a00000014000200200100000000000000000000000000000500030000000000060001000a00000014000200fc0200000000000000000000000000000500030000000000060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac1414aa0500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414000500030000000000060001000a00000014000200200100000000000000000000000000020500030000000000a0000080060001000a00000014000200fc0000000000000000000000000000000500030000000000060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac14140005000300000000007c000080060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8000000000000000000000000000000500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe8000000000000000000000000000bb050003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b2400020055fbc2635cc801d67c589cc98f3cf65074dffe0886750dec83be49fbf628e1dc240002000f1b8b82264208ab1a2dce776c03b9f348f500ef8e7606466943f5ba2ae2881e0c0000800800030000000000060006000000000008000100", @ANYRES32, @ANYBLOB="24000300000000000000000000000000000000000000000000000000000000000000000024000300a05ca84f6c9c8e3853e2fd7a7cae0fb20fa152600cb00845174f08076f8d7843080007"], 0xd40}, 0x1, 0x0, 0x0, 0x30000}, 0x0) 7.006387299s ago: executing program 3 (id=2392): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x12, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000009feffff720a00fef8ffffff71a400fe0000000071101000000000001d410200000000004704000001ed030407000000c00000001d440000000000006b0a00fe000000007203"], 0x0}, 0x94) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c00000010000304000000001f00000000000000", @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350064756d6d79300000000000000000000008000a00", @ANYRES32=r2], 0x3c}}, 0x8000) 6.851355721s ago: executing program 3 (id=2394): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b400000000000000791050000000000062000a000000000095000000000000009e574bffff1729aba9b39a58e3cd8757e44cf3611b8e327a0279acba1f7791408d1efa421239728e2e5cc319b58520609dfd4a1a021d000000000000efffff75c3d894d99aef659f8b0000c515d8c219fbd9da31fc3ce3e9a2653000aec385a84a3d3f466bba30ac1486a70037fb03adef1a427fb0f4cb3072182da7c30000000000000000000000000000000000000000000000000000297e9fed660213ecb576987ad0972f18fbb7c9ecc03901f028b15b30ecf3205f90c9684ddc80d13bf37afc00e5efd686e6fb5ef4ee00b66126f773434a5c0d2ad3526bc484a6b94396117615f78f97637d8f8838aa75efb657ddafb15b88d97e47731cc3f55ce4e6a42562e6fb1f0000003030249c350044b09c36d10549a5949ff21418f1517508fb13540a82b5030cd9bb1bb066ca833c1fef6cefa28543ee520e46a3e96aca0d5a5f8cb34ad9c54c3a9a698f835bb83bcfd81ac5cfa18ce0740717994b5152cd0fa735433e50dccee16a208245b4366d44bb7ebd169b9e3a66d0cb29291a50f642ae4cb007540c806cd1cf88fdcaa393d1e1a697649401a802b474e374c767cb1ce52fd917d6af3de547be8429540de37f868a7f25d47c4b710836436008d4e8c8b42aeee84629d06d75ef09e0260b41de1f750480e492b6822d6275b7ccda1141707069cdb21de7a98dc37efdd806cc3619ad0659998bdd90b008c1aed04ee682b8ffd25741abbd9c6482ca45b82b6b7f25f71280cd6ba8bbb1e32dfe84831d1fc132755ce9aaf1952cb6829e9d6f4cbd8a07dc0cebcad512b3e0f2daa622bc805d2e152e0765b20cd6c8e2f4fff81e1458a43f35d36b25225dc0fbaf3b8131f5a8ae73e8badc519350edf048d5f56617"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) 5.658993026s ago: executing program 6 (id=2401): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x6) r1 = openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f0000000000)='\x00\x00\x00\x00\x00\x00', 0x6) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000240)={0x0, 0x2}, 0x8) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000040)={0x0, 0x2}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_rdma(0x10, 0x3, 0x14) r4 = syz_io_uring_setup(0xf00, &(0x7f0000000080)={0x0, 0xeadf, 0x2, 0x0, 0x161, 0x0, 0x0}, &(0x7f0000000100), &(0x7f00000001c0), &(0x7f0000000180)) r5 = socket$netlink(0x10, 0x3, 0x15) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev={0xac, 0x14, 0x14, 0x1b}, 0x0, 0x0, 'dh\x00'}, 0x2c) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) io_uring_enter(r4, 0xeed, 0xeed, 0x1, 0x0, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/kernel/kexec_crash_size', 0x202, 0x0) sendfile(r4, r6, 0x0, 0x6) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000340)=@req={0xfff, 0xe, 0x4, 0x9}, 0x10) r7 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) writev(r7, &(0x7f00000000c0), 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r8, &(0x7f0000000080)={0xa, 0x4e22, 0x1, @empty}, 0x1c) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="66b71455d9e0010829d00eea322b12256a595d64b3a5c9ae08bc002576b81b03ccf6a9fd80aac7b03957f8a090158894730f2c1bf160d7d4210e676aa21d1ae2c3f6620500"/88], 0x28}, 0x1, 0x0, 0x0, 0x4048815}, 0xc000) 4.090636531s ago: executing program 6 (id=2404): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@ipv6_newroute={0x2c, 0x18, 0x0, 0x70bd2d, 0x25dfdbff, {0xa, 0x10, 0x0, 0x2, 0xfc, 0x2, 0xff, 0x1, 0x2100}, [@RTA_MARK={0x8}, @RTA_UID={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0xc080) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x900, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="5c0000000a0601080000000000000000070000000900020073797a31000000000500010007001f0e340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x4c040) ioctl$CDROMPLAYTRKIND(r1, 0x5304, &(0x7f0000000080)={0x8, 0x8, 0xaa, 0x6}) 3.529196545s ago: executing program 9 (id=2412): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7c, 0x7c, 0x2, [@var, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}]}, @func, @volatile, @volatile, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x96}, 0x20) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="180000002000000000000000000100009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x5, 0xe2, &(0x7f00000002c0)=""/226, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x2}, 0x80) 3.420640261s ago: executing program 9 (id=2413): connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x0, 0x4815) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, &(0x7f0000000600)={0xffffffffffffffff, r0, 0xff}) syz_open_dev$dmmidi(0x0, 0xfff, 0x42040) unshare(0x6a040000) socketpair$unix(0x1, 0x7, 0x0, 0x0) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), 0x0) openat$sr(0xffffffffffffff9c, &(0x7f00000001c0), 0x40802, 0x0) syz_open_dev$mouse(0x0, 0x6, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r2 = shmget$private(0x0, 0x800000, 0x0, &(0x7f0000173000/0x800000)=nil) shmctl$SHM_LOCK(r2, 0xb) shmctl$SHM_UNLOCK(r2, 0xc) shmat(r2, &(0x7f0000ff9000/0x4000)=nil, 0x3800) unshare(0x24020400) r3 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r3, 0xda8d) accept4$inet(r3, 0x0, 0x0, 0x800) syz_open_dev$dvb_frontend(0x0, 0x101, 0xa0580) 1.846329643s ago: executing program 6 (id=2417): r0 = socket$kcm(0x10, 0x2, 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xb, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0185648, &(0x7f0000000100)={0x0, 0x400, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90b, 0x6, '\x00', @value64=0x4ad}}) r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ef, 0x100, 0x1, 0x11}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) r6 = memfd_secret(0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd=r6, 0x8, 0x0, 0x0, 0x14}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000140)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0x41}], 0x2) r8 = gettid() r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2400000020000103000000000000ed00020000040000000012000000081238f92f74a0230fb9db2509a2a324ffb77f6b588989b40727c1e848795a3590be7ed19aae5a3d8fc073e962264b352dfa9a56e12b2a09edbffdd7cffd43e4a3c41d210436b431a4995ecd379e44013d14b472"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000000000)=0x0) timer_settime(r10, 0x0, &(0x7f0000000280)={{}, {0x77359400}}, 0x0) r11 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x3, 0x40483) ioctl$VIDIOC_DQEVENT(r11, 0x80885659, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000f01fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) socket$netlink(0x10, 0x3, 0x0) r12 = socket$alg(0x26, 0x5, 0x0) bind$alg(r12, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r12, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r13 = accept4(r12, 0x0, 0x0, 0x80800) sendmmsg$alg(r13, &(0x7f0000002700)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}], 0x1, 0x40800) recvmsg(r13, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 1.430044343s ago: executing program 8 (id=2418): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'netdevsim0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4400000010000305a10000000000100000009ad3", @ANYRES32=0x0, @ANYBLOB="01000000060000001c0012800b0001006d616373656300000c00028005000f000200000008000500", @ANYRES32=r1], 0x44}}, 0x40000) 1.240429933s ago: executing program 8 (id=2419): socket(0x10, 0x3, 0x0) (async) r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'dummy0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0xd0f, 0x470bd30, 0x25dfdbff, {0x60, 0x0, 0x0, r2, {0x0, 0xfff2}, {0xfff1, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_ingress={0xc}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x44080) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x4000) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x44}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x1c, &(0x7f0000000400)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xcd9}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0xfffffffe}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000380)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.088036482s ago: executing program 8 (id=2420): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x70bd27, 0x0, [@sadb_address={0x3, 0x6, 0x33, 0x0, 0x0, @in={0x2, 0x1000}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x5, 0xfc, 0xe0000001}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x8, 0x0, '4'}]}, 0x60}, 0x1, 0x7}, 0x500) 971.473848ms ago: executing program 8 (id=2421): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000006000000000070000000900010073797a300000000084000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000838001180090001006c61737400000000280002800c00024000000000000000090800014000000ba308000140000010000800014000003f5e980000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000006c0003806800008008000340000000025c0002800c00028008000340000000024c000280080003400000000408000180fffffffd0800f1d7fffffffd0800034000000003090002"], 0x164}, 0x1, 0x0, 0x0, 0x4000819}, 0x0) 860.713696ms ago: executing program 8 (id=2422): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808001800000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100000000009500000000000000b7020000000000007b9af8ff00000000b509020000000000dbaaf8fff1000000bf8200000000000007080000f8ffffffbfa420000000000007090000f0ffffffc70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f1ff76000000af9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 784.287425ms ago: executing program 9 (id=2423): r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000080)={@map, 0xffffffffffffffff, 0x7}, 0x10) write$binfmt_misc(r0, &(0x7f0000000340), 0x2000011a) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000a00)=ANY=[], 0x490) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind$802154_raw(r2, &(0x7f0000007cc0)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0202}}}, 0x14) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, r1) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8, 0x11, 0x2007ff}}}, 0x24}, 0x1, 0x0, 0xffa1}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) 777.844873ms ago: executing program 8 (id=2424): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@ipv6_newroute={0x2c, 0x18, 0x0, 0x70bd2d, 0x25dfdbff, {0xa, 0x10, 0x0, 0x2, 0xfc, 0x2, 0xff, 0x1, 0x2100}, [@RTA_MARK={0x8}, @RTA_UID={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0xc080) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x900, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="5c0000000a0601080000000000000000070000000900020073797a31000000000500010007000e1f340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x4c040) ioctl$CDROMPLAYTRKIND(r1, 0x5304, &(0x7f0000000080)={0x8, 0x8, 0xaa, 0x6}) 644.051626ms ago: executing program 6 (id=2425): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0xa) fchdir(r1) r2 = open(&(0x7f0000000080)='./bus\x00', 0x1031c2, 0xb4) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000040)=@l={0x92, 0x7, 0xb0, 0x4, 0x0, 0x24, 0xe8e}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x3ff}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ftruncate(r2, 0x2007ffb) close(r2) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r9, 0x402, 0x8000003d) fcntl$setsig(r9, 0xa, 0x21) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x88882, 0x0) 443.550914ms ago: executing program 9 (id=2426): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket(0x11, 0x3, 0x0) setsockopt(r1, 0x107, 0x18, &(0x7f0000000000)="10000000", 0x4) close(r0) (async) close(r0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) (async) close(r2) close(0xffffffffffffffff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010094797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000106140000001100010000000000000000000100000ab29be1ba6323d00a5f5a7b64c7ea66c7ab9408f574cd22df1ef8acaff5036117dedef016ff157a47f61469f12cfc9a18615492320cddc8530c0a5c2923dfb63fc3033d1f391ab23b4f0fa22e4c45bf5edfa681e055f84f71f32267f93cc644318a17"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010094797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000106140000001100010000000000000000000100000ab29be1ba6323d00a5f5a7b64c7ea66c7ab9408f574cd22df1ef8acaff5036117dedef016ff157a47f61469f12cfc9a18615492320cddc8530c0a5c2923dfb63fc3033d1f391ab23b4f0fa22e4c45bf5edfa681e055f84f71f32267f93cc644318a17"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 188.890993ms ago: executing program 9 (id=2427): syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = dup(r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x11, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 0s ago: executing program 9 (id=2428): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001180), 0x88003, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f00000000c0)="17000000", 0x4) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r4) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r5 = syz_open_procfs(r3, &(0x7f0000000180)='smaps\x00') syz_usb_disconnect(0xffffffffffffffff) readv(r5, &(0x7f0000002e00)=[{&(0x7f0000000a80)=""/4096, 0x1000}], 0x1) write$char_usb(r2, &(0x7f00000008c0)='-0', 0x2) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000000)=0x2) kernel console output (not intermixed with test programs): [ 419.681635][ T24] usb 11-1: device descriptor read/64, error -71 [ 419.697924][ T5753] Bluetooth: hci6: command 0x1003 tx timeout [ 419.759651][ T5107] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 419.789013][ T24] usb usb11-port1: attempt power cycle [ 419.896535][ T12] tipc: Subscription rejected, illegal request [ 420.162140][ T24] usb 11-1: new full-speed USB device number 12 using dummy_hcd [ 420.189618][ T24] usb 11-1: device descriptor read/8, error -71 [ 420.428185][ T24] usb 11-1: new full-speed USB device number 13 using dummy_hcd [ 420.541049][ T24] usb 11-1: device descriptor read/8, error -71 [ 420.713529][ T24] usb usb11-port1: unable to enumerate USB device [ 421.107911][T12903] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1976'. [ 421.343441][T12905] netlink: 'syz.3.1976': attribute type 10 has an invalid length. [ 421.527255][T12905] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1976'. [ 421.583211][T12905] bridge0: port 1(dummy0) entered blocking state [ 421.720949][T12905] bridge0: port 1(dummy0) entered disabled state [ 421.735727][T12905] dummy0: entered allmulticast mode [ 421.786432][T12782] syz.0.1942 (12782) used greatest stack depth: 18568 bytes left [ 421.789225][T12905] bridge0: port 1(dummy0) entered blocking state [ 421.792536][T12905] bridge0: port 1(dummy0) entered forwarding state [ 423.436502][T12922] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1983'. [ 424.178575][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 424.476051][ T7338] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.813012][T12938] input: syz1 as /devices/virtual/input/input45 [ 425.008187][ T5763] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 425.022078][ T5763] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 425.028523][ T5763] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 425.032659][ T5763] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 425.036958][ T5763] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 425.770744][ T7338] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.896616][ T7338] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.067937][T12955] trusted_key: encrypted_key: insufficient parameters specified [ 426.178322][ T7338] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.243710][T12931] lo speed is unknown, defaulting to 1000 [ 426.736816][T12966] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1994'. [ 426.784862][T12966] 8021q: adding VLAN 0 to HW filter on device bond3 [ 426.798183][T12966] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1994'. [ 426.839305][T12966] bond3: entered promiscuous mode [ 426.842027][T12966] bond3: entered allmulticast mode [ 426.863268][T12966] bond2: (slave dummy0): Releasing active interface [ 426.870808][T12966] dummy0: entered promiscuous mode [ 426.872939][T12966] dummy0: entered allmulticast mode [ 426.875613][T12966] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 427.297634][ T5107] Bluetooth: hci5: command tx timeout [ 428.129320][ T7338] bridge_slave_1: left allmulticast mode [ 428.136548][ T7338] bridge_slave_1: left promiscuous mode [ 428.148017][ T7338] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.169360][ T7338] bridge_slave_0: left allmulticast mode [ 428.176433][ T7338] bridge_slave_0: left promiscuous mode [ 428.191281][ T7338] bridge0: port 1(bridge_slave_0) entered disabled state [ 428.267629][ T8028] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 428.396199][ T40] kauditd_printk_skb: 746 callbacks suppressed [ 428.396221][ T40] audit: type=1326 audit(1780649825.262:1576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12985 comm="syz.6.1999" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f53f7c code=0x0 [ 428.427788][ T8028] usb 5-1: Using ep0 maxpacket: 16 [ 428.433986][ T8028] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 428.438945][ T8028] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 428.447315][ T8028] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 428.458035][ T8028] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 428.470370][ T8028] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 428.490551][ T8028] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 428.495246][ T8028] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 428.500024][ T8028] usb 5-1: Manufacturer: syz [ 428.505353][ T8028] usb 5-1: config 0 descriptor?? [ 428.728264][T12980] overlayfs: missing 'lowerdir' [ 428.756673][T12980] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1997'. [ 428.868856][ T7338] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 428.875493][ T7338] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 428.881093][ T7338] bond0 (unregistering): Released all slaves [ 428.909236][T12980] bond12: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 428.966372][T12980] bond12 (unregistering): Released all slaves [ 429.127549][ T8028] rc_core: IR keymap rc-hauppauge not found [ 429.130373][ T8028] Registered IR keymap rc-empty [ 429.132725][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.155014][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.182037][ T8028] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0 [ 429.195721][ T8028] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input46 [ 429.231332][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.241424][T12931] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.248329][T12931] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.248571][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.254714][T12931] bridge_slave_0: entered allmulticast mode [ 429.276947][T12931] bridge_slave_0: entered promiscuous mode [ 429.288615][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.291776][T12931] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.298467][T12931] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.302838][T12931] bridge_slave_1: entered allmulticast mode [ 429.307308][T12931] bridge_slave_1: entered promiscuous mode [ 429.308936][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.330046][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.346396][T12986] lo speed is unknown, defaulting to 1000 [ 429.357831][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.388132][ T5107] Bluetooth: hci5: command tx timeout [ 429.399683][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.427581][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.441283][T12931] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 429.450276][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.455375][T12931] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 429.477689][ T8028] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 429.503486][ T8028] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 429.507603][ T8028] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 429.529440][ T8028] usb 5-1: USB disconnect, device number 28 [ 429.728385][T12931] team0: Port device team_slave_0 added [ 429.738194][T12931] team0: Port device team_slave_1 added [ 429.743842][ T5459] 8021q: adding VLAN 0 to HW filter on device eth10 [ 429.792746][T13012] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2002'. [ 429.832339][ T7338] hsr_slave_0: left promiscuous mode [ 429.838515][ T7338] hsr_slave_1: left promiscuous mode [ 429.841809][ T7338] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 429.844995][ T7338] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 429.852937][ T7338] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 429.856154][ T7338] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 429.879973][ T7338] veth1_macvtap: left promiscuous mode [ 429.888416][ T7338] veth0_macvtap: left promiscuous mode [ 429.892824][ T7338] veth1_vlan: left promiscuous mode [ 429.897735][ T7338] veth0_vlan: left promiscuous mode [ 430.092931][T13014] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2003'. [ 430.096461][T13014] netlink: 'syz.0.2003': attribute type 7 has an invalid length. [ 430.100988][T13014] netlink: 'syz.0.2003': attribute type 8 has an invalid length. [ 430.104704][T13014] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2003'. [ 430.227197][ T7338] team0 (unregistering): Port device team_slave_1 removed [ 430.252860][ T7338] team0 (unregistering): Port device team_slave_0 removed [ 430.373518][ T7338] team0 (unregistering): Port device dummy0 removed [ 430.514053][T12931] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 430.517752][T12931] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 430.530864][T12931] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 430.571921][T13014] gretap0: entered promiscuous mode [ 430.580203][T13014] gretap0: left promiscuous mode [ 430.601154][T12931] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 430.609133][T12931] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 430.620319][T12931] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 430.808712][T12931] hsr_slave_0: entered promiscuous mode [ 430.812172][T12931] hsr_slave_1: entered promiscuous mode [ 430.815243][T12931] debugfs: 'hsr0' already exists in 'hsr' [ 430.820558][T12931] Cannot create hsr debugfs directory [ 431.325848][ T5459] 8021q: adding VLAN 0 to HW filter on device eth11 [ 431.467591][ T5107] Bluetooth: hci5: command tx timeout [ 432.459115][T13040] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2007'. [ 433.544148][ T5107] Bluetooth: hci5: command tx timeout [ 433.606339][T12931] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 433.621920][T12931] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 433.637720][ T5459] 8021q: adding VLAN 0 to HW filter on device eth12 [ 433.642074][T12931] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 433.695028][T12931] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 433.705260][T12931] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 433.731791][T12931] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 433.743145][T12931] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 433.781797][T12931] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 433.791305][T13056] 8021q: VLANs not supported on gre0 [ 434.173251][ T7335] tipc: Subscription rejected, illegal request [ 434.527782][ T5459] 8021q: adding VLAN 0 to HW filter on device eth13 [ 434.636217][T12931] 8021q: adding VLAN 0 to HW filter on device bond0 [ 434.656299][T12931] 8021q: adding VLAN 0 to HW filter on device team0 [ 434.862133][T13084] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 434.864835][ T982] netdevsim netdevsim6 netdevsim0: entered promiscuous mode [ 434.871175][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.873809][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.906824][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.910280][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 434.978475][T13090] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2021'. [ 435.093949][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.100394][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 435.285244][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.293629][ T5763] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 435.306189][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 435.313914][ T5763] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 435.322705][ T5763] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 435.330318][ T5763] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 435.341475][ T5763] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 435.361163][T13103] tipc: Resetting bearer [ 435.495253][T13113] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2027'. [ 435.549862][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.557689][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 435.718152][T13120] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 435.799505][ T12] netdevsim netdevsim0  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.803441][ T12] netdevsim netdevsim0  (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 436.273781][ T12] bridge_slave_1: left allmulticast mode [ 436.292724][ T12] bridge_slave_1: left promiscuous mode [ 436.335549][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.382710][T13145] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2033'. [ 436.383778][ T12] batman_adv: batadv0: Interface deactivated: gretap1 [ 436.709227][ T12] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface [ 436.717077][ T12] ip6gretap1 (unregistering): left allmulticast mode [ 437.356439][ T12] batman_adv: batadv0: Removing interface: gretap1 [ 437.390125][ T12] bond3 (unregistering): (slave geneve2): Releasing active interface [ 437.457984][ T5763] Bluetooth: hci3: command tx timeout [ 437.649259][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 437.661430][ T7338] smbdirect: ib_dev[syz1] removed [ 437.667587][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 437.675877][ T12] bond0 (unregistering): Released all slaves [ 437.751956][ T12] bond1 (unregistering): Released all slaves [ 437.765887][ T12] bond2 (unregistering): Released all slaves [ 437.780814][ T12] bond3 (unregistering): Released all slaves [ 437.794132][ T12] bond4 (unregistering): (slave veth3): Releasing active interface [ 437.808142][ T12] bond4 (unregistering): Released all slaves [ 437.846806][ T12] bond5 (unregistering): Released all slaves [ 437.881971][ T12] bond6 (unregistering): Released all slaves [ 437.955181][ T12] bond7 (unregistering): (slave veth5): Releasing active interface [ 438.002806][ T12] bond7 (unregistering): Released all slaves [ 438.016736][ T12] bond8 (unregistering): Released all slaves [ 438.032845][ T12] bond9 (unregistering): (slave veth7): Releasing active interface [ 438.040501][ T12] bond9 (unregistering): Released all slaves [ 438.054129][ T12] bond10 (unregistering): Released all slaves [ 438.073440][ T12] bond11 (unregistering): Released all slaves [ 438.276766][ T5459] 8021q: adding VLAN 0 to HW filter on device eth14 [ 438.282367][ T12] tipc: Disabling bearer [ 438.289733][ T12] tipc: Left network mode [ 438.327834][T13099] lo speed is unknown, defaulting to 1000 [ 438.355290][T12931] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 438.572900][T13169] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2036'. [ 438.774069][T13175] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2037'. [ 438.887198][T13183] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2038'. [ 438.972972][T13184] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2038'. [ 439.019357][T13183] 8021q: adding VLAN 0 to HW filter on device bond4 [ 439.027123][ T5459] 8021q: adding VLAN 0 to HW filter on device eth16 [ 439.069390][T13184] bond4: entered promiscuous mode [ 439.071586][T13184] bond4: entered allmulticast mode [ 439.207374][T13183] bond3: (slave dummy0): Releasing backup interface [ 439.227868][T13183] dummy0: left promiscuous mode [ 439.230789][T13183] dummy0: left allmulticast mode [ 439.235755][T13183] dummy0: entered promiscuous mode [ 439.238460][T13183] dummy0: entered allmulticast mode [ 439.241177][T13183] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 439.358380][T13194] netlink: 112 bytes leftover after parsing attributes in process `syz.3.2041'. [ 439.525439][T12931] veth0_vlan: entered promiscuous mode [ 439.530476][T13205] netlink: 'syz.6.2043': attribute type 30 has an invalid length. [ 439.541592][ T5763] Bluetooth: hci3: command tx timeout [ 439.554049][T13206] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2044'. [ 439.571105][T13099] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.574372][T13099] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.579127][T13099] bridge_slave_0: entered allmulticast mode [ 439.583725][T13099] bridge_slave_0: entered promiscuous mode [ 439.655967][T13099] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.659825][T13099] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.663286][T13099] bridge_slave_1: entered allmulticast mode [ 439.667372][T13099] bridge_slave_1: entered promiscuous mode [ 439.679913][T12931] veth1_vlan: entered promiscuous mode [ 439.835941][T13099] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 439.841299][ T5459] 8021q: adding VLAN 0 to HW filter on device eth17 [ 439.852128][T13099] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 439.918023][T13099] team0: Port device team_slave_0 added [ 439.921086][T13214] fuse: Bad value for 'fd' [ 439.926442][T13099] team0: Port device team_slave_1 added [ 440.032973][T12931] veth0_macvtap: entered promiscuous mode [ 440.071273][ T12] hsr_slave_0: left promiscuous mode [ 440.073883][ T12] hsr_slave_1: left promiscuous mode [ 440.080079][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 440.087861][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 440.097138][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 440.103477][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 440.121142][ T12] veth1_macvtap: left promiscuous mode [ 440.124768][ T12] veth0_macvtap: left promiscuous mode [ 440.147694][ T12] veth1_vlan: left promiscuous mode [ 440.150517][ T12] veth0_vlan: left promiscuous mode [ 440.756695][ T12] team0 (unregistering): Port device team_slave_1 removed [ 440.776991][ T12] team0 (unregistering): Port device team_slave_0 removed [ 440.902198][ T12] team0 (unregistering): Port device dummy0 removed [ 440.928108][T13099] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 440.931453][T13099] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 440.944882][T13099] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 440.952635][ T5459] 8021q: adding VLAN 0 to HW filter on device eth15 [ 440.960197][T12931] veth1_macvtap: entered promiscuous mode [ 440.971662][T13099] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 440.978368][T13099] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 440.991524][T13099] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 441.044839][T13233] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2048'. [ 441.074104][T13099] hsr_slave_0: entered promiscuous mode [ 441.079572][T13099] hsr_slave_1: entered promiscuous mode [ 441.082864][T13099] debugfs: 'hsr0' already exists in 'hsr' [ 441.085339][T13099] Cannot create hsr debugfs directory [ 441.096551][T12931] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 441.132325][T12931] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 441.201853][ T7102] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.207259][ T7102] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.236315][ T7102] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.240068][ T7102] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.368082][T13241] netlink: 16186 bytes leftover after parsing attributes in process `syz.6.2050'. [ 441.637947][ T5763] Bluetooth: hci3: command tx timeout [ 441.731033][ T1243] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 441.745256][ T1243] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 441.802530][ T7102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 441.806009][ T7102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 441.875581][ T12] IPVS: stop unused estimator thread 0... [ 442.064331][T13099] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 442.079691][T13099] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 442.086885][T13099] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 442.101676][T13099] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 442.111428][T13099] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 442.135792][T13099] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 442.144404][T13099] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 442.163372][T13099] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 442.322919][T13099] 8021q: adding VLAN 0 to HW filter on device bond0 [ 442.351741][T13099] 8021q: adding VLAN 0 to HW filter on device team0 [ 442.375513][ T1243] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.379560][ T1243] bridge0: port 1(bridge_slave_0) entered forwarding state [ 442.447327][T13257] netlink: 72 bytes leftover after parsing attributes in process `syz.8.2052'. [ 442.452574][ T72] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.457023][ T72] bridge0: port 2(bridge_slave_1) entered forwarding state [ 442.780830][ T1243] tipc: Subscription rejected, illegal request [ 442.997015][T13278] lo speed is unknown, defaulting to 1000 [ 443.704823][ T5763] Bluetooth: hci3: command tx timeout [ 443.729594][T13099] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 444.293184][T13099] veth0_vlan: entered promiscuous mode [ 444.309541][ T5852] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 444.330264][T13099] veth1_vlan: entered promiscuous mode [ 444.415908][T13099] veth0_macvtap: entered promiscuous mode [ 444.451277][T13099] veth1_macvtap: entered promiscuous mode [ 444.469003][ T5852] usb 8-1: Using ep0 maxpacket: 16 [ 444.476005][ T5852] usb 8-1: config 0 has no interfaces? [ 444.479571][T13316] netlink: 'syz.8.2064': attribute type 4 has an invalid length. [ 444.481311][ T5852] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 444.489439][ T5852] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 444.494465][T13099] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 444.497488][ T5852] usb 8-1: Manufacturer: syz [ 444.503408][ T5852] usb 8-1: config 0 descriptor?? [ 444.688533][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 444.690992][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.810739][T13317] netlink: 'syz.8.2064': attribute type 4 has an invalid length. [ 444.834669][T13099] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 444.843332][ T5852] usb 8-1: USB disconnect, device number 28 [ 444.876494][ T7335] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.885614][ T7335] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.889816][ T7335] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.893953][ T46] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 445.129689][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.137133][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.140865][T13324] netlink: 'syz.6.2066': attribute type 1 has an invalid length. [ 445.183001][T13324] 8021q: adding VLAN 0 to HW filter on device bond5 [ 445.198424][T13324] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2066'. [ 445.242049][T13324] bond5: entered promiscuous mode [ 445.246647][T13324] bond5: entered allmulticast mode [ 445.270665][T13328] bond4: (slave dummy0): Releasing backup interface [ 445.303210][T13328] dummy0: left promiscuous mode [ 445.309487][T13328] dummy0: left allmulticast mode [ 445.324351][T13328] bond5: (slave dummy0): making interface the new active one [ 445.331175][T13328] dummy0: entered promiscuous mode [ 445.335206][T13328] dummy0: entered allmulticast mode [ 445.389069][T13328] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 445.400162][ T7335] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.405421][ T7335] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.745568][T13347] netlink: 'syz.3.2071': attribute type 30 has an invalid length. [ 446.089366][ T0] NOHZ tick-stop error: local softirq work is pending, handler #108!!! [ 447.520291][T13368] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2074'. [ 447.664456][T13371] netlink: 'syz.8.2074': attribute type 10 has an invalid length. [ 447.680114][T13371] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2074'. [ 447.709910][T13377] netlink: 'syz.9.2076': attribute type 1 has an invalid length. [ 447.872924][T13377] netlink: 'syz.9.2076': attribute type 10 has an invalid length. [ 447.881022][T13377] netlink: 40 bytes leftover after parsing attributes in process `syz.9.2076'. [ 448.283958][T13380] bridge0: port 3(veth3) entered blocking state [ 448.310877][T13380] bridge0: port 3(veth3) entered disabled state [ 448.316972][T13380] veth3: entered allmulticast mode [ 448.327139][T13380] veth3: entered promiscuous mode [ 448.346707][T13383] bridge0: port 4(dummy0) entered blocking state [ 448.351170][T13383] bridge0: port 4(dummy0) entered disabled state [ 448.358325][T13383] dummy0: entered allmulticast mode [ 448.362329][T13383] dummy0: entered promiscuous mode [ 448.383339][T13385] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2077'. [ 448.391194][T13377] bridge0: port 4(dummy0) entered blocking state [ 448.393970][T13377] bridge0: port 4(dummy0) entered forwarding state [ 448.410460][T13377] dummy0: left allmulticast mode [ 448.417809][T13377] bridge0: port 4(dummy0) entered disabled state [ 448.575730][ T982] kernel write not supported for file /dsp (pid: 982 comm: kworker/1:2) [ 448.674449][T13405] syzkaller0: entered promiscuous mode [ 448.696430][T13405] syzkaller0: entered allmulticast mode [ 448.738648][T13405] tipc: Started in network mode [ 448.745304][T13405] tipc: Node identity 668dfdc340a6, cluster identity 4711 [ 448.785642][T13405] tipc: Enabled bearer , priority 0 [ 448.863444][T13403] tipc: Resetting bearer [ 448.877889][T13418] overlayfs: failed to resolve './file0': -2 [ 448.921973][T13403] tipc: Disabling bearer [ 449.036704][T13422] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 451.371345][T13446] 8021q: VLANs not supported on gre0 [ 451.495476][T13449] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2094'. [ 451.654282][T13454] fuse: Bad value for 'fd' [ 451.757530][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 452.382887][T13457] macsec1: entered allmulticast mode [ 452.385294][T13457] netdevsim netdevsim9 netdevsim0: entered allmulticast mode [ 452.430451][T13457] netdevsim netdevsim9 netdevsim0: entered promiscuous mode [ 452.435132][T13457] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 452.708431][T13467] Invalid source name [ 452.963876][T13467] syz.3.2100: page allocation failure: order:0, mode:0x340cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_THISNODE), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 452.973827][T13467] CPU: 0 UID: 0 PID: 13467 Comm: syz.3.2100 Tainted: G L syzkaller #0 PREEMPT(full) [ 452.973856][T13467] Tainted: [L]=SOFTLOCKUP [ 452.973862][T13467] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 452.973871][T13467] Call Trace: [ 452.973879][T13467] [ 452.973886][T13467] dump_stack_lvl+0x100/0x190 [ 452.973912][T13467] warn_alloc.cold+0x95/0x1c1 [ 452.973933][T13467] ? __pfx_warn_alloc+0x10/0x10 [ 452.973959][T13467] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 452.973992][T13467] ? _mutex_trylock_nest_lock+0x170/0x310 [ 452.974021][T13467] __alloc_frozen_pages_noprof+0xf25/0x2bc0 [ 452.974061][T13467] ? __lock_acquire+0x4a5/0x2630 [ 452.974086][T13467] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 452.974135][T13467] __folio_alloc_noprof+0x13/0x260 [ 452.974161][T13467] alloc_migration_target+0x1d7/0x6d0 [ 452.974186][T13467] migrate_pages_batch+0x5dc/0x45c0 [ 452.974208][T13467] ? __pfx_alloc_migration_target+0x10/0x10 [ 452.974240][T13467] ? __pfx_migrate_pages_batch+0x10/0x10 [ 452.974261][T13467] ? lock_acquire+0x1b1/0x370 [ 452.974287][T13467] ? find_held_lock+0x2b/0x80 [ 452.974308][T13467] ? clockevents_program_event+0x1bf/0x820 [ 452.974329][T13467] ? clockevents_program_event+0x1bf/0x820 [ 452.974351][T13467] ? __lock_acquire+0x4a5/0x2630 [ 452.974374][T13467] ? __lock_acquire+0x4a5/0x2630 [ 452.974404][T13467] migrate_pages_sync+0x12c/0x880 [ 452.974427][T13467] ? __pfx_alloc_migration_target+0x10/0x10 [ 452.974450][T13467] ? finish_task_switch.isra.0+0x2c6/0x1010 [ 452.974471][T13467] ? __pfx_migrate_pages_sync+0x10/0x10 [ 452.974494][T13467] ? lockdep_hardirqs_on+0x78/0x100 [ 452.974521][T13467] ? __lock_acquire+0x4a5/0x2630 [ 452.974543][T13467] ? __css_rstat_updated+0x1ce/0x5a0 [ 452.974573][T13467] migrate_pages+0x1aa5/0x2880 [ 452.974601][T13467] ? __pfx_alloc_migration_target+0x10/0x10 [ 452.974631][T13467] ? __pfx_migrate_pages+0x10/0x10 [ 452.974658][T13467] ? __lock_acquire+0x4a5/0x2630 [ 452.974686][T13467] ? mtree_load+0x32d/0xa90 [ 452.974714][T13467] move_pages_and_store_status+0xf1/0x230 [ 452.974740][T13467] ? __pfx_move_pages_and_store_status+0x10/0x10 [ 452.974777][T13467] kernel_move_pages+0xc47/0x13f0 [ 452.974809][T13467] ? __pfx_kernel_move_pages+0x10/0x10 [ 452.974841][T13467] ? xfd_validate_state+0x129/0x190 [ 452.974867][T13467] __ia32_sys_move_pages+0xdd/0x1b0 [ 452.974892][T13467] ? __do_fast_syscall_32+0x98/0x970 [ 452.974918][T13467] ? lockdep_hardirqs_on+0x78/0x100 [ 452.974942][T13467] __do_fast_syscall_32+0xe7/0x970 [ 452.974970][T13467] do_fast_syscall_32+0x32/0x70 [ 452.974997][T13467] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 452.975020][T13467] RIP: 0023:0xf70bef7c [ 452.975036][T13467] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 452.975052][T13467] RSP: 002b:00000000f548c50c EFLAGS: 00000292 ORIG_RAX: 000000000000013d [ 452.975067][T13467] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000000020a0 [ 452.975079][T13467] RDX: 0000000080000040 RSI: 0000000080001180 RDI: 0000000080000000 [ 452.975089][T13467] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 452.975100][T13467] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 452.975111][T13467] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 452.975134][T13467] [ 452.975142][T13467] Mem-Info: [ 453.169755][T13467] active_anon:2158 inactive_anon:1284 isolated_anon:0 [ 453.169755][T13467] active_file:1723 inactive_file:11299 isolated_file:0 [ 453.169755][T13467] unevictable:1769 dirty:6 writeback:25 [ 453.169755][T13467] slab_reclaimable:6928 slab_unreclaimable:69691 [ 453.169755][T13467] mapped:33121 shmem:1793 pagetables:1691 [ 453.169755][T13467] sec_pagetables:307 bounce:0 [ 453.169755][T13467] kernel_misc_reclaimable:0 [ 453.169755][T13467] free:53423 free_pcp:716 free_cma:0 [ 453.190548][T13467] Node 0 active_anon:8kB inactive_anon:28kB active_file:156kB inactive_file:4kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:24kB dirty:8kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:9016kB pagetables:1528kB sec_pagetables:1160kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 453.208813][T13467] Node 1 active_anon:8624kB inactive_anon:5108kB active_file:6736kB inactive_file:45192kB unevictable:3540kB isolated(anon):0kB isolated(file):0kB mapped:132460kB dirty:16kB writeback:100kB shmem:3636kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7464kB pagetables:5236kB sec_pagetables:68kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 453.222506][T13467] Node 0 DMA free:2536kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:12kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 453.235687][T13467] lowmem_reserve[]: 0 285 285 285 285 [ 453.241150][T13467] Node 0 DMA32 free:29840kB boost:29460kB min:42556kB low:45828kB high:49100kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8kB inactive_anon:28kB active_file:156kB inactive_file:4kB unevictable:3536kB writepending:8kB zspages:1384kB present:1032196kB managed:292748kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 453.259170][T13467] lowmem_reserve[]: 0 0 0 0 0 [ 453.268764][T13467] Node 1 DMA32 free:178656kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:6624kB inactive_anon:5108kB active_file:6736kB inactive_file:45192kB unevictable:3540kB writepending:16kB zspages:6060kB present:1048432kB managed:948212kB mlocked:4kB bounce:0kB free_pcp:8272kB local_pcp:0kB free_cma:0kB [ 453.288181][T13467] lowmem_reserve[]: 0 0 0 0 0 [ 453.291046][T13467] Node 0 DMA: 43*4kB (UE) 14*8kB (UE) 9*16kB (UE) 6*32kB (UE) 8*64kB (UE) 1*128kB (E) 1*256kB (E) 0*512kB 1*1024kB (E) 0*2048kB 0*4096kB = 2540kB [ 453.299391][T13467] Node 0 DMA32: 1143*4kB (UME) 315*8kB (UME) 150*16kB (UM) 168*32kB (UME) 60*64kB (UME) 23*128kB (UME) 8*256kB (UM) 8*512kB (UM) 2*1024kB (M) 0*2048kB 0*4096kB = 29844kB [ 453.310936][T13467] Node 1 DMA32: 1842*4kB (UME) 3797*8kB (UME) 2233*16kB (UME) 481*32kB (UME) 112*64kB (UME) 45*128kB (UME) 28*256kB (ME) 18*512kB (ME) 27*1024kB (UME) 12*2048kB (UME) 2*4096kB (U) = 178592kB [ 453.321019][T13467] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 453.326832][T13467] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 453.334097][T13467] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 453.343807][T13467] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 453.351924][T13467] 15724 total pagecache pages [ 453.360364][T13467] 911 pages in swap cache [ 453.364413][T13467] Free swap = 95608kB [ 453.367748][T13483] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2105'. [ 453.372514][T13467] Total swap = 124996kB [ 453.379185][T13467] 524155 pages RAM [ 453.381919][T13467] 0 pages HighMem/MovableOnly [ 453.385050][T13467] 210075 pages reserved [ 453.392661][T13467] 0 pages cma reserved [ 453.443173][T13486] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2107'. [ 453.473598][T13488] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(11) [ 453.474024][T13486] 8021q: adding VLAN 0 to HW filter on device bond6 [ 453.477150][T13488] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 453.484224][T13488] vhci_hcd vhci_hcd.0: Device attached [ 453.522884][T13486] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2107'. [ 453.528813][T13488] netlink: 'syz.8.2106': attribute type 12 has an invalid length. [ 453.561239][T13486] bond6: entered promiscuous mode [ 453.563987][T13486] bond6: entered allmulticast mode [ 453.590642][T13486] bond5: (slave dummy0): Releasing active interface [ 453.602894][T13486] dummy0: left promiscuous mode [ 453.610172][T13486] dummy0: left allmulticast mode [ 453.645797][T13486] dummy0: entered promiscuous mode [ 453.654353][T13486] dummy0: entered allmulticast mode [ 453.672638][T13486] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 453.798344][ T8028] usb 54-1: SetAddress Request (2) to port 0 [ 453.810959][ T8028] usb 54-1: new SuperSpeed USB device number 2 using vhci_hcd [ 454.203363][T13489] vhci_hcd: connection reset by peer [ 454.225882][ T13] vhci_hcd vhci_hcd.8: stop threads [ 454.234261][ T13] vhci_hcd vhci_hcd.8: release socket [ 454.243199][T13501] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2109'. [ 454.271891][ T13] vhci_hcd vhci_hcd.8: disconnect device [ 455.369925][T13517] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2114'. [ 455.632127][T13529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2116'. [ 455.719929][T13533] netlink: 'syz.3.2116': attribute type 10 has an invalid length. [ 455.723248][T13533] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2116'. [ 455.732272][T13534] netlink: 'syz.6.2118': attribute type 30 has an invalid length. [ 456.345161][T13558] netlink: 'syz.6.2122': attribute type 1 has an invalid length. [ 456.397719][T13558] bond7: (slave geneve2): making interface the new active one [ 456.405555][T13558] bond7: (slave geneve2): Enslaving as an active interface with an up link [ 456.415575][ T228] netdevsim netdevsim6 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 456.437968][ T228] netdevsim netdevsim6 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 456.443626][T13558] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2122'. [ 456.447997][ T46] netdevsim netdevsim6 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 456.461995][ T46] netdevsim netdevsim6 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 456.481806][T13558] 8021q: adding VLAN 0 to HW filter on device bond7 [ 456.563113][T13564] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2123'. [ 457.088607][T13575] syz_tun: entered allmulticast mode [ 457.105487][T13575] pim6reg: entered allmulticast mode [ 457.133993][T13575] syz_tun (unregistering): left allmulticast mode [ 457.687545][T13284] usb 13-1: new full-speed USB device number 2 using dummy_hcd [ 457.856164][T13284] usb 13-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 457.864004][T13585] overlayfs: failed to resolve '/ile0': -2 [ 457.866985][T13284] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 457.871749][T13284] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 457.886920][T13284] usb 13-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 457.895851][T13284] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.902560][T13284] usb 13-1: Product: syz [ 457.904195][T13284] usb 13-1: Manufacturer: syz [ 457.906052][T13284] usb 13-1: SerialNumber: syz [ 457.913635][T13284] usb 13-1: config 0 descriptor?? [ 457.917870][T13583] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 458.010074][T13284] rc_core: IR keymap rc-streamzap not found [ 458.013323][T13284] Registered IR keymap rc-empty [ 458.018752][T13284] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/rc/rc0 [ 458.033594][T13284] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/rc/rc0/input47 [ 458.247044][T13284] usb 13-1: USB disconnect, device number 2 [ 458.273087][T13599] dummy0: left promiscuous mode [ 458.901732][ T8028] usb 54-1: device descriptor read/8, error -110 [ 459.358528][ T8028] usb usb54-port1: attempt power cycle [ 459.921021][ T8028] usb usb54-port1: unable to enumerate USB device [ 461.750349][T13642] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 462.188111][T13282] usb 13-1: new high-speed USB device number 3 using dummy_hcd [ 462.340412][T13282] usb 13-1: Using ep0 maxpacket: 16 [ 462.349148][T13282] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 462.359396][T13282] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 462.372167][T13282] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 462.382863][T13282] usb 13-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 462.391666][T13282] usb 13-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 462.408953][T13282] usb 13-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 462.414449][T13282] usb 13-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 462.423369][T13282] usb 13-1: Manufacturer: syz [ 462.430619][T13282] usb 13-1: config 0 descriptor?? [ 462.727667][T13282] rc_core: IR keymap rc-hauppauge not found [ 462.733318][T13282] Registered IR keymap rc-empty [ 462.735675][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 462.771689][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 462.799331][T13282] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/rc/rc0 [ 462.807258][T13282] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/rc/rc0/input48 [ 462.825043][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 462.857629][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 462.861495][T13644] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2145'. [ 462.895052][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 462.910669][T13644] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 462.941506][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 462.957685][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 462.978802][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 463.003233][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 463.010964][T13644] bond1 (unregistering): Released all slaves [ 463.031295][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 463.059365][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 463.079529][T13282] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 463.100167][T13282] mceusb 13-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 463.104178][T13282] mceusb 13-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 463.151484][ T9705] usb 13-1: USB disconnect, device number 3 [ 463.261795][T13655] netlink: 14 bytes leftover after parsing attributes in process `syz.6.2146'. [ 463.281200][T13655] bond6: (slave dummy0): Releasing backup interface [ 463.284906][T13655] dummy0 (unregistering): left promiscuous mode [ 463.287873][T13655] dummy0 (unregistering): left allmulticast mode [ 463.395435][T13282] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 463.587011][T13282] hid-generic 0000:0000:0000.000D: hidraw1: HID v0.00 Device [syz1] on syz0 [ 463.897949][T13659] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2148'. [ 464.408607][T13673] netlink: 240 bytes leftover after parsing attributes in process `syz.9.2150'. [ 464.702025][T13678] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2153'. [ 467.510991][T13711] netlink: 'syz.3.2161': attribute type 1 has an invalid length. [ 467.602958][T13711] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2161'. [ 467.608914][T13715] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2162'. [ 467.615805][T13711] 8021q: adding VLAN 0 to HW filter on device bond15 [ 467.951633][T13729] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2167'. [ 468.273422][T13737] netlink: 12 bytes leftover after parsing attributes in process `syz.9.2169'. [ 468.304473][T13738] 8021q: adding VLAN 0 to HW filter on device bond2 [ 468.315535][T13738] 8021q: adding VLAN 0 to HW filter on device bond3 [ 468.327938][T13738] 8021q: adding VLAN 0 to HW filter on device bond4 [ 468.333492][T13738] 8021q: adding VLAN 0 to HW filter on device bond5 [ 468.346741][T13738] 8021q: adding VLAN 0 to HW filter on device bond6 [ 468.351289][T13740] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2169'. [ 468.400510][T13737] 8021q: adding VLAN 0 to HW filter on device bond1 [ 468.409874][ T7103] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 468.415958][ T7103] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 468.518257][T13740] bond1: entered promiscuous mode [ 468.520749][T13740] bond1: entered allmulticast mode [ 468.541329][T13737] dummy0: entered promiscuous mode [ 468.561996][T13737] dummy0: entered allmulticast mode [ 468.593093][T13737] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 468.597987][ T7103] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 468.606122][ T7103] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 468.636588][ T46] bond2: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 468.646448][ T46] bond2: (slave veth5): making interface the new active one [ 468.669589][ T46] bond2: active interface up! [ 469.024576][T13750] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2174'. [ 469.033576][T13750] bridge_slave_0: left allmulticast mode [ 469.038193][T13750] bridge_slave_0: left promiscuous mode [ 469.043262][T13750] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.321806][T13788] 8021q: VLANs not supported on gre0 [ 472.477590][ T9705] usb 11-1: new high-speed USB device number 14 using dummy_hcd [ 472.627582][ T9705] usb 11-1: Using ep0 maxpacket: 16 [ 472.632963][ T9705] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 472.640338][ T9705] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 472.646793][ T9705] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 472.658314][ T9705] usb 11-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 472.663732][ T9705] usb 11-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 472.671476][ T9705] usb 11-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 472.677069][ T9705] usb 11-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 472.680962][ T9705] usb 11-1: Manufacturer: syz [ 472.916628][T13792] netlink: 'syz.3.2190': attribute type 1 has an invalid length. [ 472.919806][T13792] netlink: 'syz.3.2190': attribute type 1 has an invalid length. [ 473.029505][ T9705] usb 11-1: config 0 descriptor?? [ 473.261188][T13784] overlayfs: missing 'lowerdir' [ 473.292521][T13784] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2186'. [ 473.330903][ T46] Bluetooth: hci6: Frame reassembly failed (-84) [ 473.349229][T13784] bond8: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 473.479309][T13804] overlayfs: upper fs does not support file handles, falling back to index=off. [ 473.491775][T13784] bond8 (unregistering): Released all slaves [ 474.053624][ T9705] rc_core: IR keymap rc-hauppauge not found [ 474.059807][ T9705] Registered IR keymap rc-empty [ 474.064777][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.087987][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.109610][ T9705] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:0.0/rc/rc0 [ 474.132331][ T9705] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:0.0/rc/rc0/input49 [ 474.173802][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.213408][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.379864][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.397704][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.417716][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.437662][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.457834][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.477684][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.497696][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.519543][ T9705] mceusb 11-1:0.0: Error: mce write submit urb error = -90 [ 474.519682][T13284] IPVS: starting estimator thread 0... [ 474.560928][ T9705] mceusb 11-1:0.0: Registered with mce emulator interface version 1 [ 474.568327][ T9705] mceusb 11-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 474.584994][ T9705] usb 11-1: USB disconnect, device number 14 [ 474.637525][T13824] IPVS: using max 29 ests per chain, 69600 per kthread [ 474.868340][T13829] netlink: 16186 bytes leftover after parsing attributes in process `syz.6.2196'. [ 475.378652][ T5107] Bluetooth: hci6: command 0x1003 tx timeout [ 475.380404][ T5763] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 476.447701][ T9705] usb 8-1: new high-speed USB device number 29 using dummy_hcd [ 476.600604][ T9705] usb 8-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 476.604859][ T9705] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.610026][ T9705] usb 8-1: config 0 descriptor?? [ 476.944086][ T9705] udl 8-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 476.951081][ T9705] [drm:udl_init] *ERROR* Selecting channel failed [ 476.982645][ T9705] [drm] Initialized udl 0.0.1 for 8-1:0.0 on minor 3 [ 476.985525][ T9705] [drm] Initialized udl on minor 3 [ 476.993395][ T9705] udl 8-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 477.006474][ T9705] udl 8-1:0.0: [drm] Cannot find any crtc or sizes [ 477.018949][ T9705] usb 8-1: USB disconnect, device number 29 [ 477.033503][ T58] udl 8-1:0.0: [drm] Cannot find any crtc or sizes [ 477.732431][T13284] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 477.786290][T13284] hid-generic 0000:0000:0000.000E: hidraw1: HID v0.00 Device [syz1] on syz0 [ 480.363766][ T5824] kernel read not supported for file /rfkill (pid: 5824 comm: kworker/1:4) [ 481.378366][T13881] lo speed is unknown, defaulting to 1000 [ 481.606817][T13897] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2214'. [ 481.613599][T13896] netlink: 'syz.9.2215': attribute type 8 has an invalid length. [ 481.627846][ T5824] usb 11-1: new high-speed USB device number 15 using dummy_hcd [ 481.797761][ T5824] usb 11-1: Using ep0 maxpacket: 16 [ 481.811576][ T5824] usb 11-1: config 0 has no interfaces? [ 481.823341][ T5824] usb 11-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 481.848439][ T5824] usb 11-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 481.853702][ T5824] usb 11-1: Manufacturer: syz [ 481.870152][ T5824] usb 11-1: config 0 descriptor?? [ 482.202068][T13905] netlink: 'syz.8.2218': attribute type 1 has an invalid length. [ 482.209119][T13905] netlink: 'syz.8.2218': attribute type 4 has an invalid length. [ 482.275521][ T8581] usb 11-1: USB disconnect, device number 15 [ 482.887580][ T5860] usb 13-1: new high-speed USB device number 4 using dummy_hcd [ 483.070055][ T5860] usb 13-1: config 0 has no interfaces? [ 483.073308][ T5860] usb 13-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice= 0.03 [ 483.079079][ T5860] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 483.094504][ T5860] usb 13-1: config 0 descriptor?? [ 483.348291][ T5860] usb 13-1: USB disconnect, device number 4 [ 483.419465][T13924] 8021q: VLANs not supported on gre0 [ 484.872784][T13934] netlink: 36 bytes leftover after parsing attributes in process `syz.9.2227'. [ 485.046520][T13937] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2229'. [ 485.060736][T13937] netlink: 'syz.9.2229': attribute type 7 has an invalid length. [ 485.074962][T13937] netlink: 'syz.9.2229': attribute type 8 has an invalid length. [ 485.080922][T13937] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2229'. [ 485.173270][T13937] gretap0: entered promiscuous mode [ 485.222338][T13937] gretap0: left promiscuous mode [ 488.399455][T13953] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2235'. [ 488.431742][ T40] audit: type=1800 audit(1780649885.302:1577): pid=13956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2237" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 488.450908][T13960] tmpfs: Unknown parameter 'ndes' [ 488.464546][T13960] random: crng reseeded on system resumption [ 488.587044][ T40] audit: type=1800 audit(1780649885.312:1578): pid=13956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2237" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 488.693326][T13962] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2238'. [ 488.936357][T13968] netlink: 16186 bytes leftover after parsing attributes in process `syz.9.2239'. [ 489.409138][T13974] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2241'. [ 490.244222][T13982] netlink: 'syz.9.2244': attribute type 10 has an invalid length. [ 490.286349][T13982] bond1: (slave dummy0): Releasing backup interface [ 490.302300][T13982] dummy0: left promiscuous mode [ 490.317087][T13982] dummy0: left allmulticast mode [ 490.332419][T13984] netlink: 'syz.9.2244': attribute type 10 has an invalid length. [ 490.350245][T13982] team0: Port device dummy0 added [ 490.374741][T13984] team0: Port device dummy0 removed [ 490.429814][T13984] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 490.793964][T13284] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 490.814321][T13284] hid-generic 0000:0000:0000.000F: hidraw1: HID v0.00 Device [syz1] on syz0 [ 491.126444][T13994] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2245'. [ 491.359669][T13995] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2245'. [ 491.643329][T13994] 8021q: adding VLAN 0 to HW filter on device bond16 [ 491.686316][T13995] bond16: entered promiscuous mode [ 491.734672][T13995] bond16: entered allmulticast mode [ 491.741538][T13993] fido_id[13993]: Failed to read report descriptor at '/sys/devices/virtual/misc/uhid/0000:0000:0000.000F/report_descriptor': No such device [ 491.878274][T13998] bridge0: port 1(dummy0) entered disabled state [ 491.882762][T13998] dummy0: left allmulticast mode [ 491.885066][T13998] dummy0: left promiscuous mode [ 491.887354][T13998] bridge0: port 1(dummy0) entered disabled state [ 491.908148][T13998] dummy0: entered promiscuous mode [ 491.912466][T13998] dummy0: entered allmulticast mode [ 491.918515][T13998] bond16: (slave dummy0): Enslaving as an active interface with an up link [ 492.549511][T14011] lo speed is unknown, defaulting to 1000 [ 492.800537][T13284] usb 11-1: new high-speed USB device number 16 using dummy_hcd [ 492.957678][T13284] usb 11-1: Using ep0 maxpacket: 16 [ 492.964954][T13284] usb 11-1: config 0 has no interfaces? [ 492.974316][T13284] usb 11-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 492.980815][T13284] usb 11-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 492.986393][T13284] usb 11-1: Manufacturer: syz [ 492.997089][T13284] usb 11-1: config 0 descriptor?? [ 493.270488][T13284] usb 11-1: USB disconnect, device number 16 [ 493.388479][T14026] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2256'. [ 493.427372][T14022] lo speed is unknown, defaulting to 1000 [ 495.542625][T14053] netlink: 'syz.3.2263': attribute type 7 has an invalid length. [ 495.547128][T14053] netlink: 'syz.3.2263': attribute type 8 has an invalid length. [ 495.563703][ T58] kernel read not supported for file /rfkill (pid: 58 comm: kworker/3:1) [ 495.878112][ T8028] usb 11-1: new full-speed USB device number 17 using dummy_hcd [ 496.007709][ T8028] usb 11-1: device descriptor read/64, error -71 [ 496.117596][ T58] usb 8-1: new high-speed USB device number 30 using dummy_hcd [ 496.247617][ T8028] usb 11-1: new full-speed USB device number 18 using dummy_hcd [ 496.298070][ T58] usb 8-1: Using ep0 maxpacket: 32 [ 496.304576][ T58] usb 8-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 496.317505][ T58] usb 8-1: config 4 has 0 interfaces, different from the descriptor's value: 9 [ 496.323926][ T58] usb 8-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 496.327867][ T58] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.331134][ T58] usb 8-1: Product: syz [ 496.333123][ T58] usb 8-1: Manufacturer: syz [ 496.335915][ T58] usb 8-1: SerialNumber: syz [ 496.397722][ T8028] usb 11-1: device descriptor read/64, error -71 [ 496.509022][ T8028] usb usb11-port1: attempt power cycle [ 496.721520][ T58] usb 8-1: USB disconnect, device number 30 [ 496.859583][ T8028] usb 11-1: new full-speed USB device number 19 using dummy_hcd [ 496.878346][ T8028] usb 11-1: device descriptor read/8, error -71 [ 496.909393][T14080] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2273'. [ 496.952912][ T40] audit: type=1800 audit(1780649893.822:1579): pid=14080 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.2273" name="bus" dev="overlay" ino=337 res=0 errno=0 [ 497.119006][ T8028] usb 11-1: new full-speed USB device number 20 using dummy_hcd [ 497.141083][ T8028] usb 11-1: device descriptor read/8, error -71 [ 497.248491][ T8028] usb usb11-port1: unable to enumerate USB device [ 498.387800][T14100] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2281'. [ 498.724291][T14107] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2284'. [ 498.784319][ T5824] usb 13-1: new high-speed USB device number 5 using dummy_hcd [ 498.797137][ T5860] Process accounting resumed [ 498.937578][ T5824] usb 13-1: Using ep0 maxpacket: 16 [ 498.943738][ T5824] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 498.953483][ T5824] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 498.963649][ T5824] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 498.974063][ T5824] usb 13-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 498.986775][ T5824] usb 13-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 498.998475][ T5824] usb 13-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 499.007529][ T5824] usb 13-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 499.015398][ T5824] usb 13-1: Manufacturer: syz [ 499.033144][ T5824] usb 13-1: config 0 descriptor?? [ 499.176467][T14121] netlink: 16186 bytes leftover after parsing attributes in process `syz.6.2288'. [ 499.259457][T14102] overlayfs: missing 'lowerdir' [ 499.326824][T14122] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2282'. [ 499.349015][T14122] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 499.532518][T14122] bond1 (unregistering): Released all slaves [ 499.708505][T14104] Process accounting resumed [ 500.127734][ T5824] rc_core: IR keymap rc-hauppauge not found [ 500.314727][ T5824] Registered IR keymap rc-empty [ 500.320098][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.347910][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.378912][ T5824] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/rc/rc0 [ 500.391751][ T5824] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/rc/rc0/input50 [ 500.415738][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.462782][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.477933][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.497665][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.517883][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.547555][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.570172][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.599931][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.620360][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.663026][ T5824] mceusb 13-1:0.0: Error: mce write submit urb error = -90 [ 500.685766][ T5824] mceusb 13-1:0.0: Registered with mce emulator interface version 1 [ 500.695277][ T5824] mceusb 13-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 500.700478][T14143] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 500.703646][T14143] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 500.711226][ T5824] usb 13-1: USB disconnect, device number 5 [ 500.714389][T14143] vhci_hcd vhci_hcd.0: Device attached [ 500.779004][T14143] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.806526][T14152] netlink: 'syz.6.2296': attribute type 10 has an invalid length. [ 500.826114][T14152] netlink: 'syz.6.2296': attribute type 10 has an invalid length. [ 500.914925][T14153] syzkaller0: entered promiscuous mode [ 500.918982][T14153] syzkaller0: entered allmulticast mode [ 501.007796][ T29] usb 44-1: SetAddress Request (10) to port 0 [ 501.011460][ T29] usb 44-1: new SuperSpeed USB device number 10 using vhci_hcd [ 501.321358][T14146] vhci_hcd: connection reset by peer [ 501.325262][ T13] vhci_hcd vhci_hcd.3: stop threads [ 501.328185][ T13] vhci_hcd vhci_hcd.3: release socket [ 501.332974][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 502.183557][T14168] 9p: Bad value for 'wfdno' [ 502.715571][T14180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2304'. [ 502.762553][T14182] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2305'. [ 503.135668][T14188] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2307'. [ 503.371958][T14191] 9p: Bad value for 'rfdno' [ 505.044776][T14202] netlink: 36 bytes leftover after parsing attributes in process `syz.9.2312'. [ 505.690740][T14207] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2314'. [ 506.112608][ T29] usb 44-1: device descriptor read/8, error -110 [ 506.129459][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 506.132309][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 506.603250][T14220] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2317'. [ 506.758177][ T29] usb usb44-port1: attempt power cycle [ 507.351701][ T29] usb usb44-port1: unable to enumerate USB device [ 507.995791][T14236] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2322'. qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 509.381715][T14257] netlink: 36 bytes leftover after parsing attributes in process `syz.8.2327'. [ 510.023253][T14261] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2328'. [ 510.557637][ T29] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 510.717588][ T29] usb 8-1: Using ep0 maxpacket: 16 [ 510.730762][ T29] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 510.743601][ T29] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 510.754867][ T29] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 510.757734][T14268] bridge0: port 2(bridge_slave_1) entered disabled state [ 510.764168][ T29] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 510.770525][T14268] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.773618][ T29] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 510.802517][ T29] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 510.809229][ T29] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 510.818771][ T29] usb 8-1: Manufacturer: syz [ 510.861763][ T29] usb 8-1: config 0 descriptor?? [ 511.107538][T14265] overlayfs: missing 'lowerdir' [ 511.126467][T14265] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2329'. [ 511.220116][T14268] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 511.251764][T14268] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 512.064483][T14277] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2332'. [ 512.177492][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 512.253051][T14279] netlink: 'syz.6.2332': attribute type 10 has an invalid length. [ 512.257965][T14279] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2332'. [ 512.628833][T14265] bond17: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 512.776088][T14265] bond17 (unregistering): Released all slaves [ 512.850063][T14290] 9pnet_virtio: no channels available for device syz [ 512.933578][ T7338] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.956016][ T7338] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.962239][ T7338] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.967031][ T7338] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.177831][ T29] rc_core: IR keymap rc-hauppauge not found [ 513.195395][ T29] Registered IR keymap rc-empty [ 513.202813][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 513.367514][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 513.388546][ T29] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 513.395154][ T29] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input51 [ 513.420200][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 513.447733][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 513.467746][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 513.652458][T14305] overlayfs: missing 'lowerdir' [ 514.159183][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 514.188075][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 514.207728][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 514.227580][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 514.247627][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 514.277679][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 514.308063][ T29] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 514.330246][ T29] mceusb 8-1:0.0: Registered with mce emulator interface version 1 [ 514.334992][ T29] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 514.369317][ T29] usb 8-1: USB disconnect, device number 31 [ 514.505610][T14327] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 514.523350][T14327] Cannot find map_set index 2 as target [ 515.145346][T14320] xt_bpf: check failed: parse error [ 515.689652][T14355] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 515.819138][ T9705] usb 14-1: new high-speed USB device number 2 using dummy_hcd [ 515.977573][ T9705] usb 14-1: Using ep0 maxpacket: 16 [ 516.111531][T14362] 8021q: VLANs not supported on gre0 [ 516.248394][ T9705] usb 14-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 516.556943][T14365] can: request_module (can-proto-0) failed. [ 516.910684][ T9705] usb 14-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 516.915462][ T9705] usb 14-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 516.920673][ T9705] usb 14-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 516.925898][ T9705] usb 14-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 516.935547][ T9705] usb 14-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 516.939762][ T9705] usb 14-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 516.943199][ T9705] usb 14-1: Manufacturer: syz [ 516.948131][ T9705] usb 14-1: config 0 descriptor?? [ 516.985468][T14374] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2358'. [ 517.101527][T14376] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2359'. [ 517.145690][T14380] netlink: 'syz.8.2361': attribute type 30 has an invalid length. [ 517.217742][ T9705] rc_core: IR keymap rc-hauppauge not found [ 517.221984][ T9705] Registered IR keymap rc-empty [ 517.224408][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.247796][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.280336][ T9705] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.9/usb14/14-1/14-1:0.0/rc/rc0 [ 517.289599][ T9705] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.9/usb14/14-1/14-1:0.0/rc/rc0/input52 [ 517.303975][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.328234][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.348451][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.368343][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.369589][T14353] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2351'. [ 517.390793][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.425791][T14353] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 517.427623][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.447775][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.466312][T14353] bond2 (unregistering): Released all slaves [ 517.478160][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.512507][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.593657][T14400] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2366'. [ 517.667791][T14401] netlink: 'syz.6.2366': attribute type 10 has an invalid length. [ 517.671389][T14401] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2366'. [ 517.739786][ T8581] usb 13-1: new high-speed USB device number 6 using dummy_hcd [ 517.758990][ T9705] mceusb 14-1:0.0: Error: mce write submit urb error = -90 [ 517.899745][ T8581] usb 13-1: Using ep0 maxpacket: 16 [ 517.906615][ T8581] usb 13-1: config 127 has an invalid interface number: 124 but max is 0 [ 517.914209][ T8581] usb 13-1: config 127 has no interface number 0 [ 517.916430][ T8581] usb 13-1: config 127 interface 124 has no altsetting 0 [ 517.925008][ T8581] usb 13-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 517.934453][ T8581] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.940615][ T8581] usb 13-1: Product: syz [ 517.941986][ T8581] usb 13-1: Manufacturer: syz [ 517.945757][ T8581] usb 13-1: SerialNumber: syz [ 518.275525][T14391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.287950][T14391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.442945][ T9705] mceusb 14-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 518.460952][ T9705] mceusb 14-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 518.468267][ T9705] usb 14-1: USB disconnect, device number 2 [ 518.604228][ T0] NOHZ tick-stop error: local softirq work is pending, handler #302!!! [ 519.094974][ T40] audit: type=1800 audit(1780649915.962:1580): pid=14417 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2369" name="SYSV00000000" dev="hugetlbfs" ino=3 res=0 errno=0 [ 519.330337][T14433] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2375'. [ 519.466545][ T8581] usb 13-1: reset high-speed USB device number 6 using dummy_hcd [ 519.643261][T14439] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 519.684431][ T8581] usb 13-1: unable to get BOS descriptor or descriptor too short [ 519.694896][ T8581] usb 13-1: device firmware changed [ 519.708205][ T8581] usb 13-1: USB disconnect, device number 6 [ 520.187735][T14451] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2380'. [ 520.191505][T14451] netlink: 348 bytes leftover after parsing attributes in process `syz.6.2380'. [ 520.195298][T14451] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2380'. [ 520.198886][T14451] netlink: 348 bytes leftover after parsing attributes in process `syz.6.2380'. [ 521.368118][ T5860] usb 13-1: new high-speed USB device number 7 using dummy_hcd [ 521.528578][ T5860] usb 13-1: Using ep0 maxpacket: 32 [ 521.536884][ T5860] usb 13-1: unable to get BOS descriptor or descriptor too short [ 521.547243][ T5860] usb 13-1: config 8 has an invalid interface number: 188 but max is 0 [ 521.552278][ T5860] usb 13-1: config 8 has no interface number 0 [ 521.557844][ T5860] usb 13-1: config 8 interface 188 has no altsetting 0 [ 521.584508][ T5860] usb 13-1: string descriptor 0 read error: -22 [ 521.588407][ T5860] usb 13-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 521.598747][ T5860] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.631125][ T5860] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 521.635728][ T5860] dw2102: su3000_power_ctrl: 1, initialized 0 [ 521.642782][ T5860] dvb-usb: bulk message failed: -22 (2/0) [ 521.659045][ T5860] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 521.665305][ T5860] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 521.669421][ T5860] usb 13-1: media controller created [ 521.675636][ T5860] dvb-usb: bulk message failed: -22 (6/0) [ 521.679934][ T5860] dw2102: i2c transfer failed. [ 521.690840][ T5860] dvb-usb: bulk message failed: -22 (6/0) [ 521.699220][ T5860] dw2102: i2c transfer failed. [ 521.700931][ T5860] dvb-usb: bulk message failed: -22 (6/0) [ 521.710298][ T5860] dw2102: i2c transfer failed. [ 521.712186][ T5860] dvb-usb: bulk message failed: -22 (6/0) [ 521.720614][ T5860] dw2102: i2c transfer failed. [ 521.722351][ T5860] dvb-usb: bulk message failed: -22 (6/0) [ 521.727559][ T5860] dw2102: i2c transfer failed. [ 521.732318][ T5860] dvb-usb: bulk message failed: -22 (6/0) [ 521.737334][ T5860] dw2102: i2c transfer failed. [ 521.742959][ T5860] dvb-usb: MAC address: 02:02:02:02:02:02 [ 521.775810][ T5860] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 521.799658][ T5860] dvb-usb: bulk message failed: -22 (3/0) [ 521.807540][ T5860] dw2102: command 0x0e transfer failed. [ 521.810169][ T5860] dvb-usb: bulk message failed: -22 (3/0) [ 521.812933][ T5860] dw2102: command 0x0e transfer failed. [ 521.854717][T14485] 8021q: adding VLAN 0 to HW filter on device bond17 [ 521.871456][T14485] bond17: entered promiscuous mode [ 521.873820][T14485] bond17: entered allmulticast mode [ 521.890188][T14485] bond16: (slave dummy0): Releasing backup interface [ 521.898055][T14485] dummy0: left promiscuous mode [ 521.902925][T14485] dummy0: left allmulticast mode [ 521.921471][T14485] dummy0: entered promiscuous mode [ 521.924934][T14485] dummy0: entered allmulticast mode [ 521.927999][T14485] bond17: (slave dummy0): Enslaving as an active interface with an up link [ 522.128659][ T5860] dvb-usb: bulk message failed: -22 (3/0) [ 522.132070][ T5860] dw2102: command 0x0e transfer failed. [ 522.141526][ T5860] dvb-usb: bulk message failed: -22 (3/0) [ 522.143468][T14492] openvswitch: netlink: VXLAN extension message has 12 unknown bytes. [ 522.147110][ T5860] dw2102: command 0x0e transfer failed. [ 522.156073][ T5860] dvb-usb: bulk message failed: -22 (1/0) [ 522.161223][ T5860] dw2102: command 0x51 transfer failed. [ 522.167585][T14475] dvb-usb: bulk message failed: -22 (5/0) [ 522.174240][T14475] dw2102: i2c transfer failed. [ 522.207508][ T5860] DVB: Unable to find symbol ds3000_attach() [ 522.208147][T14497] netlink: 'syz.9.2395': attribute type 1 has an invalid length. [ 522.212387][ T5860] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 522.231298][T14495] kAFS: unable to lookup cell '.,c¾Ì' [ 522.298180][ T5107] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 522.323169][ T5107] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 522.328229][ T5860] rc_core: IR keymap rc-su3000 not found [ 522.329453][ T5107] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 522.330735][ T5860] Registered IR keymap rc-empty [ 522.351381][ T5107] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 522.356345][ T5107] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 522.357055][ T5860] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.8/usb13/13-1/rc/rc0 [ 522.365854][T14503] __nla_validate_parse: 6 callbacks suppressed [ 522.365904][T14503] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2397'. [ 522.376959][T14503] bridge_slave_0: left allmulticast mode [ 522.395203][ T5860] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.8/usb13/13-1/rc/rc0/input53 [ 522.395398][T14503] bridge_slave_0: left promiscuous mode [ 522.408234][ T5860] dvb-usb: schedule remote query interval to 150 msecs. [ 522.419891][T14503] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.422544][ T5860] dw2102: su3000_power_ctrl: 0, initialized 1 [ 522.437716][ T5860] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 522.452931][ T5860] usb 13-1: USB disconnect, device number 7 [ 522.579518][ T5860] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 523.028257][ T7338] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.037148][ T7338] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 523.331423][ T7338] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.335842][ T7338] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 523.716984][T14500] lo speed is unknown, defaulting to 1000 [ 523.969024][ T5107] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 523.975493][ T5107] Bluetooth: hci4: Injecting HCI hardware error event [ 523.986741][ T5763] Bluetooth: hci4: hardware error 0x00 [ 524.280219][T14526] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2401'. [ 524.326634][ T7338] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.339946][ T7338] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 524.426905][ T5107] Bluetooth: hci6: command tx timeout [ 524.481607][ T7338] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.486112][ T7338] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 524.792568][T14539] binder: 14534:14539 ioctl 5408 0 returned -22 [ 525.025500][T14500] bridge0: port 1(bridge_slave_0) entered blocking state [ 525.031552][T14500] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.038406][T14500] bridge_slave_0: entered allmulticast mode [ 525.049145][T14500] bridge_slave_0: entered promiscuous mode [ 525.068897][T14500] bridge0: port 2(bridge_slave_1) entered blocking state [ 525.076623][T14553] netlink: 24 bytes leftover after parsing attributes in process `syz.9.2407'. [ 525.079046][T14500] bridge0: port 2(bridge_slave_1) entered disabled state [ 525.087783][T14500] bridge_slave_1: entered allmulticast mode [ 525.094472][T14500] bridge_slave_1: entered promiscuous mode [ 525.135273][T14543] lo speed is unknown, defaulting to 1000 [ 525.137597][ T5824] usb 11-1: new high-speed USB device number 21 using dummy_hcd [ 525.208344][T14500] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 525.230189][T14500] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 525.297696][ T5824] usb 11-1: Using ep0 maxpacket: 16 [ 525.301611][ T5824] usb 11-1: config 0 has no interfaces? [ 525.305161][ T5824] usb 11-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 525.312638][ T5824] usb 11-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 525.317037][ T5824] usb 11-1: Manufacturer: syz [ 525.328380][ T5824] usb 11-1: config 0 descriptor?? [ 525.507019][ T7338] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 525.513944][ T7338] ip6gretap1 (unregistering): left allmulticast mode [ 525.665750][ T7338] bond2 (unregistering): (slave geneve2): Releasing active interface [ 525.729016][ T7338] bond0 (unregistering): Released all slaves [ 525.738292][ T7338] bond1 (unregistering): Released all slaves [ 525.750691][ T7338] bond2 (unregistering): Released all slaves [ 525.761401][ T7338] bond3 (unregistering): (slave veth3): Releasing active interface [ 525.767121][ T7338] bond3 (unregistering): Released all slaves [ 525.785175][ T7338] bond4 (unregistering): (slave veth5): Releasing active interface [ 525.794157][ T7338] bond4 (unregistering): Released all slaves [ 525.809204][ T7338] bond5 (unregistering): Released all slaves [ 525.827011][ T7338] bond6 (unregistering): Released all slaves [ 525.841997][ T7338] bond7 (unregistering): Released all slaves [ 525.856956][ T7338] bond8 (unregistering): Released all slaves [ 525.880768][ T7338] bond9 (unregistering): Released all slaves [ 525.897137][ T7338] bond10 (unregistering): Released all slaves [ 525.914630][ T7338] bond11 (unregistering): Released all slaves [ 525.931250][ T7338] bond12 (unregistering): Released all slaves [ 525.942444][ T7338] bond13 (unregistering): Released all slaves [ 525.952855][ T7338] bond14 (unregistering): Released all slaves [ 525.968558][ T7338] bond15 (unregistering): Released all slaves [ 525.984952][ T7338] bond16 (unregistering): Released all slaves [ 526.003318][ T7338] bond17 (unregistering): (slave dummy0): Releasing backup interface [ 526.012738][ T7338] dummy0: left promiscuous mode [ 526.014859][ T7338] dummy0: left allmulticast mode [ 526.018460][ T7338] bond17 (unregistering): Released all slaves [ 526.036099][T14500] team0: Port device team_slave_0 added [ 526.151384][T14500] team0: Port device team_slave_1 added [ 526.246508][ T7338] : left promiscuous mode [ 526.272559][ T5763] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 526.331936][ T9705] usb 11-1: USB disconnect, device number 21 [ 526.472242][T14500] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 526.478580][T14500] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 526.495655][T14500] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 526.500587][ T5763] Bluetooth: hci6: command tx timeout [ 526.528883][ T7338] tipc: Disabling bearer [ 526.533327][ T7338] tipc: Disabling bearer [ 526.698617][ T7338] tipc: Left network mode [ 526.705061][T14500] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 526.729802][T14500] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 526.751864][T14500] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 526.833821][T14500] hsr_slave_0: entered promiscuous mode [ 526.837751][T14500] hsr_slave_1: entered promiscuous mode [ 526.841228][T14500] debugfs: 'hsr0' already exists in 'hsr' [ 526.843588][T14500] Cannot create hsr debugfs directory [ 527.309740][T14586] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2417'. [ 527.392651][T14588] netlink: 'syz.6.2417': attribute type 10 has an invalid length. [ 527.396479][T14588] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2417'. [ 527.552575][ T5459] 8021q: adding VLAN 0 to HW filter on device eth18 [ 527.862372][T14603] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2421'. [ 528.231917][ T7103] tipc: Subscription rejected, illegal request [ 528.265759][T14612] lo speed is unknown, defaulting to 1000 [ 528.462835][T14614] syzkaller0: entered promiscuous mode [ 528.465397][T14614] syzkaller0: entered allmulticast mode [ 528.508445][ T5824] usb 13-1: new high-speed USB device number 8 using dummy_hcd [ 528.583942][ T5763] Bluetooth: hci6: command tx timeout [ 528.660996][ T5824] usb 13-1: Using ep0 maxpacket: 16 [ 528.665089][T14614] tipc: Enabled bearer , priority 0 [ 528.665621][ T5824] usb 13-1: config 0 has no interfaces? [ 528.673322][ T5824] usb 13-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 528.679185][ T5824] usb 13-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 528.683311][ T5824] usb 13-1: Manufacturer: syz [ 528.695783][ T5824] usb 13-1: config 0 descriptor?? [ 528.719540][ T8581] kernel read not supported for file /rfkill (pid: 8581 comm: kworker/0:5) [ 528.881281][T14633] random: crng reseeded on system resumption [ 529.011243][ T5824] usb 13-1: USB disconnect, device number 8 [ 529.165408][T14500] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 529.172781][T14500] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 529.177167][T14500] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 529.186439][T14500] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 529.194717][T14500] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 529.202387][T14500] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 529.210468][T14613] tipc: Resetting bearer [ 529.235911][T14613] tipc: Disabling bearer [ 529.287594][T14500] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 529.300151][T14500] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 529.328928][ T40] audit: type=1800 audit(1780649926.202:1581): pid=14624 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.2425" name="bus" dev="ramfs" ino=55894 res=0 errno=0 [ 529.349816][ T7338] ------------[ cut here ]------------ [ 529.355558][ T7338] sdata->crypto_tx_tailroom_needed_cnt != master->crypto_tx_tailroom_needed_cnt [ 529.355578][ T7338] WARNING: net/mac80211/key.c:1163 at ieee80211_free_keys+0x4ed/0x640, CPU#1: kworker/u32:15/7338 [ 529.364027][ T7338] Modules linked in: [ 529.369249][ T7338] CPU: 1 UID: 0 PID: 7338 Comm: kworker/u32:15 Tainted: G L syzkaller #0 PREEMPT(full) [ 529.374244][ T7338] Tainted: [L]=SOFTLOCKUP [ 529.376013][ T7338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 529.380586][ T7338] Workqueue: netns cleanup_net [ 529.383429][ T7338] RIP: 0010:ieee80211_free_keys+0x4ed/0x640 [ 529.386334][ T7338] Code: c0 74 08 3c 03 0f 8e 26 01 00 00 8b 9d 78 fb ff ff 44 89 ef 89 de e8 c2 05 ff f6 41 39 dd 0f 84 6b fe ff ff e8 c4 0b ff f6 90 <0f> 0b 90 e9 5d fe ff ff e8 b6 0b ff f6 4c 89 fa 48 b8 00 00 00 00 [ 529.394263][ T7338] RSP: 0018:ffffc90004897378 EFLAGS: 00010293 [ 529.397010][ T7338] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8b08efce [ 529.400960][ T7338] RDX: ffff888046d70000 RSI: ffffffff8b08efdc RDI: ffff888046d70000 [ 529.404411][ T7338] RBP: ffff88801b661c78 R08: 0000000000000004 R09: 0000000000000001 [ 529.407966][ T7338] R10: 0000000000000000 R11: ffffffff81d4bcc2 R12: 1ffff92000912e71 [ 529.411887][ T7338] R13: 0000000000000001 R14: ffffc900048973a8 R15: ffffc90004897390 [ 529.415105][ T7338] FS: 0000000000000000(0000) GS:ffff88809728a000(0000) knlGS:0000000000000000 [ 529.419297][ T7338] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 529.422190][ T7338] CR2: 00000000315e5ff8 CR3: 0000000029077000 CR4: 0000000000352ef0 [ 529.425903][ T7338] Call Trace: [ 529.427665][ T7338] [ 529.428909][ T7338] ? __pfx_ieee80211_free_keys+0x10/0x10 [ 529.431025][ T7338] ? mark_held_locks+0x40/0x70 [ 529.432812][ T7338] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 529.435453][ T7338] ieee80211_do_stop+0x1ba9/0x2940 [ 529.437950][ T7338] ? rcu_is_watching+0x12/0xc0 [ 529.440419][ T7338] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 529.443418][ T7338] ? do_raw_spin_lock+0x128/0x260 [ 529.445890][ T7338] ? mark_held_locks+0x40/0x70 [ 529.448521][ T7338] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 529.451137][ T7338] ? __pfx_ieee80211_stop+0x10/0x10 [ 529.453654][ T7338] ieee80211_stop+0x165/0x300 [ 529.457306][ T7338] ? __pfx_ieee80211_stop+0x10/0x10 [ 529.460204][ T7338] __dev_close_many+0x312/0x700 [ 529.463088][ T7338] ? __pfx___dev_close_many+0x10/0x10 [ 529.465793][ T7338] ? __lock_acquire+0x4a5/0x2630 [ 529.468238][ T7338] ? __schedule+0x12a7/0x67a0 [ 529.470330][ T7338] ? find_held_lock+0x2b/0x80 [ 529.472481][ T7338] netif_close_many+0x233/0x630 [ 529.474805][ T7338] ? lock_acquire+0x1b1/0x370 [ 529.477629][ T7338] ? __pfx_netif_close_many+0x10/0x10 [ 529.480134][ T7338] ? rcu_is_watching+0x12/0xc0 [ 529.482307][ T7338] netif_close+0x17f/0x230 [ 529.484136][ T7338] ? __pfx_netif_close+0x10/0x10 [ 529.486103][ T7338] ? ieee80211_unregister_hw+0x4d/0x360 [ 529.488513][ T7338] dev_close+0xaa/0x240 [ 529.490226][ T7338] cfg80211_shutdown_all_interfaces+0xb4/0x230 [ 529.493098][ T7338] ieee80211_remove_interfaces+0xc3/0x6f0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 529.496175][ T7338] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 529.499589][ T7338] ieee80211_unregister_hw+0x55/0x360 [ 529.501938][ T7338] hwsim_exit_net+0x88e/0x1530 [ 529.504279][ T7338] ? __pfx_hwsim_exit_net+0x10/0x10 [ 529.506847][ T7338] ? ip_vs_sync_net_cleanup+0x84/0x90 [ 529.509428][ T7338] ? __ip_vs_dev_cleanup_batch+0x21e/0x2a0 [ 529.512020][ T7338] ? __pfx_hwsim_exit_net+0x10/0x10 [ 529.514262][ T7338] ops_undo_list+0x2ee/0xab0 [ 529.516295][ T7338] ? __pfx_ops_undo_list+0x10/0x10 [ 529.518354][ T7338] ? idr_destroy+0x62/0x2e0 [ 529.520006][ T7338] cleanup_net+0x499/0x920 [ 529.521631][ T7338] ? __pfx_cleanup_net+0x10/0x10 [ 529.523405][ T7338] ? rcu_is_watching+0x12/0xc0 [ 529.525170][ T7338] process_one_work+0xa0e/0x1980 [ 529.526963][ T7338] ? __pfx_process_one_work+0x10/0x10 [ 529.529552][ T7338] ? __pfx_cleanup_net+0x10/0x10 [ 529.531655][ T7338] worker_thread+0x5ef/0xe50 [ 529.534208][ T7338] ? __pfx_worker_thread+0x10/0x10 [ 529.536498][ T7338] ? kthread+0x13a/0x450 [ 529.538619][ T7338] ? __pfx_worker_thread+0x10/0x10 [ 529.540835][ T7338] kthread+0x370/0x450 [ 529.542538][ T7338] ? __pfx_kthread+0x10/0x10 [ 529.544504][ T7338] ret_from_fork+0x72b/0xd50 [ 529.546847][ T7338] ? __pfx_ret_from_fork+0x10/0x10 [ 529.549914][ T7338] ? __switch_to+0x800/0x1100 [ 529.552636][ T7338] ? __pfx_kthread+0x10/0x10 [ 529.555059][ T7338] ret_from_fork_asm+0x1a/0x30 [ 529.557215][ T7338] [ 529.558839][ T7338] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 529.562290][ T7338] CPU: 1 UID: 0 PID: 7338 Comm: kworker/u32:15 Tainted: G L syzkaller #0 PREEMPT(full) [ 529.567678][ T7338] Tainted: [L]=SOFTLOCKUP [ 529.569473][ T7338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 529.576805][ T7338] Workqueue: netns cleanup_net [ 529.579709][ T7338] Call Trace: [ 529.581439][ T7338] [ 529.582762][ T7338] dump_stack_lvl+0x100/0x190 [ 529.584833][ T7338] vpanic+0x552/0x970 [ 529.586665][ T7338] ? __pfx_vpanic+0x10/0x10 [ 529.588662][ T7338] panic+0xd1/0xe0 [ 529.590252][ T7338] ? __pfx_panic+0x10/0x10 [ 529.592293][ T7338] ? check_panic_on_warn+0x1f/0x90 [ 529.594733][ T7338] check_panic_on_warn.cold+0x19/0x34 [ 529.596930][ T7338] ? ieee80211_free_keys+0x4ed/0x640 [ 529.599064][ T7338] __warn.cold+0x191/0x328 [ 529.601223][ T7338] __report_bug+0x296/0x3d0 [ 529.603362][ T7338] ? ieee80211_free_keys+0x4ed/0x640 [ 529.605900][ T7338] ? __pfx___report_bug+0x10/0x10 [ 529.607983][ T7338] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 529.610235][ T7338] ? __pfx___schedule+0x10/0x10 [ 529.612071][ T7338] ? find_held_lock+0x2b/0x80 [ 529.613868][ T7338] ? schedule+0x2bf/0x390 [ 529.615569][ T7338] ? ieee80211_free_keys+0x4ed/0x640 [ 529.617597][ T7338] report_bug+0xb2/0x220 [ 529.619320][ T7338] ? ieee80211_free_keys+0x4ed/0x640 [ 529.622049][ T7338] handle_bug+0x16a/0x2a0 [ 529.624659][ T7338] exc_invalid_op+0x17/0x50 [ 529.626992][ T7338] asm_exc_invalid_op+0x1a/0x20 [ 529.629275][ T7338] RIP: 0010:ieee80211_free_keys+0x4ed/0x640 [ 529.631785][ T7338] Code: c0 74 08 3c 03 0f 8e 26 01 00 00 8b 9d 78 fb ff ff 44 89 ef 89 de e8 c2 05 ff f6 41 39 dd 0f 84 6b fe ff ff e8 c4 0b ff f6 90 <0f> 0b 90 e9 5d fe ff ff e8 b6 0b ff f6 4c 89 fa 48 b8 00 00 00 00 [ 529.640838][ T7338] RSP: 0018:ffffc90004897378 EFLAGS: 00010293 [ 529.644481][ T7338] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8b08efce [ 529.648595][ T7338] RDX: ffff888046d70000 RSI: ffffffff8b08efdc RDI: ffff888046d70000 [ 529.652078][ T7338] RBP: ffff88801b661c78 R08: 0000000000000004 R09: 0000000000000001 [ 529.656015][ T7338] R10: 0000000000000000 R11: ffffffff81d4bcc2 R12: 1ffff92000912e71 [ 529.660281][ T7338] R13: 0000000000000001 R14: ffffc900048973a8 R15: ffffc90004897390 [ 529.664083][ T7338] ? finish_task_switch.isra.0+0x152/0x1010 [ 529.666594][ T7338] ? ieee80211_free_keys+0x4de/0x640 [ 529.668876][ T7338] ? ieee80211_free_keys+0x4ec/0x640 [ 529.671175][ T7338] ? ieee80211_free_keys+0x4ec/0x640 [ 529.673368][ T7338] ? __pfx_ieee80211_free_keys+0x10/0x10 [ 529.676138][ T7338] ? mark_held_locks+0x40/0x70 [ 529.678520][ T7338] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 529.681607][ T7338] ieee80211_do_stop+0x1ba9/0x2940 [ 529.683930][ T7338] ? rcu_is_watching+0x12/0xc0 [ 529.685864][ T7338] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 529.688216][ T7338] ? do_raw_spin_lock+0x128/0x260 [ 529.690314][ T7338] ? mark_held_locks+0x40/0x70 [ 529.692551][ T7338] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 529.695578][ T7338] ? __pfx_ieee80211_stop+0x10/0x10 [ 529.698531][ T7338] ieee80211_stop+0x165/0x300 [ 529.700946][ T7338] ? __pfx_ieee80211_stop+0x10/0x10 [ 529.703109][ T7338] __dev_close_many+0x312/0x700 [ 529.705283][ T7338] ? __pfx___dev_close_many+0x10/0x10 [ 529.707632][ T7338] ? __lock_acquire+0x4a5/0x2630 [ 529.709885][ T7338] ? __schedule+0x12a7/0x67a0 [ 529.712790][ T7338] ? find_held_lock+0x2b/0x80 [ 529.715726][ T7338] netif_close_many+0x233/0x630 [ 529.718647][ T7338] ? lock_acquire+0x1b1/0x370 [ 529.721114][ T7338] ? __pfx_netif_close_many+0x10/0x10 [ 529.723826][ T7338] ? rcu_is_watching+0x12/0xc0 [ 529.725948][ T7338] netif_close+0x17f/0x230 [ 529.727921][ T7338] ? __pfx_netif_close+0x10/0x10 [ 529.730402][ T7338] ? ieee80211_unregister_hw+0x4d/0x360 [ 529.733490][ T7338] dev_close+0xaa/0x240 [ 529.735854][ T7338] cfg80211_shutdown_all_interfaces+0xb4/0x230 [ 529.738891][ T7338] ieee80211_remove_interfaces+0xc3/0x6f0 [ 529.741593][ T7338] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 529.744181][ T7338] ieee80211_unregister_hw+0x55/0x360 [ 529.746413][ T7338] hwsim_exit_net+0x88e/0x1530 [ 529.748520][ T7338] ? __pfx_hwsim_exit_net+0x10/0x10 [ 529.750461][ T7338] ? ip_vs_sync_net_cleanup+0x84/0x90 [ 529.752459][ T7338] ? __ip_vs_dev_cleanup_batch+0x21e/0x2a0 [ 529.754653][ T7338] ? __pfx_hwsim_exit_net+0x10/0x10 [ 529.757064][ T7338] ops_undo_list+0x2ee/0xab0 [ 529.759493][ T7338] ? __pfx_ops_undo_list+0x10/0x10 [ 529.762002][ T7338] ? idr_destroy+0x62/0x2e0 [ 529.764596][ T7338] cleanup_net+0x499/0x920 [ 529.766485][ T7338] ? __pfx_cleanup_net+0x10/0x10 [ 529.768232][ T7338] ? rcu_is_watching+0x12/0xc0 [ 529.769979][ T7338] process_one_work+0xa0e/0x1980 [ 529.771757][ T7338] ? __pfx_process_one_work+0x10/0x10 [ 529.773784][ T7338] ? __pfx_cleanup_net+0x10/0x10 [ 529.775734][ T7338] worker_thread+0x5ef/0xe50 [ 529.777707][ T7338] ? __pfx_worker_thread+0x10/0x10 [ 529.779860][ T7338] ? kthread+0x13a/0x450 [ 529.781663][ T7338] ? __pfx_worker_thread+0x10/0x10 [ 529.783819][ T7338] kthread+0x370/0x450 [ 529.785821][ T7338] ? __pfx_kthread+0x10/0x10 [ 529.788138][ T7338] ret_from_fork+0x72b/0xd50 [ 529.790332][ T7338] ? __pfx_ret_from_fork+0x10/0x10 [ 529.792491][ T7338] ? __switch_to+0x800/0x1100 [ 529.794446][ T7338] ? __pfx_kthread+0x10/0x10 [ 529.796473][ T7338] ret_from_fork_asm+0x1a/0x30 [ 529.798508][ T7338] [ 529.800678][ T7338] Kernel Offset: disabled [ 529.802992][ T7338] Rebooting in 86400 seconds..