last executing test programs: 3.141823627s ago: executing program 3 (id=4): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) bind$can_raw(r3, &(0x7f0000000000)={0x1d, r4}, 0x10) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f0000000200)=[{{0x4}, {0x2, 0x0, 0x1, 0x1}}], 0x8) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x2710, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000340)={0x5, 0x0, [{0x9a7, 0x0, 0x100}, {0xb65, 0x0, 0x4}, {0xb55, 0x0, 0x3}, {0x3f6, 0x0, 0x6}, {0x4b564d01, 0x0, 0x200}]}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x4, 0x7, 0x8, 0x8000001000, 0x400, 0x4002004c4, 0x1001, 0x0, 0x3, 0x10, 0x0, 0x3, 0x1], 0xeeee8000, 0x140640}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.695016915s ago: executing program 3 (id=6): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) syz_open_dev$vim2m(0x0, 0x1000, 0x2) listen(0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000100)={0x1, 0x0, @ioapic={0x8082801, 0x5fa, 0x8, 0x1ff, 0x0, [{0x3, 0x6, 0x9, '\x00', 0xd}, {0x5, 0x9, 0x8, '\x00', 0x6}, {0xfe, 0x5, 0x9, '\x00', 0x5}, {0x81, 0x3, 0x8, '\x00', 0x5}, {0xc, 0xf, 0x7f, '\x00', 0x60}, {0x0, 0x0, 0x2}, {0x1, 0x9, 0x9, '\x00', 0xa}, {0xd, 0x47, 0xb, '\x00', 0x46}, {0x8, 0x5, 0x0, '\x00', 0xff}, {0x6, 0x3, 0x0, '\x00', 0x6}, {0x40, 0x4, 0x2, '\x00', 0xa3}, {0x8, 0x4, 0x19, '\x00', 0xff}, {0x3, 0x86, 0xa, '\x00', 0xf9}, {0x5, 0x4f, 0x2}, {0x68, 0x87, 0x1, '\x00', 0x7}, {0xb, 0x0, 0x23, '\x00', 0x7b}, {0x3, 0x7, 0xd1}, {0x68, 0x3, 0x2, '\x00', 0x3}, {0x8, 0x9e, 0xc0, '\x00', 0x2}, {0x3e, 0x48, 0xa, '\x00', 0x2}, {0x7, 0x1, 0x2, '\x00', 0x1}, {0x3, 0x7, 0x6, '\x00', 0x4}, {0x93, 0x9, 0x4, '\x00', 0xe6}, {0x3, 0x7f, 0xe0, '\x00', 0x47}]}}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000440)={0x1, 0x0, [{0x1, 0xfff, 0xfff, 0xffffffff, 0x9}]}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000100)={0x2, 0x0, @pic={0x0, 0x7, 0x5, 0x4, 0x0, 0x0, 0x4, 0xbb, 0x2, 0xc0, 0x6d, 0x26, 0x61, 0x7, 0x95, 0xd}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2000004, 0x31, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000140), 0x80, 0x1, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000140)={'ip_vti0\x00', &(0x7f00000000c0)={'syztnl0\x00', r5, 0x40, 0x8, 0xc9f9, 0x3, {{0x6, 0x4, 0x0, 0x36, 0x18, 0x66, 0x0, 0x6, 0x2f, 0x0, @private=0xa010102, @broadcast, {[@end]}}}}}) 2.467005517s ago: executing program 1 (id=2): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000048000000030a010200000000000000000100000009000300735a7a320000000014000480080002400000000408000140000000000900010073797a300000000008000a400000000228000000060a010400000000000000000100000008000b40000000000900010073797a30"], 0xb8}}, 0x0) 2.282215996s ago: executing program 3 (id=7): socket$netlink(0x10, 0x3, 0xf) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffff80000002, 0x12) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xc, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000300000000000000000000000000000000000000ac1414aa0009000000000000000000125c14de2dcc768e000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000fcffffffff7f400002000000000000080000000000000000010000004400050000000000000000000000000000000000fffffff83c0000"], 0xfc}}, 0x0) r3 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r3, &(0x7f0000001c00)={&(0x7f0000000140)={0xa, 0x88, 0x7, @mcast2}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000180)="671723d7c6012c", 0x7}, {&(0x7f00000001c0)="9e91d91a92dc7c8fff658bb539e2ffb332c99223a7dfe52c1f51218206f5abfd2a", 0x21}], 0x2}, 0x20008b88) 2.22642259s ago: executing program 0 (id=1): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, 0x0, 0x40) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0xca, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x100001, 0x3, 0x0, 0x5, 0x6, 0x2000001, 0x7, 0x3c5b, 0x1, 0x24, 0x8006, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0xfffffffc, 0x80008071, 0x7, 0x17, 0xd, 0x3, 0x2, 0x3e, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x312, 0xd, 0x8, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x7ffe, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0xa6d, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1fe, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0x4000a9, 0x5, 0x9, 0xac8, 0x2000af, 0xfffffffe, 0x8, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x2, 0x5, 0x42c2, 0x6, 0x6, 0x0, 0xb9, 0x4e7, 0x5, 0x2, 0x57, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x8, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0x6, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x45, 0x8, 0x30b1d693, 0x5, 0x1f40, 0x7, 0x41, 0x6c1b, 0x0, 0x804, 0xac1, 0xb1e, 0xd7, 0x9, 0xffff3441, 0xfff]}, 0x45c) syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2) syz_open_dev$vim2m(0x0, 0x40005, 0x2) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x300}], 0x20000000000000dc, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x7, 0x7, 0x3}) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x256c, 0x6d, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x74, 0x90, 0x6d, "", [{{0x9, 0x4, 0x0, 0xff, 0x1, 0x3, 0x1, 0x0, 0xf, {0x9, 0x21, 0x9, 0x1, 0x1, {0x22, 0x8aa}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xb, 0x2, 0x5d}}}}}]}}]}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) close_range(r4, r2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)={0x78, r1, 0x1, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x42, 0xe, {{{}, {}, @broadcast, @broadcast, @from_mac=@broadcast, {0x0, 0x20}}, 0xfffffffffffffffc, @random=0x2, 0x1, @void, @void, @val={0x3, 0x1, 0x95}, @void, @val={0x6, 0x2, 0x1}, @val={0x5, 0x3, {0x4, 0xab, 0x7}}, @val={0x25, 0x3, {0x0, 0x99, 0x1}}, @val={0x2a, 0x1, {0x1, 0x1, 0x1}}, @val={0x3c, 0x4, {0x0, 0x81, 0x30, 0x3}}, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16c1}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x78}}, 0x0) 2.206258542s ago: executing program 1 (id=8): socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200)=0xffffffff80000002, 0x12) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xc, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000300000000000000000000000000000000000000ac1414aa0009000000000000000000125c14de2dcc768e000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000fcffffffff7f400002000000000000080000000000000000010000004400050000000000000000000000000000000000fffffff83c0000"], 0xfc}}, 0x0) r3 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r3, &(0x7f0000001c00)={&(0x7f0000000140)={0xa, 0x88, 0x7, @mcast2}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000180)="671723d7c6012c", 0x7}, {&(0x7f00000001c0)="9e91d91a92dc7c8fff658bb539e2ffb332c99223a7dfe52c1f51218206f5abfd2a", 0x21}], 0x2}, 0x20008b88) 2.056554827s ago: executing program 1 (id=9): fsopen(&(0x7f0000000200)='9p\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x2440) ioctl$CEC_ADAP_S_LOG_ADDRS(r3, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x5, 0x4, 0x0, 0x0, "f759ca14860e4041836dd400", '\x00\x00\a\x00', "0300", '\x00', ["d5c2a7cdaeea2c6f8e00b600", "809389dc7fb3eacf821b00", "2971088d5453005a4e5200", "ff812500004000"]}) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r5 = add_key(&(0x7f00000002c0)='id_legacy\x00', &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff8) r6 = add_key(&(0x7f0000000340)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0x0, r5) keyctl$setperm(0x5, r6, 0x82004) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x84, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x48, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x38, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_LIMIT_FLAGS={0x8}, @NFTA_LIMIT_TYPE={0x8}]}}}]}, @NFT_MSG_NEWSETELEM={0x38, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xc, 0x3, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x104}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r8 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r8, 0x40146f2c, 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r8, 0x40146f2c, &(0x7f0000000040)={0x4, 0x0, 0x0, 0xb, 0x4}) keyctl$join(0x1, &(0x7f0000000240)={'syz', 0x1}) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="9a", 0x1, 0x800, &(0x7f0000000480)={0xa, 0x4e23, 0x20000000, @loopback}, 0x1c) ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x40049421, 0x1) 1.963200878s ago: executing program 3 (id=10): r0 = fsopen(&(0x7f0000000200)='9p\x00', 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) timer_create(0x3, &(0x7f0000000080)={0x0, 0x11, 0x72dd52e12af71abe, @thr={0x0, 0x0}}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r6 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$setperm(0x5, r6, 0x82004) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd) keyctl$read(0xb, r6, &(0x7f0000000240)=""/112, 0x349b7f55) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r7 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r7, 0x40146f2c, &(0x7f00000000c0)={0x100, 0x0, 0x0, 0x5, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r7, 0x40146f2c, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x3, 0x4}) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000000180)="9a", 0x1, 0x800, &(0x7f0000000480)={0xa, 0x4e23, 0x20000000, @loopback}, 0x1c) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r0], 0x40}}, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x58) r9 = accept4(r8, 0x0, 0x0, 0x0) recvmsg$qrtr(r9, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10042}, 0x1c, 0x10140) 1.770536749s ago: executing program 2 (id=3): r0 = syz_open_dev$vbi(&(0x7f0000000f40), 0x3, 0x2) ioctl$VIDIOC_DQBUF(r0, 0xc044560f, &(0x7f0000000fc0)=@multiplanar_mmap={0x80000000, 0x8, 0x4, 0x8, 0x8, {}, {0x1, 0x1, 0x2b, 0x4, 0x21, 0x9, "40fb033f"}, 0x0, 0x1, {0x0}, 0x400}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000080)={{0x1, 0x0, 0xfffffffb, 0x2, 0xfffffffc}}) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f0000000040)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000140)=0x90) write$tun(r2, &(0x7f0000000ac0)={@void, @void, @ipv6=@gre_packet={0x0, 0x6, "be5f7f", 0x1479, 0x2f, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, {[@dstopts={0x33, 0x3e, '\x00', [@padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x5}, @generic={0x1, 0xfa, "14ad230f8a2f56feb31005323b73c8d8a8c3e634ae8a30dc9e400d70e6cdaf630ccd6bd5568339f28d0599f109cf37cbf77b676532e50da0a1e11135859d27294ae95d260836fe8837a6a3850c8911ffbb8af142ad54119778b0b0aedfca4dacee25e6b4852a914b57e8ec0323b39f48d0e87166a9fe37bd728f82aa6beeb55c26372715a0d1767e1d83f4ba7f096b79536e0831a3a6cd8eefff78d498f726445098373807457e35fa6155c9636007feb44fb8fb41f7b879131c5ba2af3ebd75f33f26e004fefd03bd75bbe247e70ead320bbf6a3dfa751c839013cd285e6d0acf3b26d7ab3f9cc4e687be6c1631d87c03279e01554f8bdea03d"}, @jumbo={0xc2, 0x4, 0x4}, @generic={0x4, 0xe0, "525c9a3bf27a50da5888993b77386436d62352495c3d41616333e2bcb9cf369a0778826c502e10056bd25e431db71b934e6fa22482c3559812b17a73afe9e3fd361f0544b97eb10cf0739aaa3c06672fe1d6def4aa843dd7d77fed43524266d9983e0f7ba4341a7ac1291f480c806c33156fac96626489a11c8a3c806636461afbb8bbe5a8b5f5c4013113ba40b7cc4a8ff73377b1aa72d3ae73a4db7a4a3cd8f82c159070e5b30eea0b893dcd7d91deb70ec5340c2c9b523b08e4e7674f88bf59d7871cef5c6dac5cc8442c4db482080c41149e21ca5a46068c2bcf06816d92"}]}, @dstopts={0x2f, 0x200, '\x00', [@generic={0xf, 0x1000, "1c46efd107a8395149431ea1b12b654641fc502ecd7ab5da025ee5d52101a34bb2806e0f5fa382014c320b80f9d7b774896eb7f71d1c9025017e1e8b010722470d785b08fdd5206ac757b0c7f85e82435e794eb8ab5484dc180290d9ff753cb406a70d2b2f5378c5b9138225da92051b3fe6081a68725ce59bbeb39ccd821f0419a5aff548549726482dfe76cb4673f938ae60b566992f811d83f06e6674d7e7fc0cee4182d0df3fad5f571bf03f4003f1327c3f00c2aa2e5d9fb5522f8be1b488a8dbf55bbd92a133d0c00f685ec9e9c7a412e8e8ab746b3bac6e8ee59e0cfb4fdc81f30aa5b993e384dee4fdc432a08c00fb94a78c44adb50ebece75d3105d91f16638e8a4654889e861954486f89f1b711053310fa6eda0023f609869a579629d9eff6d8bf0a919283fe9d31e0461c16e63b6f66e50b50d0b9d487a6ef33b049d3bdf568b275f602856cacb9dcb09cecbe57239d552239265580516833c2381f24e6decbe970cac6bf4de7354558f10a0e2ffa57f2ed04e524efa5e3ec9dc3e92306457a9d4c0197d7b6d6b041d277d9c11ff23585902f9a6701c2ee7dac168dad3e379bb31423298f79f5849710e060151a7bf33dccfb3480a9422586e21d9d02727c43d9a82ad4ae3079495647af398237f29763854cb5318cd8fd491de58733a744c714d90f6772dd5c52bb908b40bc12aa9ff69bac4f63e1f9cc90ec197bf78ad3e1a5ff3215aea3818b2ab0889a781d61e9cb24f5312262e12d664b0aee0a61d80cd62e2f685e9a6af2129ff50eaba8e5bda374c715d548c9e562710a2d50c848151b4574239dba3cae7006ccca48fb9004d7cd887ee265d8d6f56e850be9ced1a73279b67b00609317cc97e1fd1211be8a299996a924115e016a0080f7fb041a228817a0359d247d115b3534af5894e81e7cfd63e37097c748e4b2a9fd8a40fd544c3205aa96d697ab02b383bb7937e37fd984944c371f61594fd77b5132c81fa38f996e3366ee4272773ae08e2ea8f992123354160e7b08ab49a7e1fa38d6cd3c19c8081c9c9e41302ceca8db929a00d7cf36a14e6e693499c12b514a24c43fb883f171a1c122f5edccdfff414ff7870e849bc93d6ac1ac4fa6734b1649dec9ba929f8487b448e8cdcbf2c54c0c88ec9f4389d8f6413ce45bc1d78dbd2ddc433156d1bd04f425251d0f7b4109e69b410c5fe696500075176da44925d33dd775e659505c0e8846be3850f72596112cefcc160c79da6119f73d7f52c1cbed18ea6d84bb2c1a97b1534e47861767235a6b0f3dd8f86a0a14db6c550b7f185d5e0d9a9472ffe9401d41940971af5854adee427685586b3af84edb7d3ac2b89247f3dcf0945b538a2e54b6a230e189713d101290947e93231cc23f003b240394741396ee13cb3bcce52b5a7db171b31a3b1c42dc49627f2e6f7cbedc437a5609ca25c3fbf25020b853edcbaaa19b6664a0b77d758f25f24b03487cdfea7d01b3bc3b60a6bf60776de41b028745bccd4e3c653cc05093a38e0b2631eba18a08f34150016852f14bc39d8fafec4d2839dfd86c49dd031110f6fde1c5f928e73884ba8ce6fb91fc35039200322e3ce3adf0afb1410b5e917e71696414836bd52ff7e929b5fa3564d864dc0c19cd64616d64c2d69dd24bd1016361a6b5cf41a3683f6b7f7644a1fc862446b34b7321d5c803fd62e5581ce1e25f28e447028e7d8927264510bc2cf068dbde001b735f27e4ca40c21d66874d7f64e82fbeb73328dc8d9b6f983a40ca0bc7a03e2d6444da8ca87c82908442073bc3842e000d17befc04078f5884e1f3f955b60a8f625ffef38dfd4a0f58903e874029bd2da325f2de3e74543706e3b29cd09d85bfb7b0689baabd5e4d941b788f04d86d2041cf4b531e948d2c9304292f3819a15fa4f82750db4d974d0e0f80f04b4ea4d243ecdbae95f87a37301bc90182c4cf6706afd1a6a569433d7bd9eac52f7d5fd3a76a37300748a7d1b8d4887d4fc32bb6055937dde15b219f49b8042d6f9f50d526887eb621005b9a037067df6ceb020d0b3ba46794a90513af89e3cc45a42b7a290d61453e28148eb606f25b2d36076172d30b7f6e352b04fdb4ae56d882a1e530c8366744ce9a5c36f89a9d7122aad420930c8328e35d37eaa6072703742b475915282781ac7003a9e25a05dddd4d2ee1948187ba3518814b81ca3aa3a3e3c8a594d06f6e84af741b5e86e4db7576e5a9a2cc95fadbb3fd0fce543c615f4682541dc11d061c2c5a20c05e44d867478b9fce8e179698ea86e6c8d81511983a69b392c3d1f266b3fbfdb57d067f6130ffe59c59ab8912fa3df37b8c6fc0e34c3d5b11b268fc52369169e106bb15b310edeecd9c22e19151ab2308e5f0c0311eef5394f9241b0994f177a5f1d12080b047c3084e77df1848e044806763616920059f0b6dc2948846f5b350caef1ad7229ce39d11e4a113481c77dfccec90920e7c4d8eecd8e3dfa28fd7c4428092a9841546d77df5b8e836d9b7a67eef3f7db8cf1ad3ee7fb50eab51354d8b5f33f5567a704d5c2ab5ff359729ef031632de3628fcf1b004e6e219d2c21daf30c1e11358b0d553979287512d1f7af6b12595713e85d7c020dac5586c69926ed88e689b1a16722dde34c5183061a018e326cc509d419a4de077958c788430d820a5502f7a8360c076f7f544e26041fc73fa320e118d6b4c016bf1bea4eb41b9107a96623eb3ea665cd23c47dabce2700b8372e352bd2a10bab76ebde4bf4c281e0a7190c3e78ae5c461b25692f108a63d1fd562f424aeb6e470595f790c0d91ea3830d026b560a2133be7b5c2cf9e15fa6c7abaca072acd293d58f500f1005d0cbfcc5813c5855cde34056eec37dbf1b21fe37eba9db58daef614824a4a2f85dbda417ab40abf4b7318ba124aeb1919d1035f7f8f87d1929a52ca8debae2c4a305c3a4fb8fc08711e3a01f71797706477c373c65410e74c98663ce38815ba0877e3d069a1c1926af904280d331270b9725ca9bff42f3ea9af7aa4c8b212cbb5f6b073eb4231d32208158016c7fa5e7b7bd48928c51f63c02efb97795040f736c7f96117a7c449f146ed2ffece633f8e2a7fb118b64c74f77c790e96689b0b274872db0e73113b31a75391f5a4bd876149a644db4456bb5ce83b15ae54587e1f25ae50c548808e4a40076a8742e4887d52dd746e3b4877c9ae7562892fb3d6593bbd7d589997a34daeba8ef41809d7012d4dcebbabb8cea967e7c8f6d69239ad2232c02b31c2dc3d6cc73f04c6caa182e7450a5709bf7881e00b6fafc5aba60834a835fc631c99c633adaae705cb6b08ead26ab69d37e8e164fdec81deebea01071157891d2b9edcf5809d069b3e94a947e59c9f8485a0121ff7bf893280addffd67b32420317b695faeb04bf2a125d1e8d4f69ce843e1d808fa3f62e8d5998f3d6cf7e1d9aa630b52b65cc488db37b85c6d7aafad8f847acc1c458c6860c2180c831acb3f386a432c31913ef818b3fe5e04c368501d6f2bb94cd01a79d585b80699c5cf5ea5172244ed80081e9654e20957ac7252b3dc9fb641b61f7294ada8f7e93fb31215aed4abdabd4d360223d1ecbe90d015c3a85df50d6873b36431e51b9ede82a326ae931b1a4e5bf7ef3876ccf7a5c45fe089c0adb616b800d46c9bcb2825311c7a618bbdc7b1327f63c1a064af630ff38dd9c3039ca2abd8162877b8a72a8e7c1284c7156a5cc8c9aadd9c20ea900226d2a93dd31a02e740bab47073895040aa33c1232aca1a0a645b9a7ee34ce732ac01c415bc2a3c9bfa1efb563e1324af98f0c500120af146fa694a0142b1334bf2c0e70b619f99d4ea32d3af9c2cd71c713fea7d7ef419889ed92a3464b6430eea7de219cdd10a5351c3cebaaec1f015aa234f67313953a804c841018c9fc29aeec265461dec66e05915dd2ceb7a7f54369cb5137cd6308472b212c818a901f60f971d2b4dba7125e841397c44b7cd13f140f55fb197031d313ac58b8b506a12e95e7396ce30c892a465fe5e251dccfe44de2ac9c8084d699c9951cf694f965079844400012050e0e645bcfd5de207fc9796db887d9290bab5af1745c58752c6374acbfcaede61336b0357ffdef115d1d4f3001605022ed9a1f24dabb58dd069f012c5a13e9a79efa61a53cf1719494a4f45d807b3670132676527d63898c9b1e781d229fe0e9cc022e46a41229a4a406781adec8c0ea625137edc2b9528cc5b9221420a753e7d5c093ca917ac17ea634065d741b87e2d0cf48795a79fa56ed8699c0b4861709c4c8dae578e6e84719c3541cdc7fc6ab0efbb80ce298a561a1cd3bb17812fb25298e544ca2f5b2374412e69ea496ceee9793e9c3f877118201d31506cae9c91a17ce2c6f2dc15512fc8c80080c8844e38e738f957f7b5d1901fa2216dd11b7e17bffe4a3249a898f2a8761858efeabe6d96f31a27a9abeec21db04ff4c095e616442ee78422d4a409f5fce5ddd716ed3a6912a37a14f774b565b25ec3adcc2bca2fbe0e9e08c3eabeece451ae8378ffdcf94367bac87e7a194cd82908db945602e9588fdcd07d531745d47c48f7945ac7666b00709b3bb2ac611310cf70f69ee5e6efd7ef5fa4f579669f53547cd48f38d1b7a3ab8c64935a8675148b936be51a172befedd3cab454f7c93e9c2d5352b796b5d7af9a4f91c0746d2c5d2f67864f9b228f305a5651629b4cce388675493ae1620f793ee59e326ebf1073a82a77324b3d0d56ee49613dda4070c7ade7f039b64523c88f6be7ec0e8b3d469eb4eb2e81fd061633622525c6bc5734daa74bf29a7211125af2ba9ef24f9343a69a5bd445e82c967c616902b36eb59fb66798f3477ef4631f833eb6f354707cac07ef8fdedf0101af32b4630a43ed288bb6198556c90fcdf7585a3b28712861afb3c9d0c34f006508ba7676b0e3a3a1767e2510b8886fc5a257d0295e909078e7c6058e3269c2f05f8c518471641336d483156897e93d73a4dd855f698964f483174e6eeefc1b72c2a5addd99dc4d1c3f0a7d27817c43b6166c94763c79ab689a2bf012ea7b1018d23489e238060b08e92e0dbb631a0eaad58312bd04bc9ec8adb4e2a5442e1b272556c00172d496523c26477436c2d2a4e683b849a7664bb9291e844cc7549cb23703ed74215058f5430965daea12bb3fa0998c420971c3d8649d09e4e7df4c307d8e770bbd6c29dca08583c512e227a4079481863413cb643c481915d60e71c08870b2f78f03d53900fa40c6c8d82708b770c2c4152ba1ce33f9ddd973a0fb5976904b02a140ca084c6e1160d3ed66aa10f77c9436f0e874376c84694fa01c92aa4661d616346e778fd4f06ea0d5e3d7f7d431b736c027c0f2f04d4526967746478f8c7233cb27e87d72e447b256a6d3e14cceeab5b2d528b0951d5670115924336983ea5ab8c292fce4f3568deafbbb4484d0eb0548c57bff7813f49b3af96e5fcafc894c58111b9d2cfdc45ce7d9a78bb8a14686975039be11406e9026a0a67faad8a012d5f2791c8bd62af29f0436f1d8c451e14dad786cc958f10d6953158601fc279ec7ba4a5dadc7fb46f7587b160bb0d5baddefd20717c7df02104905fd78c26bc6b4eb795c2c81cf5b09d6f13c606cb182bc5a73edec28d2b3cefe6a6aec9699706c508c657ffc684b84c3565c312f4d52348460a2a8326748f073d30b8a0a3ff2ec809edbc05fdbe834133c25d90d652a96b11a8f7f64df3db1e7931aac473c0b13e8a3771c75a4000"/4096}]}], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x37, 0x0, [], "fce59645b96d5b5c5eeefe6fb7c1382d27afb21aa69027325c040eb5b379619424f287fa9ff14e0abddc8beae3be52a6602a15c9422eb9"}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x800, [0x4, 0x0], "e8c950c9ec09612b7d67b7bbb0c57ec4686a66a84cc1b0c142898a8bef0d42d80580f30431c29621e7dc1d61d33ba51201c085e9c0ea1d4c53f99a5c269c2127e0497d0694923f7cc0df519e49e01dbb19d8d53c702f56f0e9ef3f72ea01b4444b5197f64e44787c530d4c33ceca97c1124f6366d555970a47b779d004e43ce50ccd6f4d635ea5a049bbcd8c08c690fcfb204d0362da764ba9f03ed705c57acd22cad54e5f945099feb0ee9a47bf5ad747935bda82784ed6cdca71afbfa60b6cdabb82b4f05760b728131ede9a916e962b18f6971140bb418d32f695d501266e9729a3"}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0xa613], "bfdf7fc64345191a8d33408102096fe7bcdec513b7188632cab91cdfc6b4c66b0452d58460eba5f2007146a73f395220b58f5391d850d04aff3f3199a36632c93cb0a9ae"}, {0x8, 0x88be, 0x2, {{0x1, 0x1, 0xc, 0x1, 0x0, 0x1, 0x1, 0x3}, 0x1, {0x5}}}, {0x8, 0x22eb, 0x3, {{0x0, 0x2, 0xbb, 0x2, 0x0, 0x2, 0x6, 0x4}, 0x2, {0x800, 0x7fff, 0x2, 0x8, 0x1, 0x0, 0x1, 0x1}}}, {0x8, 0x6558, 0x0, "7f737498937985a4f43143fd7f3f220e438aed5e347338f66a558740b1a609f1fd0783da6c3ad97f87d3aca5e0236017abeaa00ef16daa3cc8be29562538349fa278088ca3f8423b3796976ff96ca3de4be236d96ecf592849eb5e8c4d7576aef563cf8b5b2a6591dfb34bca5896c0910d9c5085eaf56c3ccae5f677ea9df19560a981002099e490b978f937e5120873f3e917e900eaa3991c5d3b222360a78eba26fd080811d2d5ff0f2eae81d9dd2b60d841dea1dc4c159c96358daa55666d8c"}}}}}, 0x14a1) 1.301104669s ago: executing program 4 (id=5): r0 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x2100) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x14, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000300)={&(0x7f00000001c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r0, 0xc03064b7, &(0x7f0000000200)={r1, r2, r3, 0x0, 0x8000, 0x80000003, 0x0, 0x0, 0x5, 0xe, 0xc, 0x31e}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x6c}, [@ldst={0x4}]}, &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = eventfd(0x5ef) ioctl$KVM_IOEVENTFD(r5, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0x0, 0x0, r6}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f00000001c0)={0xffff1000, 0x20e000, 0x8}) 1.184480393s ago: executing program 2 (id=11): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) r1 = syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x40402) ioctl$FE_GET_PROPERTY(r1, 0x80086f53, &(0x7f0000000000)={0x3, &(0x7f0000000300)=[{0x2a, '\x00', @st={0x4, [{0x3, @svalue=0xdff9}, {0x2, @uvalue=0x7}, {0x2, @uvalue=0x5}, {0x3, @uvalue=0x3}]}, 0xffff16c8}, {0x1e, '\x00', @buffer={"107daa320a009710b73995706d5d37880bb86e00", 0x20}, 0x17d}, {0x16, '\x00', @st={0x4, [{0x1, @uvalue=0x7}, {0x2, @uvalue=0x7}, {0x0, @svalue=0x9}, {0x3, @svalue=0x3}]}}]}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0) r3 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r3, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) bind$inet(r3, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r3, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000015c0)=""/127, 0x7f}}], 0x1, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) r4 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x7, 0xe, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0xc, 0x5, 0x2000000000, 0xfe1, 0x80, 0x3, 0x0, 0xffff, 0x8d], 0x100000, 0x40000}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f0000000b00)) connect$unix(0xffffffffffffffff, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e20}, 0x6e) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x0) r7 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r7, 0x8) 775.106542ms ago: executing program 0 (id=12): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) syz_open_dev$vim2m(0x0, 0x1000, 0x2) listen(0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000100)={0x1, 0x0, @ioapic={0x8082801, 0x5fa, 0x8, 0x1ff, 0x0, [{0x3, 0x6, 0x9, '\x00', 0xd}, {0x5, 0x9, 0x8, '\x00', 0x6}, {0xfe, 0x5, 0x9, '\x00', 0x5}, {0x81, 0x3, 0x8, '\x00', 0x5}, {0xc, 0xf, 0x7f, '\x00', 0x60}, {0x0, 0x0, 0x2}, {0x1, 0x9, 0x9, '\x00', 0xa}, {0xd, 0x47, 0xb, '\x00', 0x46}, {0x8, 0x5, 0x0, '\x00', 0xff}, {0x6, 0x3, 0x0, '\x00', 0x6}, {0x40, 0x4, 0x2, '\x00', 0xa3}, {0x8, 0x4, 0x19, '\x00', 0xff}, {0x3, 0x86, 0xa, '\x00', 0xf9}, {0x5, 0x4f, 0x2}, {0x68, 0x87, 0x1, '\x00', 0x7}, {0xb, 0x0, 0x23, '\x00', 0x7b}, {0x3, 0x7, 0xd1}, {0x68, 0x3, 0x2, '\x00', 0x3}, {0x8, 0x9e, 0xc0, '\x00', 0x2}, {0x3e, 0x48, 0xa, '\x00', 0x2}, {0x7, 0x1, 0x2, '\x00', 0x1}, {0x3, 0x7, 0x6, '\x00', 0x4}, {0x93, 0x9, 0x4, '\x00', 0xe6}, {0x3, 0x7f, 0xe0, '\x00', 0x47}]}}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000440)={0x1, 0x0, [{0x1, 0xfff, 0xfff, 0xffffffff, 0x9}]}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000100)={0x2, 0x0, @pic={0x0, 0x7, 0x5, 0x4, 0x0, 0x0, 0x4, 0xbb, 0x2, 0xc0, 0x6d, 0x26, 0x61, 0x7, 0x95, 0xd}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2000004, 0x31, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000140), 0x80, 0x1, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000140)={'ip_vti0\x00', &(0x7f00000000c0)={'syztnl0\x00', r5, 0x40, 0x8, 0xc9f9, 0x3, {{0x6, 0x4, 0x0, 0x36, 0x18, 0x66, 0x0, 0x6, 0x2f, 0x0, @private=0xa010102, @broadcast, {[@end]}}}}}) 599.54757ms ago: executing program 4 (id=13): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket(0x10, 0x803, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0xfffd, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0x3}, {}, {0xfff2, 0xfff1}}, [@filter_kind_options=@f_basic={{0xa}, {0x54, 0x2, [@TCA_BASIC_ACT={0x50, 0x3, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x4, 0xffff, 0x6, 0x6, 0x6}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x4) 166.127949ms ago: executing program 4 (id=14): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)={0x28, r1, 0x1, 0x70bd2c, 0x0, {{0x2}, {@void, @val={0xc, 0x99, {0x2, 0x25}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @default=0x9b4}]]}, 0x28}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) r2 = fsopen(&(0x7f0000000080)='erofs\x00', 0x0) fcntl$addseals(r2, 0x409, 0x15) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000000)=0xfffffff9, 0x4) r4 = socket(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000980)={0x6}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000c40)=ANY=[@ANYBLOB="241100005200230625bd7000ffdbdf251d0000001011f0800b117280c100528008002a00040000000400e780040076800c008c8008004100e0000002430bd00b774278246dd6633ee925b01b78cf151676b9f8ebd42261b8b82b537266bd69f1b48d708ba1cf531004602a750fec1517ce167c7c85e10d392b57086b5bcb1abe5d00e686e782b750aee74eb318cd6cfa73ebab21f322eba424a681aa7a6f096aeaa49802d933f1514bf0581a6dfbee3d0fe621074183ca2dde6f706d993ab6422fb26507f137c50b7a7a3e3b40402c11e0b4d038708910304f4a53ef65000000764af75ad45c915538e6e4baf9ed13a9fd323d0e5941435c55b3627a84678a7ae0b804b4bab0affbd25799769f3db24062990bb01b797f4ff80f8625abb01e3f577b2ef0ed84d6ac6ba8efee5a40fd2d123425ff0d09ec1d02ee95c50c717a56d3601bc5ae377d6e07f134df83ff22c8572267abe26a341038bf819813981da8d9e5ed0e7fc0efe33e5658d2487a3e4a22b57a9f6be79de32ca5fa7029904397fa3312b7c4562186623aba63968f997067bf26fd4da8eff7de615f84e11caaff83379e2b3b3f59c893b071d1d1c2d189f0f542515e5836ef60fd3ad19bf1472ba51e31b81b62991c98be28627dfcae735b80bd2e1b24aba6c422580ba65b0829b58056ab5334fb12b9728c98cbfb77a9fbf4b0aa2760b7849f00313b46b3aace4afc6cc2fd447b3c1248ae992b001b54f906475b81e3ccd6fca5dac88ac7861675ef810b43b6a7b80b45b374391ee172178eafc40f9edd075f628de6adf23475e370065b80dbf95c29b6ad26fbe58f66f26fe715615add5bcd787a99978af006be23f4b2474642ae896260d53e8c731bb55d47a52ad8816e2a2dc7ee72197ba078d36ecb190468fd5bdb9a108cf8b2b425c30b1b580861f291da7d32880365fdae50e4d618c577040e551a5770b63f0cb83c63f29ea2fcc3ba483de15c73912599f4556cc66d454b072e14b64e20d25465d1753923762db4daf5bf0fe9647e65c30a680be234f118a1380e032c9a7ef4cdda26d855cda4057ca316259aa52e68fa46e508c4945ca6c2afe75342873674fc296cdc2f967f327e41fb13a11c37e16073818597c224f9e7dd59ab01fa519646c43ad4faa94ccd0ff748efeb84163b47742005fdf68297004d7636e3df2f42cf24b463b0333d74e090402807b3ea4421a31ee2e8b8f453fa0b2bbafb3095a12237a344ab56cc4fd6e2880b855ccbca96e44d34290084ec161a1c212f70468ed49ed37cd405226aecf0a0a781064f86154189b952d67668e4c6b90132aacbbd1f16fcc6414dd5b0c48fed2df08e5e18f2a54ae2b38d863b19121a855b9bbdb3db1493c153645072f1029e3e4692b7cd8877883a8f45fc90ee9558559e82d5e525e907b6b3d22ccf7900bdf020d79a012b6c056218af9637b6ee74e8e76c2e1e5e3c984361fa84bca3fc8182448ab3db932de1873ec8b217f1a7a47910509093621da29da94269e91b3fe800060a2407169d708d08f6bc053f9b8f13eb622d1230f71e4766b57b22983188bce98eae7a3e3be6b1a82c7050bd8f2a6b292208e34b68fea0c6b48ef0f8d4d3b58281470a91a342e6fb520fd7958a57c22a66cee35946a85cd30707e44ea400c91463e52affdbf95357ce614c2099169b8c116d41f5fc57ea142f3144e05e5f518b23b089e014c9440c84fc5f1224642bba63a91475394a74bb34fcb069e1008d9fd73c368749dfacc6bb61ac4d8b122a37f946dd909392e142f0378e6b6cc7e058047f843609c0207b2bd73a2493582da75fe4523d8e5ea30415725180f3cfd15b7891c813b4a95fb0a6468beab8b2cfa217df18ac096705fd6c7c8d0cb0b78dde8eb6539dca2885d19a5a0a212a43159b84fef2e13d75c55bacfb39a956c02ab91acb28591500e3dcc25b3dd17f84cb442003aaa4aa181548285eee92b8a3cc8861046857ccee9563eaae76ce517fd5b0d3188dcfcb773d90471f1ecedd79424740a21557794ba553559e0731c5dae3a943a5b54fb33fa987954241dc61c21d4f76558ee414df3fa309822b4f0b195b8221c5d3c08458749ad9d3d2429b30ea87862e40f8c36e7475402012ca850230fde56510d45ac5b4b2e8264d9ced329431867f5b1e1a4de4b7b9581c55246df98b23c19e9a33d0016e51db9bca12c149bc0577d6f7887111318a518c639a792a6d192c6cdca676fcc30119378e89f7f9625ae467903543f74bfafd6b2265055510b374db3ca580db57fe6ad40bde1b63ed3586295fe79f8e75f1e4b1271e3ede607eff395202c956f8fb96d8853257defa3f4f963731b31c18f46685fa6998d8ccd3cab6b65286dfd4da2f2a3f597f334c4d5fb95ef165a57453d20d76c1b15bce773739ba82c47157bee4f13564e8d6f7e6ffd107cceb40575aa1f7e3b4a5f432f97a0023c09bddc92c5676036a53c6a9b0685c9a5d5a5056698886a11f417b7d246fb6ca4f1693e30f64ebcdae1d82133447e7b389bea59ec7745876056214e9fe397ab576f81d3baca2b26377dd856ab1edc02f3d7bac661aed0f42fc2d462d3bba6d64281902a94fb3b5bc533cb825ad66c2a0b42ef2a83875fb221686e8828968d7ea455d598f37abe4fdc5fc062e398f68630cc2c3d187c3b8be8aa4a4e84264a5f6f09a2128b04cde0e51090824ec69b8ec22a5e13610a89f408b2fc45b884cff4dc50f41d26c9230ae7f3b3333d7f4f4f9cced0addc6bb6ca005b42c2f86f7b57a89aa7f709dace80d599d74b60c48b6be86c7e47402628f094bac1034e679b874d4554c44c0b16de6781790a2a8c7cc7ff8706ff556fb22ee40fb9be6c77f46d6dca59bf36cc001d24773961a85563491adf95a39995e182b7736b2c55511a8aad1d935fb2dac8838b6a86b96144d449310f819e20f6d260bd812b6593df489f019c501dba613b07eb6726d663f053f709426fe67ba240e7b700525df724a54f434e6b47204578f4907cd3f419fde8d44e3d0811b2ed2dfb4fe334ee1ca03a229acc9c83aa87e4b2ad0bc2ff574a6ff1f215eb34d948df3540b140b215c7af3afe684ffc59da1dde337d62ac1c6abb105a3d5c3b6ada837b08ad7399d07e2d30f5db922910726a20b2f7ba610e1ad15f4221f92b89a029e416f37fef2b5459bb987dcbfe00bdae8c1602aa74f847db0ea27f06d41aa46acd77e51e4636c5e7e1e06d8454924813b7b6d7348e84681de383b821aeec67937c383a2410e51be10b7551f51191d8a947c134d2e99c4261975951230909c25903dddaadb65111571052fedc246388570915f9fbb66c29a8ee74a6a1b6b632db4d0bf32ef92d6f6cf8f8728090ecca6f2bc98f31959265afeddb3da857ce75dcd95ac1bb73d7a1993033d010c2ebee1365692849e00cf8a32dfa5592fe228b8c0485816e96aafe20b2738230703004a494691c33ab8881e1ba7ddd92d373b99c3f4692059b32a9d95f763fc65fb6192a6fdad9005722d7045e0d2208ba954c0e42db0d363e97586a4068e444743047911ef4b785cea5c6d32be5e6812d088aa1b73f12485309c84cb75f968c3d9d4dbf42b13b184bb5861584b0c11b60c05912241309aa2cee0fcfc67e3baf2b79bae879060f7584d57087d967e3994537bac93e029238215127d9bedcae257f1410a0b09556e4d65d6de956a769ee218415b73b08cfa8583e508706a8ce65d872c65fffb43564c74e80b877d88e161a36ce4d169f34bb86f6bcf04d0b6e9d5b2296f95833e18b2cb8bbfada4fc57e31c9ce4ec0f6948dddbf4597a4ba5a735d6f5d83677bac57d296fef529f4e378bc2270fc5ba4cb6a3ad03dc134f8e914b328fcbe3cbc2a961f892b7e279c8e41793cd4047a531fb72cf76cf99f2a99a5b3428a0eab4eadfc8d88f75a6c6644191dcd0f7ce1c04569ab8654f1d18435d2eb071668d524a1be64cdb4d896e4bbd1f71820b8c7e034d4f8c9d2b71b6052ea2bd32a89c51bcd6ab837cf6f01f8775728db939f0f7c85fea0e93f2c105733d1a9f2e636df40bd1730693c367c2de38240137eee2895a39d1bae2acfd9b42bce8079a7dd7e124d5e3cc05c441aceda6d523016329839d84649d33f9c2dd9cd9fb7e2d0161e4b721e47d9684449ae2e77972d8b9ad732e197dc3e1fcc5dd91be9d1ca20c764bae25aea0758240c5b6c0129903aaa9f6a9aa5853203f7ed9c85845576819cc5eae6610c90702bac72a130e328f5c608fe679e6dc1226bb1f7ad513d6750497d929cffb4259a8af3f4cd97d83ece9e942cad34978ba9b9ddfea6c4492261a3e5fe03e0f22d780f7faf271956a4a355af772a3cf10ea7045ec6bb0b880032909390f08c07cfce30c43d691d8f77d16d64c2520c0210a21fc7e63cfb97707ca283b6f2549477cc6b11f6e860ea24a49d75e1990010f8a5e38612ba112f8dd2b1af53adff5291b3af709acf8c8ed98bdbf077cc7a3c3c8012b2466df5d70d288f48a7bf5d2bba6b0904017302d762bc1e28b083937f7fa31720e7d3ad9bb7de3c202e17b9caba276673c7b74d7df7715bd034634a894a8e6edccab13483fff03a5ec4cf51e415ea8bc06bb29fbb23c3983bfaa66d57b980cd370b000c637a224e09ea79845729bbfcab8765df1afba6213002107abef9bd4f454e682b0725c2360a40848ffb9670c3aeb16752e6ca1ecd58a1683eb13ffead0858c3da325352d001ca0d49c61c8cce90dd1834486c04bce3b3582d8364c96d6b5dd32c5009868cbc02ceef85096b1e760bff4ab896ed5e72d9109ddae9699dff57d9c377f09d79c227affdddd5c14cd831e4a12940469aa1d428a6b93558cf1fd374eb6fa96350e7bde274a1fb9b821b39ad96d17aac27fbce9650466ae67b5047e31d05bda98b5ed5c7b40caba62f35046a13b10a95f6c1c3cb2357f579f11a9f8647c725c4ef7e2d82900ae58ea92da73803749a228864371b193523a208559e0b6a828b39d1e3be18fe46b00dca7b5582a729ef050970eb7255c266e609d5b76137993bc31adc225d0a72172dc99aa15f91bb31d0519094e619b1df8e5e503435ccd96866d4b83f0264cf315b9b2fa999b70328195bce69687b0ae8783eb63e3e459b98b5724f80a30c532dffbd5238f5ab6b1e981ab96937566b2eb3390d1cd0487d2a4ad35c76ba02cb42e8e94d166130782b464cf0fc64910c74da2003834d6ca16be0da2b9260207687761d0c88e0f4633116c82349c9e485540b6368482535074e2d2fdefe132ad802c6087238a8cd41aa5b2f7cf7e5e8aca29f3c31ff25999193cc354a7fb32dc50ba4fa8bea2c052152f1b5674a97cedc9b0840ef9bad1f109d296b20139436d3a02cb619c8a0d2dd3ea962826751886df9c72eb24f031e5ef81b253788954d0fe9cd59c19d04ef2f1a97935f4f6ce6550075fa844be5d381ab7c3f266ff6da2f9c5b5eca02c3e0e09d00a2df5eac6a2e500e82a63fa5fd213576134647fdbf94c6e513b62c1d494141b9e5846ffb6206006d350bca53fcd13d54926b4de912ecebe261ea747fb7028bf79374b4b57b32c9ffe14200f0a383cafb4816fe362abd89337afd2bb785d8b618c48d73bfe3853fe4d17aefa5310de9cdc2cae2294efdf062816f6792dddbf4aca008ff8bfe143190b5505c0c20cddf241d471cf5b3be7def677e16904ee9d82e6e0963167c532ddab4ce00d58bbe84a3e97349bf49ba781d137a8d227e89bcb51539b673daa1ba2b8cfdfce5a69076ca08385a1b5e3404190c332c52b418f4feecf8f2bbed4289dad7f957d4cc04f3fa15b0d1ef67cbd3a99391cc5f5a7db433d06631893bfdd1a4a0ecd57d467c2a7ee450e84ce31a2c2a79e838d6dfec363ee6fec8adc0168ad0badb2753b685045c9617d16a7d7933d9f7e65b6c1f3eb18ee53741579ae27b3a42962031492f7950afd2872984ac9e552f9adbb7f3dbad26c9b17f69311325b7f9b93b71432e8e3858453080031174fd471a609b105f9604873c0248946da1297fae3fb0000816c7f926b2f257410d2addcbc18c744c041c1509abbdf228989df2eabb7341aacab259f069838cf3c94ad73daef538ccc55cd7233d3e449dc5db855b9fb239ccb6ec84035ce14bdd67b29dc5a6ca2740eba646f01e32c800c3304afb58b08009f00", @ANYRES32=r2, @ANYBLOB='\x00'], 0x1124}}, 0x800) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e24, 0x447f, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x4}}, 0x0, 0x0, 0x0, 0x0, "ddfd3b7ed7c6a1c172a987ae5ce3cafd64c9a736831a5912d606798fb75c9981c4b3ac0e06891ff18bc5543ed57215a3c45f9154dfa319e52a15a2b9acf80c07fb1a854dad742eef6187f2304844c296"}, 0xd8) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) pipe(&(0x7f0000000580)={0xffffffffffffffff}) fadvise64(r8, 0x7ff, 0x9, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@alu={0x7, 0x0, 0x8, 0x3, 0x9, 0xfffffffffffffff4}]}, &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a3c}, 0x94) ioctl$FE_SET_PROPERTY(r8, 0x40086f52, &(0x7f0000000200)={0xa, &(0x7f00000003c0)}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000240)={0x2c, r5, 0x1, 0x70bd22, 0xfffffffc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x805}]}]}]}, 0x2c}}, 0x0) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r7) syz_emit_ethernet(0x4e, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd6018232500182c00fe8000000000000000000000000000bbfec0"], 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r9, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x24000000) 72.809846ms ago: executing program 0 (id=15): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) r1 = syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x40402) ioctl$FE_GET_PROPERTY(r1, 0x80086f53, &(0x7f0000000000)={0x3, &(0x7f0000000300)=[{0x2a, '\x00', @st={0x4, [{0x3, @svalue=0xdff9}, {0x2, @uvalue=0x7}, {0x2, @uvalue=0x5}, {0x3, @uvalue=0x3}]}, 0xffff16c8}, {0x1e, '\x00', @buffer={"107daa320a009710b73995706d5d37880bb86e00", 0x20}, 0x17d}, {0x16, '\x00', @st={0x4, [{0x1, @uvalue=0x7}, {0x2, @uvalue=0x7}, {0x0, @svalue=0x9}, {0x3, @svalue=0x3}]}}]}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r2, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) bind$inet(r2, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r2, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000015c0)=""/127, 0x7f}}], 0x1, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e20}, 0x6e) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r4, 0x8) 0s ago: executing program 2 (id=16): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$vga_arbiter(0xffffff9c, &(0x7f0000000000), 0x800, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4000, 0x6, &(0x7f0000a9e000/0x4000)=nil) chdir(&(0x7f0000000480)='./cgroup\x00') sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x403, 0x70b528, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xa1, 0x18000}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x1}]}}}]}, 0x48}, 0x1, 0xba01, 0x0, 0x4004}, 0x810) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.68' (ED25519) to the list of known hosts. [ 65.041964][ T5606] cgroup: Unknown subsys name 'net' [ 65.170238][ T5606] cgroup: Unknown subsys name 'cpuset' [ 65.179342][ T5606] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 66.538470][ T5606] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 68.624570][ T5630] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.632966][ T5630] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 68.633551][ T5628] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 68.642579][ T5630] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.647726][ T5629] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 68.656395][ T5630] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.669766][ T5631] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 68.677732][ T5630] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 68.685900][ T5631] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.689882][ T5629] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 68.702484][ T5629] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 68.702792][ T5630] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 68.710481][ T5629] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.717855][ T5630] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.728386][ T5629] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 68.731350][ T5631] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.739218][ T5629] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.746173][ T5631] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 68.761742][ T4943] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.773205][ T5632] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 68.781206][ T4943] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.794925][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.802641][ T5632] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 68.815624][ T5632] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 68.833237][ T5632] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 69.702693][ T5637] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.709979][ T5637] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.719499][ T5637] bridge_slave_0: entered allmulticast mode [ 69.726938][ T5637] bridge_slave_0: entered promiscuous mode [ 69.763435][ T5637] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.770782][ T5637] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.777987][ T5637] bridge_slave_1: entered allmulticast mode [ 69.784908][ T5637] bridge_slave_1: entered promiscuous mode [ 69.896135][ T5637] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.934613][ T5637] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.954298][ T5636] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.961644][ T5636] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.969007][ T5636] bridge_slave_0: entered allmulticast mode [ 69.975874][ T5636] bridge_slave_0: entered promiscuous mode [ 69.983102][ T5640] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.990636][ T5640] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.997981][ T5640] bridge_slave_0: entered allmulticast mode [ 70.004850][ T5640] bridge_slave_0: entered promiscuous mode [ 70.051269][ T5636] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.058543][ T5636] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.065805][ T5636] bridge_slave_1: entered allmulticast mode [ 70.073279][ T5636] bridge_slave_1: entered promiscuous mode [ 70.080799][ T5640] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.087982][ T5640] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.095127][ T5640] bridge_slave_1: entered allmulticast mode [ 70.102266][ T5640] bridge_slave_1: entered promiscuous mode [ 70.125546][ T5639] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.132847][ T5639] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.140336][ T5639] bridge_slave_0: entered allmulticast mode [ 70.147510][ T5639] bridge_slave_0: entered promiscuous mode [ 70.173621][ T5637] team0: Port device team_slave_0 added [ 70.179413][ T5638] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.186531][ T5638] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.193965][ T5638] bridge_slave_0: entered allmulticast mode [ 70.201321][ T5638] bridge_slave_0: entered promiscuous mode [ 70.208486][ T5639] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.215690][ T5639] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.223049][ T5639] bridge_slave_1: entered allmulticast mode [ 70.230403][ T5639] bridge_slave_1: entered promiscuous mode [ 70.257253][ T5637] team0: Port device team_slave_1 added [ 70.263021][ T5638] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.270200][ T5638] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.277562][ T5638] bridge_slave_1: entered allmulticast mode [ 70.284541][ T5638] bridge_slave_1: entered promiscuous mode [ 70.302817][ T5636] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.314455][ T5640] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.352479][ T5636] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.363641][ T5640] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.393310][ T5639] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.424710][ T5637] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.431736][ T5637] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.458339][ T5637] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.472978][ T5638] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.484072][ T5639] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.512354][ T5637] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.519633][ T5637] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.545901][ T5637] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.567596][ T5638] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.586288][ T5636] team0: Port device team_slave_0 added [ 70.593883][ T5640] team0: Port device team_slave_0 added [ 70.624764][ T5636] team0: Port device team_slave_1 added [ 70.632586][ T5640] team0: Port device team_slave_1 added [ 70.658305][ T5639] team0: Port device team_slave_0 added [ 70.694502][ T5638] team0: Port device team_slave_0 added [ 70.702009][ T5639] team0: Port device team_slave_1 added [ 70.725421][ T5640] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.732490][ T5640] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.758573][ T5640] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.771335][ T5638] team0: Port device team_slave_1 added [ 70.785889][ T5636] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.793139][ T5636] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.819114][ T5636] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.834998][ T5637] hsr_slave_0: entered promiscuous mode [ 70.837919][ T5632] Bluetooth: hci1: command tx timeout [ 70.842601][ T5637] hsr_slave_1: entered promiscuous mode [ 70.847133][ T50] Bluetooth: hci0: command tx timeout [ 70.856252][ T5640] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.858457][ T5619] Bluetooth: hci2: command tx timeout [ 70.865506][ T5640] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.871219][ T5626] Bluetooth: hci3: command tx timeout [ 70.897171][ T5640] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.917050][ T5626] Bluetooth: hci4: command tx timeout [ 70.929713][ T5636] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.936771][ T5636] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.962925][ T5636] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.995079][ T5639] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.002381][ T5639] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.028585][ T5639] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.076646][ T5636] hsr_slave_0: entered promiscuous mode [ 71.083453][ T5636] hsr_slave_1: entered promiscuous mode [ 71.089668][ T5636] debugfs: 'hsr0' already exists in 'hsr' [ 71.095460][ T5636] Cannot create hsr debugfs directory [ 71.102020][ T5638] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.109057][ T5638] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.135347][ T5638] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.147221][ T5639] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.154198][ T5639] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.180139][ T5639] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.220008][ T5638] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.227327][ T5638] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.253321][ T5638] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.285399][ T5640] hsr_slave_0: entered promiscuous mode [ 71.291794][ T5640] hsr_slave_1: entered promiscuous mode [ 71.298403][ T5640] debugfs: 'hsr0' already exists in 'hsr' [ 71.304143][ T5640] Cannot create hsr debugfs directory [ 71.321018][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.328191][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.460972][ T5639] hsr_slave_0: entered promiscuous mode [ 71.467481][ T5639] hsr_slave_1: entered promiscuous mode [ 71.473490][ T5639] debugfs: 'hsr0' already exists in 'hsr' [ 71.480134][ T5639] Cannot create hsr debugfs directory [ 71.491966][ T5638] hsr_slave_0: entered promiscuous mode [ 71.498249][ T5638] hsr_slave_1: entered promiscuous mode [ 71.504261][ T5638] debugfs: 'hsr0' already exists in 'hsr' [ 71.510146][ T5638] Cannot create hsr debugfs directory [ 71.919022][ T5637] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 71.932327][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.941059][ T5637] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 71.950713][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.958941][ T5637] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 71.968520][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.977734][ T5637] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 71.988810][ T5637] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.054530][ T5636] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 72.068517][ T5636] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.081577][ T5636] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 72.093562][ T5636] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.102854][ T5636] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 72.112846][ T5636] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.123978][ T5636] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 72.133340][ T5636] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.219770][ T5640] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.232098][ T5640] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.246261][ T5640] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.256663][ T5640] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.265162][ T5640] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.274842][ T5640] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.283796][ T5640] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.294335][ T5640] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.392499][ T5638] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 72.403166][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.411443][ T5638] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 72.421406][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.429276][ T5638] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 72.439048][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.446781][ T5638] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 72.458152][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.491285][ T5637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.569143][ T5637] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.595436][ T5639] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 72.605745][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.622245][ T3253] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.629827][ T3253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.641517][ T5639] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 72.651259][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.659473][ T5639] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 72.671514][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.697460][ T5636] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.704375][ T5639] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 72.713714][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.731850][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.739006][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.801830][ T5636] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.836107][ T3253] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.843352][ T3253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.869826][ T1012] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.877011][ T1012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.898336][ T5640] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.917362][ T50] Bluetooth: hci0: command tx timeout [ 72.918048][ T5626] Bluetooth: hci3: command tx timeout [ 72.922842][ T5632] Bluetooth: hci1: command tx timeout [ 72.929079][ T5619] Bluetooth: hci2: command tx timeout [ 72.996788][ T5640] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.003537][ T5626] Bluetooth: hci4: command tx timeout [ 73.020978][ T5638] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.042319][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.049635][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.074047][ T1012] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.081174][ T1012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.115560][ T5639] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.129053][ T5637] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.162576][ T5638] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.195828][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.202997][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.222428][ T5639] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.250730][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.257858][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.287315][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.294449][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.330010][ T5637] veth0_vlan: entered promiscuous mode [ 73.340348][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.347527][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.362418][ T5636] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.393370][ T5637] veth1_vlan: entered promiscuous mode [ 73.422842][ T5640] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.441853][ T5638] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 73.530135][ T5637] veth0_macvtap: entered promiscuous mode [ 73.555097][ T5637] veth1_macvtap: entered promiscuous mode [ 73.564652][ T5638] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.613054][ T5640] veth0_vlan: entered promiscuous mode [ 73.623089][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.644513][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.674167][ T5636] veth0_vlan: entered promiscuous mode [ 73.690654][ T1012] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.700310][ T1012] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.721799][ T5640] veth1_vlan: entered promiscuous mode [ 73.729320][ T1012] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.738573][ T1012] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.757648][ T5636] veth1_vlan: entered promiscuous mode [ 73.819616][ T5639] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.883562][ T5638] veth0_vlan: entered promiscuous mode [ 73.896188][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.922860][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.956071][ T5636] veth0_macvtap: entered promiscuous mode [ 73.972264][ T5638] veth1_vlan: entered promiscuous mode [ 73.982757][ T5636] veth1_macvtap: entered promiscuous mode [ 73.999532][ T5640] veth0_macvtap: entered promiscuous mode [ 74.010175][ T1012] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.019597][ T1012] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.021776][ T5640] veth1_macvtap: entered promiscuous mode [ 74.066602][ T5636] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.105246][ T5636] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.121784][ T5639] veth0_vlan: entered promiscuous mode [ 74.138421][ T5637] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 74.153505][ T5638] veth0_macvtap: entered promiscuous mode [ 74.166364][ T57] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.175535][ T57] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.185660][ T5640] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.203403][ T5638] veth1_macvtap: entered promiscuous mode [ 74.211654][ T57] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.220922][ T57] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.254061][ T5640] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.273520][ T5639] veth1_vlan: entered promiscuous mode [ 74.309309][ T3312] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.332899][ T5638] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.364074][ T3312] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.391687][ T5715] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 74.412317][ T3312] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.436446][ T3312] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.448707][ T5638] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.512029][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.522063][ T3312] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.533006][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.536964][ T3312] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.551098][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.585933][ T3312] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.655768][ T5639] veth0_macvtap: entered promiscuous mode [ 74.682164][ T3253] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.694500][ T3253] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.744780][ T3253] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.746225][ T5639] veth1_macvtap: entered promiscuous mode [ 74.754038][ T3253] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.877902][ T5639] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.892207][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.902376][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.922058][ T5639] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.980705][ T1012] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.998011][ T5619] Bluetooth: hci2: command tx timeout [ 74.998619][ T50] Bluetooth: hci0: command tx timeout [ 75.003542][ T5619] Bluetooth: hci1: command tx timeout [ 75.015797][ T5626] Bluetooth: hci3: command tx timeout [ 75.022975][ T1012] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.048666][ T1012] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.067315][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.082891][ T5626] Bluetooth: hci4: command tx timeout [ 75.092409][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.093851][ T1012] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.283427][ T5727] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8'. [ 75.284278][ T5725] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7'. [ 75.331309][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.356601][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.458836][ T3312] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.482321][ T3312] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.670236][ T3312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.753084][ T3312] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.759747][ T5676] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 76.081361][ T5676] usb 1-1: unable to get BOS descriptor or descriptor too short [ 76.165094][ T5676] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 76.208616][ T5676] usb 1-1: can't read configurations, error -71 [ 77.077019][ T5626] Bluetooth: hci0: command tx timeout [ 77.082954][ T5619] Bluetooth: hci2: command tx timeout [ 77.088605][ T5632] Bluetooth: hci1: command tx timeout [ 77.088650][ T50] Bluetooth: hci3: command tx timeout [ 77.158597][ T5619] Bluetooth: hci4: command tx timeout [ 77.597863][ T5764] ================================================================== [ 77.605943][ T5764] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x40a/0x4d0 [ 77.614100][ T5764] Read of size 4 at addr ffff88802c87663c by task syz.4.14/5764 [ 77.621713][ T5764] [ 77.624066][ T5764] CPU: 0 UID: 0 PID: 5764 Comm: syz.4.14 Not tainted syzkaller #0 PREEMPT(full) [ 77.624078][ T5764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 77.624089][ T5764] Call Trace: [ 77.624096][ T5764] [ 77.624101][ T5764] dump_stack_lvl+0xe8/0x150 [ 77.624116][ T5764] print_address_description+0x55/0x1e0 [ 77.624127][ T5764] ? dvb_frontend_release+0x40a/0x4d0 [ 77.624137][ T5764] print_report+0x58/0x70 [ 77.624146][ T5764] kasan_report+0x117/0x150 [ 77.624161][ T5764] ? dvb_frontend_release+0x40a/0x4d0 [ 77.624172][ T5764] dvb_frontend_release+0x40a/0x4d0 [ 77.624182][ T5764] ? __pfx_dvb_frontend_release+0x10/0x10 [ 77.624192][ T5764] __fput+0x44f/0xa60 [ 77.624207][ T5764] task_work_run+0x1d9/0x270 [ 77.624221][ T5764] ? __pfx_task_work_run+0x10/0x10 [ 77.624236][ T5764] exit_to_user_mode_loop+0xed/0x480 [ 77.624246][ T5764] ? rcu_is_watching+0x15/0xb0 [ 77.624258][ T5764] ? do_fast_syscall_32+0x33/0x70 [ 77.624270][ T5764] __do_fast_syscall_32+0x446/0x6e0 [ 77.624281][ T5764] ? do_fast_syscall_32+0x33/0x70 [ 77.624292][ T5764] ? irqentry_exit+0x10f/0x730 [ 77.624302][ T5764] ? trace_irq_disable+0x3b/0x140 [ 77.624316][ T5764] do_fast_syscall_32+0x33/0x70 [ 77.624327][ T5764] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 77.624339][ T5764] RIP: 0023:0xf701f01c [ 77.624352][ T5764] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 77.624360][ T5764] RSP: 002b:00000000f753fb1c EFLAGS: 00000206 ORIG_RAX: 00000000000001b4 [ 77.624371][ T5764] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e [ 77.624377][ T5764] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 77.624383][ T5764] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 77.624388][ T5764] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 77.624394][ T5764] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 77.624403][ T5764] [ 77.624406][ T5764] [ 77.827834][ T5764] Allocated by task 1: [ 77.831898][ T5764] kasan_save_track+0x3e/0x80 [ 77.836570][ T5764] __kasan_kmalloc+0x93/0xb0 [ 77.841149][ T5764] __kmalloc_cache_noprof+0x31c/0x660 [ 77.846512][ T5764] dvb_register_device+0x2fd/0x21e0 [ 77.851702][ T5764] dvb_register_frontend+0x61b/0x920 [ 77.856974][ T5764] vidtv_bridge_probe+0x9aa/0xf80 [ 77.861984][ T5764] platform_probe+0xf9/0x190 [ 77.866564][ T5764] really_probe+0x267/0xaf0 [ 77.871062][ T5764] __driver_probe_device+0x1ef/0x380 [ 77.876339][ T5764] driver_probe_device+0x4f/0x240 [ 77.881356][ T5764] __driver_attach+0x34c/0x640 [ 77.886332][ T5764] bus_for_each_dev+0x23b/0x2c0 [ 77.891174][ T5764] bus_add_driver+0x345/0x670 [ 77.895924][ T5764] driver_register+0x23a/0x320 [ 77.900671][ T5764] vidtv_bridge_init+0x28/0x50 [ 77.905419][ T5764] do_one_initcall+0x250/0x870 [ 77.910161][ T5764] do_initcall_level+0x104/0x190 [ 77.915081][ T5764] do_initcalls+0x59/0xa0 [ 77.919417][ T5764] kernel_init_freeable+0x2a6/0x3e0 [ 77.924610][ T5764] kernel_init+0x1d/0x1d0 [ 77.928940][ T5764] ret_from_fork+0x514/0xb70 [ 77.933512][ T5764] ret_from_fork_asm+0x1a/0x30 [ 77.938260][ T5764] [ 77.940567][ T5764] Freed by task 5764: [ 77.944531][ T5764] kasan_save_track+0x3e/0x80 [ 77.949214][ T5764] kasan_save_free_info+0x46/0x50 [ 77.954226][ T5764] __kasan_slab_free+0x5c/0x80 [ 77.958975][ T5764] kfree+0x1c5/0x640 [ 77.962851][ T5764] dvb_generic_release+0x11d/0x1b0 [ 77.968028][ T5764] dvb_frontend_release+0x132/0x4d0 [ 77.973206][ T5764] __fput+0x44f/0xa60 [ 77.977199][ T5764] task_work_run+0x1d9/0x270 [ 77.981801][ T5764] exit_to_user_mode_loop+0xed/0x480 [ 77.987070][ T5764] __do_fast_syscall_32+0x446/0x6e0 [ 77.992252][ T5764] do_fast_syscall_32+0x33/0x70 [ 77.997089][ T5764] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 78.003516][ T5764] [ 78.005825][ T5764] The buggy address belongs to the object at ffff88802c876600 [ 78.005825][ T5764] which belongs to the cache kmalloc-256 of size 256 [ 78.019869][ T5764] The buggy address is located 60 bytes inside of [ 78.019869][ T5764] freed 256-byte region [ffff88802c876600, ffff88802c876700) [ 78.033571][ T5764] [ 78.035881][ T5764] The buggy address belongs to the physical page: [ 78.042286][ T5764] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c876 [ 78.051035][ T5764] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 78.059520][ T5764] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 78.067061][ T5764] page_type: f5(slab) [ 78.071024][ T5764] raw: 00fff00000000040 ffff88813fe19b40 dead000000000100 dead000000000122 [ 78.079586][ T5764] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 78.088150][ T5764] head: 00fff00000000040 ffff88813fe19b40 dead000000000100 dead000000000122 [ 78.096802][ T5764] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 78.105456][ T5764] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 78.114111][ T5764] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 78.122761][ T5764] page dumped because: kasan: bad access detected [ 78.129175][ T5764] page_owner tracks the page as allocated [ 78.134867][ T5764] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11596325178, free_ts 0 [ 78.154557][ T5764] post_alloc_hook+0x231/0x280 [ 78.159318][ T5764] get_page_from_freelist+0x24ba/0x2540 [ 78.164852][ T5764] __alloc_frozen_pages_noprof+0x18d/0x380 [ 78.170639][ T5764] allocate_slab+0x77/0x660 [ 78.175120][ T5764] refill_objects+0x339/0x3d0 [ 78.179773][ T5764] __pcs_replace_empty_main+0x321/0x720 [ 78.185298][ T5764] __kmalloc_cache_noprof+0x392/0x660 [ 78.190652][ T5764] bus_add_driver+0x162/0x670 [ 78.195313][ T5764] driver_register+0x23a/0x320 [ 78.200067][ T5764] usb_register_driver+0x1e4/0x390 [ 78.205161][ T5764] do_one_initcall+0x250/0x870 [ 78.209907][ T5764] do_initcall_level+0x104/0x190 [ 78.214826][ T5764] do_initcalls+0x59/0xa0 [ 78.219222][ T5764] kernel_init_freeable+0x2a6/0x3e0 [ 78.224404][ T5764] kernel_init+0x1d/0x1d0 [ 78.228714][ T5764] ret_from_fork+0x514/0xb70 [ 78.233288][ T5764] page_owner free stack trace missing [ 78.238656][ T5764] [ 78.240965][ T5764] Memory state around the buggy address: [ 78.246575][ T5764] ffff88802c876500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.254622][ T5764] ffff88802c876580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.262669][ T5764] >ffff88802c876600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.270730][ T5764] ^ [ 78.276604][ T5764] ffff88802c876680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.284647][ T5764] ffff88802c876700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.292683][ T5764] ================================================================== [ 78.374893][ T5764] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 78.382138][ T5764] CPU: 0 UID: 0 PID: 5764 Comm: syz.4.14 Not tainted syzkaller #0 PREEMPT(full) [ 78.391232][ T5764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 78.401272][ T5764] Call Trace: [ 78.404541][ T5764] [ 78.407459][ T5764] vpanic+0x56c/0xa60 [ 78.411432][ T5764] ? __pfx_vpanic+0x10/0x10 [ 78.415920][ T5764] ? __pfx___schedule+0x10/0x10 [ 78.420764][ T5764] panic+0xc5/0xd0 [ 78.424506][ T5764] ? __pfx_panic+0x10/0x10 [ 78.428946][ T5764] ? preempt_schedule_common+0x82/0xd0 [ 78.434411][ T5764] ? dvb_frontend_release+0x40a/0x4d0 [ 78.439776][ T5764] check_panic_on_warn+0x89/0xb0 [ 78.444714][ T5764] ? dvb_frontend_release+0x40a/0x4d0 [ 78.450081][ T5764] end_report+0x73/0x170 [ 78.454321][ T5764] ? dvb_frontend_release+0x40a/0x4d0 [ 78.459688][ T5764] kasan_report+0x128/0x150 [ 78.464193][ T5764] ? dvb_frontend_release+0x40a/0x4d0 [ 78.469560][ T5764] dvb_frontend_release+0x40a/0x4d0 [ 78.474753][ T5764] ? __pfx_dvb_frontend_release+0x10/0x10 [ 78.480465][ T5764] __fput+0x44f/0xa60 [ 78.484446][ T5764] task_work_run+0x1d9/0x270 [ 78.489029][ T5764] ? __pfx_task_work_run+0x10/0x10 [ 78.494136][ T5764] exit_to_user_mode_loop+0xed/0x480 [ 78.499414][ T5764] ? rcu_is_watching+0x15/0xb0 [ 78.504177][ T5764] ? do_fast_syscall_32+0x33/0x70 [ 78.509195][ T5764] __do_fast_syscall_32+0x446/0x6e0 [ 78.514388][ T5764] ? do_fast_syscall_32+0x33/0x70 [ 78.519408][ T5764] ? irqentry_exit+0x10f/0x730 [ 78.524162][ T5764] ? trace_irq_disable+0x3b/0x140 [ 78.529183][ T5764] do_fast_syscall_32+0x33/0x70 [ 78.534026][ T5764] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 78.540347][ T5764] RIP: 0023:0xf701f01c [ 78.544411][ T5764] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 78.564010][ T5764] RSP: 002b:00000000f753fb1c EFLAGS: 00000206 ORIG_RAX: 00000000000001b4 [ 78.572418][ T5764] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e [ 78.580385][ T5764] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 78.588398][ T5764] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 78.596364][ T5764] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 78.604324][ T5764] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 78.612295][ T5764] [ 78.615678][ T5764] Kernel Offset: disabled [ 78.619990][ T5764] Rebooting in 86400 seconds..