last executing test programs: 14m54.243822613s ago: executing program 32 (id=655): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_COMPRESS_FILE(r0, 0xf518, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r4 = socket(0x80000000000000a, 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000027c0)='/proc/asound/timers\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000002800)={0x2020}, 0x2020) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000200)={0x2, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2}}}, 0x108) close_range(0xffffffffffffffff, r3, 0x2) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, 0x0, &(0x7f0000000600)=0x51) sendmsg$NFT_MSG_GETOBJ(r1, 0x0, 0x20000000) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40000) r7 = socket(0x2b, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000180)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x8000000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x8000000, 0x2, 0x0, 0x18, 0x4, 0x96}, 0x20) 12m40.233126017s ago: executing program 33 (id=1339): socket$kcm(0x1e, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x2, 0x4, 0x1, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000068a1f396850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000200007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x6a2e4e0ed11fabf6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5, 0x1000}, 0x50) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 11m22.764072772s ago: executing program 34 (id=1736): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'veth0_vlan\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@private2, 0x0, r3}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000040)={@private2, r3}, 0x14) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000001000010029bd7000fcdbdf2500000000", @ANYRES32=r3, @ANYBLOB="3a8d04005a10000008000400440000003cfeca652dfefec138590900000000"], 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) 7m48.863142942s ago: executing program 35 (id=2525): openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r2 = syz_io_uring_setup(0x10f, &(0x7f0000000380)={0x0, 0x46ee, 0x400, 0xffffdffe, 0x32e}, &(0x7f0000000140), &(0x7f0000000200)) io_uring_enter(r2, 0x3516, 0x67f, 0x64, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r3, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r3, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1, 0x1, 0x19e000}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r4) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000500)=@allocspi={0x100, 0x16, 0x501, 0x70bd2c, 0x25dfdbfe, {{{@in6=@dev={0xfe, 0x80, '\x00', 0x27}, @in=@multicast2, 0x4e22, 0x6, 0x4e24, 0xfffa, 0x2, 0x80, 0x120, 0x88}, {@in=@dev={0xac, 0x14, 0x14, 0xa}, 0x4d5, 0x33}, @in6=@remote, {0x1ff, 0xa2, 0x7, 0xfffffffffffffffc, 0x0, 0x4, 0x7fff, 0x48fe}, {0x4, 0x9, 0x5fde, 0xffff}, {0x5, 0xfffffff8, 0x9}, 0x70bd26, 0x0, 0xa, 0x2, 0x7f, 0x1}, 0x3, 0xde}, [@tfcpad={0x8, 0x16, 0x80000000}]}, 0x100}, 0x1, 0x0, 0x0, 0x4075}, 0xc800) getpid() syz_80211_join_ibss(&(0x7f0000000200)='wlan0\x00', &(0x7f00000002c0)=@default_ap_ssid, 0x6, 0x1) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r7 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000000340)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000007900)="60c82576efc9d0a70afe7d1f701514e8ddaf2ce931aaab50d884297e2a3f44c247d6955258350f25aa7129f8ed1faf90124306079032721b34a53b5e905aedad57b2dd637d53541f7bda2490cd12ec78d7afbe09b867d7d94432b44dbb1368245b34b1a03b7bf7c9ec3fbea5984d19cdb2fc0b6af18c1676b3d07a67cf126657954501dd8f2822a377dd8409bd93a0588e55e4b87b363f162267690da18125520a7c781af27966a7fec54d00f9e06182040e84804ab24482107e5a292a6b7f129a6797938859d859d8ddba9b9c5c5baf375bd34831bd25b9660995e5f7ca0d8959fc23160d09287522000aa5670a78061870b8748f296bb43fe182754e5eb50b28e88103a93d709205931334aedee0746f3947fb2167a443b23d69b4e542c4f00ea288dfabbe879241b2617d5373470a99ebc10bb1ce8b6b0c4283c164d7b28ec1ff1e213a6bcb6524cefd85b0482383b08c4be43bc7c7948e07e555f24c4fade8177a8f13753ab388a4ffc12d3356bd1a7a9ba64bea748974cde0876afdd3155a4e353e306926f1617284579236e5294142f94258f6f7d3b85b0d99ba05842fe199895d15ad0bb994f49de1030c53007b395edd4f5bf170826243b35fdb41f1d09179beb94cf987831a16e57745f6f4199ae57c20367eacbc6b2499192ddc9a47b3d4d6fd40c0b82318fc824fbf179ac1229bac375a4656e27775c82c5975633dd6b8d770e3574ae418332cee033eab656160c112d50e14f72f7f1e5ff8caac5ccde17528290d2dfc06928dd02239f1b2ee528cbd0cd1f67547e51ffc6da7bd8b7360469b9260aacae8520214b78f6081e5c66e495764f8d5c7e404863441834cd6023bae0c6fd2930b26556b06352c5c1400ab39bfc61237b123290171f69e94b0ccf3dc5a0f1ffb9dc6cea71a8de6586156c571a3845a969cd015b17fe43cdc1ea67695ac1673addcecdbaca67e5cde9fa241c4ed874fec484259f46b31ae342dd99a584624deaf4008dc0079a9f3eddbfb6a4bcfc3ad57fe82e6f8de9d8c391a7774a542d9f58a4175e22db9866bf02c6b4f0c3c56e31f8c259e0475112117393d8d269e01441b30776fa98edc7972c257038ab46668c93e425d976d15d913fcf4e81aeb2ee6f1b1ca1c7abaa802072f1512324de2743791ec8a58ddac92eed5055f95e682f4f67fed4d2a7474bf2e44e8ef700747a08b4d5ea060c9c3b74903e870acb9e96a8be9fb92e266a9b1bd93d224a3534f210ffcc00c9830f643cfe5f3ac6ac15108c5982e769d487b8f8955bb7dc168c61c617e5e2aa559a84ee5768390313c09a8299421805dd50394c92803e13e5d41a57a9232de28fb546673592fb5b7fea00ff3eb0a6f8c4b294b28d0d42585cdd098ab90c872d9d48e0342231a2cd371c1241fdc55141ddd08decf335dcf6a9d15915198da2fe8b2e96704798981fd17f6ebd8bd6e29aa57768d5b76178ce8170f83a75fe3d64aea80ac0beb81104f843bea82e024baa38d622e73f879141e9998eb51164be3495755efb5db051253f306068c34143c496f786db589813db9dc3c656b6c481aa7a0d8b296e61c58d3c7522bb9be794ca39f752818a9c4fb46bacee0990a075b8bad12057e9e08fa4db1814c28a28a912ed121a9322171b1b83cb7c650aab82be444060703e99c570f22129105b38073e234ba2a33ace4cce89534de700d98a8b59f594f6bcc63b1eead2fd4b1a1e89de55d28b17b730569757e11d7c116150be182e9bdfcf5c3b08094eccb36715e6f8d67bae66599e98bcf58cc57c1f0f10794011ae4fd75a9f37c8111c36e3e7386d6660ec707a6bb4d6f8467e2341a166295db06aaba341070d30cf6bec4af3be44ff3de6e880656cce0123293e904c61c99411a9b49eb6c1f56f88f222dc7f9789dcfc3451c212b124fa9d62693b2d218b15a918fa7f216a7dbbb215795e2dbf1a8831a4a75ede9a60c3a2f1b6afb1c11b9b87988250c92dfe775a0bf926426821533af193594b03a483025b8dd142ce26eda63107f378107973b30ae463df7e29f5904344becd90c5e57c29dde6354e13ca6eb032e1c1d9086d1ffc0c86ba07a0e5f5016e23df007043dce3fd171ad80cddca0f7966f1f6f2ac687d66fef8db2545c127313b872851846b14e4a959c03c835b6a05ce82a1ac7d801f5ece2714fdc9796e40c0057e751bd268b55a01d9c822bcd8221365c734c0f945bce3e89a3adbe272f7a8e5a953da3a5a14e8c2114b8ddf72191a233293ea137526f3e19e4faa11fe9cea7bad7bd6c89e1bb07f6e12b8736c7bfa5a3292a4595aee301dc7d6f27e8ec05be7fffbfea3fc8b678b926dc292f2536f6fe392b4725b2fc8eb6c09f1be7ec809f21b1797f61f2d6dd4870d96a2365f53ba6042d4e36b2ecf2507552e648189901743be3d4a09c1a8f589e83780b9a1b6744add4b0827b5c58aff880b2cf04adf218634b55b299cacfc72b272065ceb4ea373db88589f6e15c02db51ef85d3190720d8ace28dd781281b72f75a64165daf0f82a82bd8b602cb087e388260e94d41b512b0fcb77103858a27ef35e601b070b245948092d72c3e3e02f9aadc48f5269fd2f25ee75572e34a6b25977c23243e3fda2a2a6fdb12adfcae7c73c45cba7a2e03820af9f8426146ade515851c5e789a3658ce2ff81f2f8ecd48394e3e6e7bf312ae9128c9c9fa63715875d2a221162f520cb5a90377f25d0919ba97b82c8cc3de4b5ddb0eb6c3ab4f01b9b731d7edbe78a908a28eb9d056e53f9db03f87214df6ae0474c965be0a02d0e376ef0bb0a950f6042c367ef68001229dc28187040e51e804ccec77796969b1f93af41040d2ffd9eb1444fdf151dc5ed73a9b6265257f6dde3e670b0e3e71b6b5ff050a9a0eb814dd91d315790bbacbfb8faf0237bc6ed96ac8b61a56ac452523868e066ad23be4b0bc7fdda3ff9987404cc93fa177b68363c06448dabe0cde9aa173b81596ca9879345745ff969fc7380a90db97c45821db78ba70afb0c4e432142144e595f6dc8300e6dbb4b122447bf9921db55febf47f5985993dcb10f815bb7074cbee3f2242ecf608529d113080a44d317bab6df6b157f890990715e611db285a5fb6018083af4b4dcfa7a5f120a286d892c57be433e95d96afb2816d766470e42a4a783b43b358ca413b7929b8cf7cae8aaf683b35cce3ae381c5c2a52c3f977853d3a990db6c97a2d3a088498e6bb9432f24c7e3adeeb2245622b47813d2fd6096953cea4902a595b849058fece99067fd6f28db479ac626e188e32d795aa1747e4901f5ce6250ec94e2df7f42734811fce1d909749874fa4ce27baed0f00b377df2f3c0c59a2c04bb610fb646dbb7bd9ed42ac2651b67f60728dfa2c4f673feb196d83f9917a85782de947441c6162f9f845f293f5036b66dca1582b7daa02cffaf46c875686c3d73fc5bad55eb196149de09d09985eda53bdc3a8ada4c88c7156d597658d6aa58c488389ab6d96a38962390b7a7bf2ac937d8cbb763d01fe73c81e", 0x9c4}], 0x1, &(0x7f0000001380)=[@assoc={0x18, 0x117, 0x4, 0xcf5}], 0x18}], 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) 5m51.910106289s ago: executing program 36 (id=2826): socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r1, 0x6, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x2040400) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) unshare(0x2000400) fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, &(0x7f0000001b00)={0x0, 0x34325842, 0x1, @discrete={0x1, 0x100}}) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x2fc, 0x18c, 0x203, 0x0, 0x19030000, 0x3e8, 0x2e0, 0x2e0, 0x3e8, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = gettid() process_vm_writev(r3, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0x2b, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000019240)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, &(0x7f0000000740)={0x2, @pix={0x1, 0x5, 0x33424752, 0x7, 0xf3, 0x3, 0x5, 0x40, 0x1, 0x2, 0x2}}) 4m0.300371089s ago: executing program 37 (id=3008): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) pread64(r0, 0x0, 0x0, 0x8002) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) syz_open_dev$usbfs(0x0, 0x77, 0x101301) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000200)=@mmap={0x1, 0x1, 0x4, 0x1, 0x6, {0x77359400}, {0x1, 0x8, 0x5, 0x9, 0x64, 0x5, ' \x00'}, 0xfffffff7, 0x1, {}, 0x2}) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) writev(r4, &(0x7f0000002240)=[{&(0x7f0000001080)="c668bc73132a5aff44007b4c6d094f35aa81232a24322f9a2e17f70cee940719931013c005507377fee4f043a0f28a06f967f2518ab10d48491095ae200186e299ed832ae337fcab1b77d6e0c96cc2db5972513e3c7edf72af0e0d4573516255dcf83c095688ed997dfab04ee615fedb0482d7e5b897d4fd9948a79a3735e881294ff3d907115e710eab3ec4855e98e2fbc8f62ac9c7adbe2c58cd83d7fca435224904cbc0079aad731bc992fb7bc4341a72b71b94693ef84edc09f9b7c2331d8561141b3fb9dc3875f08688fd2f952b6ac67e32f4a5b3022370ddab3ba9f6d3a11c30d52bee1158d3b4ecc517c6254eb00a89c99ab0807125b4c2097071a920077cf3a923788c29ddd4551a67de22174dc169fbf920f982e97ed9f29dabd2652775a64d65f1b4622a1071e63be6501f0fcdf2e00b804a26a35b2e01a9a08825ea2eeea98db7adfb5b68d05bd1f9c202368f60f4e955283cbd108c3ed933c3f7fe406e65849b0e15b398d06e677a5b99f831fbdeb54f07076e136a10efaba02a0fa740f9e0b60811bb141f06e3e5bedaba3d6c79b4d76e30b40ab6a707b96c3c608881d803d1fb21eb63054811232c8f59d9f3fa8ebf29a756c9217326bbb3697f1fa373401d2dbc53f2d4e61f40dd9ecc27c98108a2e1e08a8e8731e6836a816911a8f53ee9fb742899f7d7887c13d85e28f7c6f5e014b74ee89040d6ae4d61cf1a620204ded033a3bdd16e9e9841bd39ec4db9ba42ce16453f3dd1b6f21b2d048fba16448fd8bc8fe8d67ba0d55f936a35fce819f49f581f8db2d54ffa08985c78cd3a6199d018224d05aac1211a59b7149f51c2dc37ef04415510dc07ce896af202741e44556d3c395cfa4828696d78216b9397b4353d2daaa4be026e93eeaa0bf1012f28c706eb5f560a037ab1999202f9cbabedfe522250c33f0869c758c73d684fb1b08289a78aea8014c995c5aeb2c7be56e243aa2ff9a879997478098896e249827b58a7a2061807892497b7eb56055c0b141ac704fa8d0b1c08c107edbf00d0936614ef8bc8520d8f7e65664a603c71bceba727ccf51ccfd32cb1352263f4b7cd908d87d3187b8cbc9ae267d48736f66b43d61f10acb78931d1b6c61e4d088c73967a4406ccc73b004b1e86f382c2afbbf891fb2d6d94112497a801af9b0b27d72a4c730c0c53c99b7449b8a2e64168eae10bf6cce557751b6b4221d5abbec2c94e0614c45a5bbceffe1e1c4ad4edfc9418c63feb162bfaa51b8e91e21f6ed0844c17604d9f91e0a4528da2bb9cebfd81794f6a611a6000ab8b9f9bc780ab868259e85abbf2ac9439cb6bfde7283152a5d9ed409934c9c3b4d7c193061d184b5965f8f642ff6710f3f50d703a847498988a83c6ba0c1707b3294fa65f2c50e5121426d5dc240171f1dae27b455a39b5a80196c8fa416f5ac6fcbac6eecb383f42b80c938ad13e2ef200bc0b0f155d8376f738e351f48ca1476f03618677fa761399ff2912e593d6c90f6f82eee8cf102f547604d28efdadbe6acd87979b780098b66dba9524441d8d37700729a6610107ebe29b5c9d4d2a77e8d619d304e84546bb15aeb39e54f50e5d287b0e2264780497654c53022b11af0a2b23ac05ea328c6dd55627c191ccd004aef9c7de0888c424a537ee0074e0dbacebea1a89d74c97529272b867c42222c6e457b067d26d63b949ed9b1103889b0754d6efea9c5096fb472979f62e11ec1d4539b471b0af008fa225a1e7bd697e86e3b87c2c85a3c060906f2611171a8264c2e2a859f7fcd3116749269f6309dab832aab9ada9ea652a8b3e53e4c183245bc26979b58a8f2286623b8c334bd8a36b0a45a1f15ee0ffcf9edaea69fc15c6df27efb88cd3058b2e6004249ff0afdf8b165d42efb86377434402cc249b8d2c24d017e7d30d35eb40de39b0b1f418493e6d926b1d5e2f929473b5b4d7290ac45a4faaa009fb54881cda265a6b2785c7c42347c916afd80f7fdb6b181a3d2c5dcd901fa66eb4a62b1e6802c4bcd2b66479065e94d206dfb21197b24341ca105525658dd15cf1c22ea2485e580fdde08d64e8ba036e299bbc6acd0d48f7cdf287ba249eaadde631695c3a3240a4f0d32d7baf2759224235fc17eff0c432c761bc0c299f556829071d10caf1898612c3a621008a6353df7a55bb6b223cd2339cd446b619d2eb004fc4526a25731ca7755be5eec9879101e3f41a7ca43bf3433ecdb1dc44c9168af76a829659e60171af3e1685871b0972e61ab2043c282510e289c2065cb77ca461640e0b3e433c7f618ae7ebbfe31f1350edf8d3680befe0e718064a7ca8c9a1d526ca78c4aa4079717ac8bcd6219a800eed8746ec0bed42f1943647122f9927df2c8683adfa16c8fc972a5428bb1e6e4d5d98d8fd2708d960edd4802f05f6d40eca95adf44f916c42f92b3e3892baa1387d4451fcfdac05eb3db6e0f6dd67e62e3222b6211073097cfcb2ded0a49510729e3eb362f4d171c1d8dc75760661ab0759a14eddf13913a30ea7f744292cb5c05aaf8283584ea835898b79b1f135c143349fa906333f5bcfa4291da6036f3b964a0b7ce31ba12e9493a01fa33a3741027397401d8cf85dc2c5b16959714fba4a58fbf1bc6bfe1cf31401f82ee0130545f781fb2adb8b2feb9bbc6cc00961660a8bf04d5f2205c0a3bd4c5064756dae35d64f34609c56c78352224ceb6e07a9a0a4c4a5632da6553f50a1b87463f5a00b3c4e8c6a8cfc9d217cab948a02e8fc9f22718850d295a4f52168423cfbc8535a8d3bd188af1b21239f5b67ec4d632666a33e4a61cb789b319c49d6de428d0e2a55576aac682532ccb061fea90d8c40f6ae0e8dcf3c4ea0664a8dd1843f593b3b910740771fc788d53ade3a0a490d405d18f153921fbb4969c87335c8a01beee463a20edb93362e369a71457c1f1bd07ead02adf1fe0132e38ac8c8c783eaa0a4f3853ebc880c755b0f42c878c67d6d3d1963880550545a19cfee51bec19b57d75b22ec7b427ec1c214158c5b81c08d5b0062a338fd0f28033251d53fab0ab12b5df515c07bca7b1b89ac16d8f57751a34f53f46f53e09595342f671502f8ff14223b1e8b659e569456d529d37ed5dbbabd418bb4909dde26e383074b06a74961ad2eafcc8d51f72edc0c27255b0f18415260a4dd7890023a2ae9d70fb5ee394c301b02f4a144e915f95820f879c39cfcb29b44759aaa17c703f8732e42346b6c7c31bb88e5044a37919eb58ca2ada699d36905677ff82776a9bb0e40001d1b0bf2c5e5a3248bfd429507acc78242536c28b59f0c8898216ced7a6823e4064a03a06323bd65077e2f9568996c5d945d3fe2a6e7338ef9cd4d3784b9ced97184c6df6841793f64f768c0c6327aeb775cb186dea645c9ebb34a4e8dc67d904304c1fbaa69d77859dfcc2c4ff7d9afe7a0fb37d9d83061aa5f0ebca84f510f3779c43b90718168b0a35a469e89d965bc43570f14f7898981916b954e030ae7841ad33cb96c6740bf8979e2504311ad6db1d551fb8dd2d14df5b47b2d719d920a44ef9186c141343f14555d76d545165f8ede11d57f309bf78439b7b1cd83ed1acfd94b3e06d07137cc9372978276173fd48ede04828e1d89f96c9fd3dab155f60833d4a5f2b483a11cc7d110a75ba42683be493d26b11bbfbc9a8c6be5ef55916ca9c492610731ba64d2cdec2375af24fcf8112e325f0c056dc9bc67ecd8c599cfee46231d06fa16cf072c728e02db1ace9cb833fb613588cec0dcf58fd295da5bbf5495b9397bf8224dbc930ae69961c2b1c3a89c67d9aa3c6a95f4177bc3508b94817696613dd6066f51842015ce7d749328c396c1d5c3ca7248975d4b74bd939e7afc8f3a074b44a68021aa85ca74df1b36dff1697668c3bbcab88fee1b5e990fca66bb099d4d697e6091056714e3ae944285f61421c9d54885c58cd73d1574b1192f61e4cff28bda0fe0854b59c9d58c1ad6f3976d4f5eb0167ae3891d61a081bd8dd10fe014b8d679c7f836c06e385a9479826a4585db46b0a8205c4add73b4da4c32c8f505d4b6f2ac635fb2f28d1e450808fbb2488267ca411a66a91b91782acdb61864573dff6772f48f866c32a2584b8b9dff228d78c33ab28f20f725c1629ed61fed32cb63c789bd1114e9468474f4a141d29d640fc724b6eeece4646315e766016f58d9d2d22f61740f218f6e3a68a9245a0a243ef30a53fa86524354fb693cd526cd2c8a397b1248c2d16e1a7c20425826ba959234479f3bc9ce36dac59fb769c35635f00bc2923ed6bc5ad0e9a3971cb4fc5b2526b0e2159e8da8e924b3065ec5c5241be60e9ef293806d84c511b9eb66615d212912ea6ccf739d1146863d3356f6c941015a8b90f6cf36f27c4a60a35cd5c93403ea648b41045dc9e155bab7aa59db38bd86ee37bcd9bb858a597ccdbf7a3e8c68c02f517a81cbd95d4bd879337fdcf5ff4db732a67daa6f7dac5cd4a25ec3dcd242234a868ea007474a000e3e1be95e896a9656b6a4b56fff894ff2deaacd58cead7813a281920b16d6fcd3fc367031fbeb996612e8dd769148467207dd21963abf07270ddf0fd592586fa33b291251b1820d2f1455eefc87f7ca725ef48d0880c84da8231e90c3af365abe50480851263e2d399d8b80fa836207911400c0cbe5233e568e6150db467f04d4f3ba6baca947c5b1921320d0acba75dc228f376db3435913af271ee780554bc036aa08de43d498b5e1af8ed3f138f0b49c1ab293f99149a7ef8fde00583854fdf0c6542ac50852786eef98a04ed86adc817fa160fe4a5d2b4d308bd5b5ec3d4cc04a544d6dee0b881a4f0ee5af50e346c99130f36fe2d6d49347ff67fd4ebc3ce85a343ca3cb79e4b8bee93480cab545941a629a07a9c7e0342a598fbb315145f7b360bf04310d2b0530a0d7131fd2ae1b7e9e3b7216524382a36107444861aac944dc89082f4f8e93408167211df56ec6c9a2d58b63112e263917519a5e16b7a42a5755913eda62916aa205b750772c5cb558cf75dc2c191d02ee95e1e96376e9edd293fa46974e771ed08b44efa45fde18f85fb7fc414c03d6671c39e98f9ba94e1a71e8c58c1be41d419b07c3ae727bcc3d3c25e20f6284188a5473a9a1b30ad20abe568bd01f634a60c8a4f05508fa4beb7bdaa81ef10616d8bd53553730a1a59b886f9c3cf0acbab450e66ed8a3ad1d6c7e60585bdbfcb861556bec84393c92d2314dfb73cda3c9397cb25df11912b28e37270856bae81687cb8a3b825f9e6f532020f5e183b9efafe4e838ff11bf3540c97f338387add109fd23eb99052ef8739e882a48f8c02c13deb4a01c03098c20afcc2b79d51c3347c9b2212b348aaf272c4021bac8d2dba916dae950f561718226020a527de32475b9dcb3237463cce653bb0e433f02fb7880de285b6a530a830d53026da52d87f462e3b393e089f169a9e1c52b55a1f2d2ef13045bee9036569b39366d", 0xf2f}], 0x1) 3m3.869050897s ago: executing program 38 (id=3133): socket$igmp6(0xa, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$netlink(0x10, 0x3, 0x0) 2m37.531472672s ago: executing program 7 (id=3225): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[], 0xc0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="b80000001900674c000000000000000000000000000000000000000000000000e000000200"/54], 0xb8}}, 0x0) syz_usb_connect$uac2(0x3, 0x7b, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x2466, 0x8010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x0, 0xf0, 0x4e, {0x8, 0xb, 0x0, 0x0, 0x1, 0xb, 0x20, 0x5}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x0, 0x9, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x5, 0x6, 0x3f, {0x8, 0x25, 0x1, 0x3, 0x0, 0x0, 0x8000}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x7, 0x6, 0x2, {0x8, 0x25, 0x1, 0x2, 0xc, 0xd, 0x6}}}}}}}}]}}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='cmdline\x00') munmap(&(0x7f00001d2000/0x2000)=nil, 0x2000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f000000f000/0x3000)=nil, &(0x7f000000d000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) preadv(r2, &(0x7f0000001200)=[{&(0x7f0000000080)=""/4097, 0xffffff51}], 0x1, 0x3f, 0x6a76) 2m34.136456028s ago: executing program 7 (id=3233): socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) preadv(r0, &(0x7f0000000580)=[{&(0x7f0000000440)=""/27, 0x1b}], 0x1, 0x9, 0x3dfc) timer_settime(r1, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) 2m33.476359561s ago: executing program 3 (id=3234): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e08092320"], 0xb) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xfffa}, 0xe) bind$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @none}, 0xe) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c010000100031082bbd700800000000ac1414aa000000000000000000000000e00000010000000000000000000000000000ecdf000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff000000000000000000000000000000002b000000ac1414aa000000010000000000000000fefffffffffffffffeffffffffffffff0000000000000000000000000000000000000000000000007f00000000000000000000000000000000000000000000084000"/117], 0x13c}}, 0x4050) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newtaction={0x14, 0x30, 0x1, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000881}, 0x2400c808) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc22, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r4, &(0x7f0000000580)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c005) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x6f5e, 0xa0001) setsockopt$sock_attach_bpf(r4, 0x1, 0x3e, &(0x7f0000000100)=r5, 0x4) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000480)="b9693e14ae39b9d4956589cd4383940ab3b40d07cb4c156f3ca6fc88de9cb8a4ecac59ed49fd2b216619907a0b6431db4058ea0fc81a8a2c0d90fe4a4d001cb9ee95d2753b07a7825250f7428fd1147c0143bfdaa681777e472c350000a1e49900194dc22df4c565e5e7dbf454da7e3171f9736ec5b31348bd11c559d531fc5ad17bb24275fe9a24f69f4c0d44458071aff8d3c4783a7f1ccd3442264f6416fda9da7fe6f999f956700335e3e6a034413af8c4ba7c00"/195, 0xc3}, {&(0x7f0000000380)="248d7ac09ae9afb8954f66838ae5bb401e1c656014c4c8af25db88b25065cb5a4c7073b230eb916c6ff171fd78611ff70f30b9e77db814a1d43c7fa7a70c0df21e728ed51b836e0ce6f3faf0e4817093867621b5e0c03cf4638bc53de55de11380d10ae2775154c1069ae25d99ff710f4bbf7b5e76282c2df5a2d1f289179a74a84d8aceef5d869e05cc5117f25cd1e4d2461a95237c2fa3ba38e181e3f23a3cde974dfa75aecc3b2ce33369ad52580a6cd143f10ac7e783955969b8bd05a524f919a2fd9d3cbd055b5d2f7f00ca58f6b770492f471dc3b6b3b101d10f157ec9f68dac9b8d18cf8b", 0xbf}, {&(0x7f0000000240)="a3df552cfd633a6742d5c27a9fc4f4", 0xffffff53}], 0x3}, 0x4009800) fanotify_init(0x200, 0x0) 2m30.585275303s ago: executing program 7 (id=3239): socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwrite64(r0, &(0x7f0000000800)="5b8529ae2468f4df9c", 0x9, 0x7) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) preadv(r0, &(0x7f0000000580)=[{&(0x7f0000000440)=""/27, 0x1b}], 0x1, 0x9, 0x3dfc) timer_settime(r1, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) 2m28.475310831s ago: executing program 1 (id=3243): r0 = syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x10, 0x4, 0x3cc}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r3 = socket$inet_sctp(0x2, 0x5, 0x84) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r3, 0x80, &(0x7f00000000c0)=@in6={0xa, 0x4e21, 0x200052, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x8}}) io_uring_enter(r0, 0x3514, 0x9141, 0x69, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f00000000c0)={0x2, 0x0, 0x4004, 0xffffffffffffffff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r4, 0x800448d5, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000380)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r7, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000128001007f00000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r8}, &(0x7f0000000240), &(0x7f0000000280)='%pS \x00'}, 0x20) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r9, 0x400454cd, 0x336) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local}) 2m28.474505631s ago: executing program 3 (id=3244): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x74fb01, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, 0x0, 0x60000) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x7fffc, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0x6, 0xb}, {0x6, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x20, 0x2, {{0x0, 0x1, 0x406, 0x4, 0x7fffffff, 0xb}, [@TCA_NETEM_LOSS={0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4004060}, 0x4008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000000300)={'syzkaller0\x00', @random="2b0100004ec6"}) 2m27.02510881s ago: executing program 3 (id=3245): fchdir(0xffffffffffffffff) exit(0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000280)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x7, 0x2}]}) r4 = socket$inet(0x2, 0xa, 0x0) sendmmsg$sock(r4, &(0x7f0000003280)=[{{&(0x7f0000000100)=@nl=@unspec, 0x12, 0x0}}], 0x1, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_register(0xffffffffffffffff, 0x0, 0x0) 2m27.024843567s ago: executing program 7 (id=3246): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x4088080, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000480)="1c0000001a009b8a140000003b00"/28, 0x1c) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) 2m25.689691598s ago: executing program 1 (id=3247): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x3000c005) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$sock(0xffffffffffffffff, 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r2 = io_uring_setup(0x364b, &(0x7f00000002c0)={0x0, 0xfb6b, 0x800, 0x0, 0x20000004}) listen(0xffffffffffffffff, 0xfffffffc) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000000580)="17", 0xffffffffffffff77, 0x10008095, 0x0, 0x0) 2m24.354275942s ago: executing program 1 (id=3248): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e26}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x7, 0x2, 0x2, 0x0, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) unshare(0x8000000) shmget$private(0x0, 0x1000, 0x1, &(0x7f000073c000/0x1000)=nil) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) 2m23.21644036s ago: executing program 7 (id=3251): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x1ce}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) utimensat(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, 0x0, 0x4000000) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1, 0x0, 0x0, r4}) 2m22.024791626s ago: executing program 7 (id=3252): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) pread64(r0, 0x0, 0x0, 0x8002) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x10) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000200)=@mmap={0x1, 0x1, 0x4, 0x1, 0x6, {0x77359400}, {0x1, 0x8, 0x5, 0x9, 0x64, 0x5, ' \x00'}, 0xfffffff7, 0x1, {}, 0x2}) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) writev(r4, &(0x7f0000002240)=[{&(0x7f0000001080)="c668bc73132a5aff44007b4c6d094f35aa81232a24322f9a2e17f70cee940719931013c005507377fee4f043a0f28a06f967f2518ab10d48491095ae200186e299ed832ae337fcab1b77d6e0c96cc2db5972513e3c7edf72af0e0d4573516255dcf83c095688ed997dfab04ee615fedb0482d7e5b897d4fd9948a79a3735e881294ff3d907115e710eab3ec4855e98e2fbc8f62ac9c7adbe2c58cd83d7fca435224904cbc0079aad731bc992fb7bc4341a72b71b94693ef84edc09f9b7c2331d8561141b3fb9dc3875f08688fd2f952b6ac67e32f4a5b3022370ddab3ba9f6d3a11c30d52bee1158d3b4ecc517c6254eb00a89c99ab0807125b4c2097071a920077cf3a923788c29ddd4551a67de22174dc169fbf920f982e97ed9f29dabd2652775a64d65f1b4622a1071e63be6501f0fcdf2e00b804a26a35b2e01a9a08825ea2eeea98db7adfb5b68d05bd1f9c202368f60f4e955283cbd108c3ed933c3f7fe406e65849b0e15b398d06e677a5b99f831fbdeb54f07076e136a10efaba02a0fa740f9e0b60811bb141f06e3e5bedaba3d6c79b4d76e30b40ab6a707b96c3c608881d803d1fb21eb63054811232c8f59d9f3fa8ebf29a756c9217326bbb3697f1fa373401d2dbc53f2d4e61f40dd9ecc27c98108a2e1e08a8e8731e6836a816911a8f53ee9fb742899f7d7887c13d85e28f7c6f5e014b74ee89040d6ae4d61cf1a620204ded033a3bdd16e9e9841bd39ec4db9ba42ce16453f3dd1b6f21b2d048fba16448fd8bc8fe8d67ba0d55f936a35fce819f49f581f8db2d54ffa08985c78cd3a6199d018224d05aac1211a59b7149f51c2dc37ef04415510dc07ce896af202741e44556d3c395cfa4828696d78216b9397b4353d2daaa4be026e93eeaa0bf1012f28c706eb5f560a037ab1999202f9cbabedfe522250c33f0869c758c73d684fb1b08289a78aea8014c995c5aeb2c7be56e243aa2ff9a879997478098896e249827b58a7a2061807892497b7eb56055c0b141ac704fa8d0b1c08c107edbf00d0936614ef8bc8520d8f7e65664a603c71bceba727ccf51ccfd32cb1352263f4b7cd908d87d3187b8cbc9ae267d48736f66b43d61f10acb78931d1b6c61e4d088c73967a4406ccc73b004b1e86f382c2afbbf891fb2d6d94112497a801af9b0b27d72a4c730c0c53c99b7449b8a2e64168eae10bf6cce557751b6b4221d5abbec2c94e0614c45a5bbceffe1e1c4ad4edfc9418c63feb162bfaa51b8e91e21f6ed0844c17604d9f91e0a4528da2bb9cebfd81794f6a611a6000ab8b9f9bc780ab868259e85abbf2ac9439cb6bfde7283152a5d9ed409934c9c3b4d7c193061d184b5965f8f642ff6710f3f50d703a847498988a83c6ba0c1707b3294fa65f2c50e5121426d5dc240171f1dae27b455a39b5a80196c8fa416f5ac6fcbac6eecb383f42b80c938ad13e2ef200bc0b0f155d8376f738e351f48ca1476f03618677fa761399ff2912e593d6c90f6f82eee8cf102f547604d28efdadbe6acd87979b780098b66dba9524441d8d37700729a6610107ebe29b5c9d4d2a77e8d619d304e84546bb15aeb39e54f50e5d287b0e2264780497654c53022b11af0a2b23ac05ea328c6dd55627c191ccd004aef9c7de0888c424a537ee0074e0dbacebea1a89d74c97529272b867c42222c6e457b067d26d63b949ed9b1103889b0754d6efea9c5096fb472979f62e11ec1d4539b471b0af008fa225a1e7bd697e86e3b87c2c85a3c060906f2611171a8264c2e2a859f7fcd3116749269f6309dab832aab9ada9ea652a8b3e53e4c183245bc26979b58a8f2286623b8c334bd8a36b0a45a1f15ee0ffcf9edaea69fc15c6df27efb88cd3058b2e6004249ff0afdf8b165d42efb86377434402cc249b8d2c24d017e7d30d35eb40de39b0b1f418493e6d926b1d5e2f929473b5b4d7290ac45a4faaa009fb54881cda265a6b2785c7c42347c916afd80f7fdb6b181a3d2c5dcd901fa66eb4a62b1e6802c4bcd2b66479065e94d206dfb21197b24341ca105525658dd15cf1c22ea2485e580fdde08d64e8ba036e299bbc6acd0d48f7cdf287ba249eaadde631695c3a3240a4f0d32d7baf2759224235fc17eff0c432c761bc0c299f556829071d10caf1898612c3a621008a6353df7a55bb6b223cd2339cd446b619d2eb004fc4526a25731ca7755be5eec9879101e3f41a7ca43bf3433ecdb1dc44c9168af76a829659e60171af3e1685871b0972e61ab2043c282510e289c2065cb77ca461640e0b3e433c7f618ae7ebbfe31f1350edf8d3680befe0e718064a7ca8c9a1d526ca78c4aa4079717ac8bcd6219a800eed8746ec0bed42f1943647122f9927df2c8683adfa16c8fc972a5428bb1e6e4d5d98d8fd2708d960edd4802f05f6d40eca95adf44f916c42f92b3e3892baa1387d4451fcfdac05eb3db6e0f6dd67e62e3222b6211073097cfcb2ded0a49510729e3eb362f4d171c1d8dc75760661ab0759a14eddf13913a30ea7f744292cb5c05aaf8283584ea835898b79b1f135c143349fa906333f5bcfa4291da6036f3b964a0b7ce31ba12e9493a01fa33a3741027397401d8cf85dc2c5b16959714fba4a58fbf1bc6bfe1cf31401f82ee0130545f781fb2adb8b2feb9bbc6cc00961660a8bf04d5f2205c0a3bd4c5064756dae35d64f34609c56c78352224ceb6e07a9a0a4c4a5632da6553f50a1b87463f5a00b3c4e8c6a8cfc9d217cab948a02e8fc9f22718850d295a4f52168423cfbc8535a8d3bd188af1b21239f5b67ec4d632666a33e4a61cb789b319c49d6de428d0e2a55576aac682532ccb061fea90d8c40f6ae0e8dcf3c4ea0664a8dd1843f593b3b910740771fc788d53ade3a0a490d405d18f153921fbb4969c87335c8a01beee463a20edb93362e369a71457c1f1bd07ead02adf1fe0132e38ac8c8c783eaa0a4f3853ebc880c755b0f42c878c67d6d3d1963880550545a19cfee51bec19b57d75b22ec7b427ec1c214158c5b81c08d5b0062a338fd0f28033251d53fab0ab12b5df515c07bca7b1b89ac16d8f57751a34f53f46f53e09595342f671502f8ff14223b1e8b659e569456d529d37ed5dbbabd418bb4909dde26e383074b06a74961ad2eafcc8d51f72edc0c27255b0f18415260a4dd7890023a2ae9d70fb5ee394c301b02f4a144e915f95820f879c39cfcb29b44759aaa17c703f8732e42346b6c7c31bb88e5044a37919eb58ca2ada699d36905677ff82776a9bb0e40001d1b0bf2c5e5a3248bfd429507acc78242536c28b59f0c8898216ced7a6823e4064a03a06323bd65077e2f9568996c5d945d3fe2a6e7338ef9cd4d3784b9ced97184c6df6841793f64f768c0c6327aeb775cb186dea645c9ebb34a4e8dc67d904304c1fbaa69d77859dfcc2c4ff7d9afe7a0fb37d9d83061aa5f0ebca84f510f3779c43b90718168b0a35a469e89d965bc43570f14f7898981916b954e030ae7841ad33cb96c6740bf8979e2504311ad6db1d551fb8dd2d14df5b47b2d719d920a44ef9186c141343f14555d76d545165f8ede11d57f309bf78439b7b1cd83ed1acfd94b3e06d07137cc9372978276173fd48ede04828e1d89f96c9fd3dab155f60833d4a5f2b483a11cc7d110a75ba42683be493d26b11bbfbc9a8c6be5ef55916ca9c492610731ba64d2cdec2375af24fcf8112e325f0c056dc9bc67ecd8c599cfee46231d06fa16cf072c728e02db1ace9cb833fb613588cec0dcf58fd295da5bbf5495b9397bf8224dbc930ae69961c2b1c3a89c67d9aa3c6a95f4177bc3508b94817696613dd6066f51842015ce7d749328c396c1d5c3ca7248975d4b74bd939e7afc8f3a074b44a68021aa85ca74df1b36dff1697668c3bbcab88fee1b5e990fca66bb099d4d697e6091056714e3ae944285f61421c9d54885c58cd73d1574b1192f61e4cff28bda0fe0854b59c9d58c1ad6f3976d4f5eb0167ae3891d61a081bd8dd10fe014b8d679c7f836c06e385a9479826a4585db46b0a8205c4add73b4da4c32c8f505d4b6f2ac635fb2f28d1e450808fbb2488267ca411a66a91b91782acdb61864573dff6772f48f866c32a2584b8b9dff228d78c33ab28f20f725c1629ed61fed32cb63c789bd1114e9468474f4a141d29d640fc724b6eeece4646315e766016f58d9d2d22f61740f218f6e3a68a9245a0a243ef30a53fa86524354fb693cd526cd2c8a397b1248c2d16e1a7c20425826ba959234479f3bc9ce36dac59fb769c35635f00bc2923ed6bc5ad0e9a3971cb4fc5b2526b0e2159e8da8e924b3065ec5c5241be60e9ef293806d84c511b9eb66615d212912ea6ccf739d1146863d3356f6c941015a8b90f6cf36f27c4a60a35cd5c93403ea648b41045dc9e155bab7aa59db38bd86ee37bcd9bb858a597ccdbf7a3e8c68c02f517a81cbd95d4bd879337fdcf5ff4db732a67daa6f7dac5cd4a25ec3dcd242234a868ea007474a000e3e1be95e896a9656b6a4b56fff894ff2deaacd58cead7813a281920b16d6fcd3fc367031fbeb996612e8dd769148467207dd21963abf07270ddf0fd592586fa33b291251b1820d2f1455eefc87f7ca725ef48d0880c84da8231e90c3af365abe50480851263e2d399d8b80fa836207911400c0cbe5233e568e6150db467f04d4f3ba6baca947c5b1921320d0acba75dc228f376db3435913af271ee780554bc036aa08de43d498b5e1af8ed3f138f0b49c1ab293f99149a7ef8fde00583854fdf0c6542ac50852786eef98a04ed86adc817fa160fe4a5d2b4d308bd5b5ec3d4cc04a544d6dee0b881a4f0ee5af50e346c99130f36fe2d6d49347ff67fd4ebc3ce85a343ca3cb79e4b8bee93480cab545941a629a07a9c7e0342a598fbb315145f7b360bf04310d2b0530a0d7131fd2ae1b7e9e3b7216524382a36107444861aac944dc89082f4f8e93408167211df56ec6c9a2d58b63112e263917519a5e16b7a42a5755913eda62916aa205b750772c5cb558cf75dc2c191d02ee95e1e96376e9edd293fa46974e771ed08b44efa45fde18f85fb7fc414c03d6671c39e98f9ba94e1a71e8c58c1be41d419b07c3ae727bcc3d3c25e20f6284188a5473a9a1b30ad20abe568bd01f634a60c8a4f05508fa4beb7bdaa81ef10616d8bd53553730a1a59b886f9c3cf0acbab450e66ed8a3ad1d6c7e60585bdbfcb861556bec84393c92d2314dfb73cda3c9397cb25df11912b28e37270856bae81687cb8a3b825f9e6f532020f5e183b9efafe4e838ff11bf3540c97f338387add109fd23eb99052ef8739e882a48f8c02c13deb4a01c03098c20afcc2b79d51c3347c9b2212b348aaf272c4021bac8d2dba916dae950f561718226020a527de32475b9dcb3237463cce653bb0e433f02fb7880de285b6a530a830d53026da52d87f462e3b393e089f169a9e1c52b55a1f2d2ef13045bee9036569b39366d", 0xf2f}], 0x1) 2m20.219325986s ago: executing program 39 (id=3227): socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0xc, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) socket$netlink(0x10, 0x3, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x2) mount$tmpfs(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000280), 0x2000001, &(0x7f0000000080)=ANY=[@ANYBLOB='fscontext=unconfined_u,fscontext', @ANYRES16]) write(r3, &(0x7f00000008c0)="bae2bf808214ff98d8d00b4e4aa5b63a86342a471feaedd023fe0d23081a02d33e4a469ab9d700b98dbc637a1ab17ee404dfa6c5d5a144ee59221d4b94680ba508343a208a525cff39a2733191ec729e1ed6ee89970d901cdde9274de2a14d16d4b60efff4a823051100a4766a36baa70307cd088fcc9e7146a60c52282f525d113a20c411358bfa0b288791cc9dba6ba75a160cb7beda4a2a7f1a2fa5c565ff344c6b7550c85aeec24195055e0cb2b5ed37875be4e627ef1027ef44c76edb024b67d2dd316c9025880d70300e9ac5abae459e1de4d6868facadaf5c07042ba04768b47d542ef67510bc6a31e1c671cd366d1060843996078b8bceab4299a1fd7ff0318b010dfc8a95b9163505bdde7f92bccfb94a227d620c7fbf355564d75dadaeb40bfa148575d175ba6b276dd1f08de275305c679ed2ca319a0d0ea310eee868429deb863319197812d62a2961765536e8b81edabf419b3ee6c60e17b9c61353366cb3e11572e94b996053feb7854704a86cd638976f8373557ca455e43463252bff8f4835f05ac57cc3e29031d648a942c4f83823378367ff5ff6157e59ccb6b7236eeca6a5f962d3f79b677fa1d2b8baa374f5aab9ecabd7f024941d73db13ba01090a7544d51c2e1ffc35d383b355c359568623715caadca70f1125419af0a5ec9832a5885c29ac40b3fe2f9f173934bb57eef3c9ab71d1b747554fb403d22cd39f98d2ac6df121c75ea827d1790db6fc7c21f601f75bc9b7d5facd83cf77e4b666e3257fb81ac213d2afccd3cc5e2bab7db075d051cd5c9f860f421e672e6d3c2ffce5f51b45e24a1dcf27de17e47ad0d34fa1ead3fc3892593f29f94f26413603c490f9c7d0682de6f9048ae911615975cee4e8b1349133192bfe71130368238688b67b74631a1a524699d28d86427694f753daf88e009c4d34ed310fea1c7356e5abc256595589f704a69b36b6dd05060f3abd79af70d2eb438b85b3d35d300eabaf51bdf479e07ff1338eba821f0c2a395cd355103df33032c1cd8edcdc5425f4418f18b7c1e85fceeb6f41fbaed2573052cf087659520618fe64ec82ae8484b2ddb50a41762fc3f90b3ceb8b2d10bac688e2d35d35e93639ab72384bebe7690c467f0f678bd75c9aa67bc96d94c98ced73d22c6776c918fe50143b80dc80d97326858cbbff3d66f7dc788b788ef275c5037081e9f025e3becca7cf496f7cddd0da37a4ea323d5037bfbcb61edf8b5980269c788605be92bd56b2399e1d5c6dfb43b65d6c9fb9a1ea1c8c548833c48a255b81ac0f7029be6234823bcf232efdc8116d530b652bc6aeab4367f7a33b4d152646003c2064a0b1cabaef6c2391e71c822409130fc4d0a3c9d2895b3f3468a51b33c512711e36632597b3e582af545f29b698d2d41f8362080977d0a0d48d492cc4f61816b7fedd27b826f81e1cbffed54c31dc6ef4b986bad01da626237a2e6bca61e2329bc4e06de64fa68d371a2f0b5dfe017d321e09bd5fc8fba5416e8d7ea329ec0f9be877dc406b6f592dfb3176cffcd9a82ac7479e674d6f3c346fcd3cd2f65e724693b5ace04bb74c2e8a47717162a3b14fcd0b9045b48545ec9dd4d2d1926da207371dbb8e339bd5456f7e00dfb73a9ad86e5e902311644a9a0ce2cb9483b90c25c8e30984bac1c462c06f1b76c68f5a8ef8e6414c67b6a0f77e9eb2e56a8b9ebe6af0a8fa69a92ea6ffde0eee16696a065da53bb4cb51c5985fcb0434589b4628efcf14ddd5f17ec6bd1f219096e02dc364d036b21df65c16a7a83a2145996f2154719317f49444f6ba380b821e4ca10ebba5795d6f04fe252cfabc4ffba1ae5938450b6da37ad734cf298029bfdac3b28cf86f27696fb2b7707702606e3bf5ae65e0d74b3ba450cb36af1c975aead56e69d4e61d3b1941b15d4e017f46552caf43c5ac8beafcf4c0e64c8247136d8e36409ef2986b79c806f4122a44cf988ce789797ec8919f6daff8e353e2391e45f4a2dd9984fbc8646132e2502d462d04b2d7be73cca3ede4240e3368585083f7721da55c95fc49b43a28c3e09c5fb7b43e4dc48d1095d7327ec859d657cf9cc8eef62aac5f1948358727267b87741c27fcc4b3577552e8ad3393a28261a1f754e8130c5b696509b608eb18a0cea00709ec2698527182412559deb8158e2caac436d000b4fb0f98cf920be07f0cbf3eb042bf865f68ca9295e541ae1ec6620b657ffd021794c9e2af3fdaeb5d453c30f8f915b28f230deb1f0717992d9b33425b79106de94e1cdb79dd14627413af70a2d34c908d0c165a3601b0339a335bb44ae635fe96c932111f6eef5216e32a46085216ad85423ef9b0e335ff7028464ccaaaf146d846c436e1db3c77877dce48b92d6b7e1d04f455f66093a9b24c07ef58cbfa7626c03cdf2153f14b055eb6c3c98a28ca85a74c48773f829a35433f11078249dd0a4295dbc3cf539a2b68c472a3000bb1b8e0faee8ea405270532c20ef4955b54d768d99d83ba165f37061bad1d1dcb1d90162b2a6c7678068e665dfa9501d367e4ba272238a3f8919d7f19cb692f2679fb1ea43d3fcf7119ce967529450de7fb3a2bb9902bf5b146e37661a934554f12dfec8647a96c5efc7bf3256af35cc94b64ad1a6902c6b052bb7334a364b0eaa485dee260d1331620e59260517f5d79c5eefc11148062fc6d8296d40a0e832b406c39440945ef986f7bd5beeef8954a86d4efb2f0b1215a3860df643bfa2f8bc99113ea1401188b580ee168a3b62201529b581e360754ae9528f9a2339e9b91a60111bd31a0079f739219cc44f909291b62f120154f6b52acde04dbccf990fcc7a69ce2038abcb3a67c6486096646dda436b4a95e50c18756554c60c6c1cc54ce217b56bdc191ed7eb7878913203bc227b28d5fdf65953a59a2ee1e1238e2c661777a9159a101fccee86d1ce2b95f5ad3d91466d9c466f5eca143b29c2609c13f708d1467c3be9834a7846eb6914861aa7b44f63c509484ffca1cfb2e561af51cbde7ee3fc2e07fc5e0e81df9d935b09f9f9476b1f3dd14952ca4d110933ee4d92eb98ea6fac1111a33e4a23a8a0c8542d5351cf34820daf5b4b805b7e70e47daa9e2dad1f8c8bb88d49322c0b40b9d7517aeee63f2167aff6cbd520a7703b38f5fb1b35437b78749c884aeec19d39a27703422", 0x8d1) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x78, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb}, {0x0, 0xfff3}, {0xd, 0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x48, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0xc1f5}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_ACT={0x34, 0x9, 0x0, 0x1, [@m_csum={0x30, 0x6, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) getegid() bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 2m10.755850874s ago: executing program 40 (id=3245): fchdir(0xffffffffffffffff) exit(0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000280)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x7, 0x2}]}) r4 = socket$inet(0x2, 0xa, 0x0) sendmmsg$sock(r4, &(0x7f0000003280)=[{{&(0x7f0000000100)=@nl=@unspec, 0x12, 0x0}}], 0x1, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_register(0xffffffffffffffff, 0x0, 0x0) 2m8.239446416s ago: executing program 41 (id=3248): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e26}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x7, 0x2, 0x2, 0x0, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) unshare(0x8000000) shmget$private(0x0, 0x1000, 0x1, &(0x7f000073c000/0x1000)=nil) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) 2m4.572265066s ago: executing program 42 (id=3252): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) pread64(r0, 0x0, 0x0, 0x8002) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x10) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000200)=@mmap={0x1, 0x1, 0x4, 0x1, 0x6, {0x77359400}, {0x1, 0x8, 0x5, 0x9, 0x64, 0x5, ' \x00'}, 0xfffffff7, 0x1, {}, 0x2}) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) writev(r4, &(0x7f0000002240)=[{&(0x7f0000001080)="c668bc73132a5aff44007b4c6d094f35aa81232a24322f9a2e17f70cee940719931013c005507377fee4f043a0f28a06f967f2518ab10d48491095ae200186e299ed832ae337fcab1b77d6e0c96cc2db5972513e3c7edf72af0e0d4573516255dcf83c095688ed997dfab04ee615fedb0482d7e5b897d4fd9948a79a3735e881294ff3d907115e710eab3ec4855e98e2fbc8f62ac9c7adbe2c58cd83d7fca435224904cbc0079aad731bc992fb7bc4341a72b71b94693ef84edc09f9b7c2331d8561141b3fb9dc3875f08688fd2f952b6ac67e32f4a5b3022370ddab3ba9f6d3a11c30d52bee1158d3b4ecc517c6254eb00a89c99ab0807125b4c2097071a920077cf3a923788c29ddd4551a67de22174dc169fbf920f982e97ed9f29dabd2652775a64d65f1b4622a1071e63be6501f0fcdf2e00b804a26a35b2e01a9a08825ea2eeea98db7adfb5b68d05bd1f9c202368f60f4e955283cbd108c3ed933c3f7fe406e65849b0e15b398d06e677a5b99f831fbdeb54f07076e136a10efaba02a0fa740f9e0b60811bb141f06e3e5bedaba3d6c79b4d76e30b40ab6a707b96c3c608881d803d1fb21eb63054811232c8f59d9f3fa8ebf29a756c9217326bbb3697f1fa373401d2dbc53f2d4e61f40dd9ecc27c98108a2e1e08a8e8731e6836a816911a8f53ee9fb742899f7d7887c13d85e28f7c6f5e014b74ee89040d6ae4d61cf1a620204ded033a3bdd16e9e9841bd39ec4db9ba42ce16453f3dd1b6f21b2d048fba16448fd8bc8fe8d67ba0d55f936a35fce819f49f581f8db2d54ffa08985c78cd3a6199d018224d05aac1211a59b7149f51c2dc37ef04415510dc07ce896af202741e44556d3c395cfa4828696d78216b9397b4353d2daaa4be026e93eeaa0bf1012f28c706eb5f560a037ab1999202f9cbabedfe522250c33f0869c758c73d684fb1b08289a78aea8014c995c5aeb2c7be56e243aa2ff9a879997478098896e249827b58a7a2061807892497b7eb56055c0b141ac704fa8d0b1c08c107edbf00d0936614ef8bc8520d8f7e65664a603c71bceba727ccf51ccfd32cb1352263f4b7cd908d87d3187b8cbc9ae267d48736f66b43d61f10acb78931d1b6c61e4d088c73967a4406ccc73b004b1e86f382c2afbbf891fb2d6d94112497a801af9b0b27d72a4c730c0c53c99b7449b8a2e64168eae10bf6cce557751b6b4221d5abbec2c94e0614c45a5bbceffe1e1c4ad4edfc9418c63feb162bfaa51b8e91e21f6ed0844c17604d9f91e0a4528da2bb9cebfd81794f6a611a6000ab8b9f9bc780ab868259e85abbf2ac9439cb6bfde7283152a5d9ed409934c9c3b4d7c193061d184b5965f8f642ff6710f3f50d703a847498988a83c6ba0c1707b3294fa65f2c50e5121426d5dc240171f1dae27b455a39b5a80196c8fa416f5ac6fcbac6eecb383f42b80c938ad13e2ef200bc0b0f155d8376f738e351f48ca1476f03618677fa761399ff2912e593d6c90f6f82eee8cf102f547604d28efdadbe6acd87979b780098b66dba9524441d8d37700729a6610107ebe29b5c9d4d2a77e8d619d304e84546bb15aeb39e54f50e5d287b0e2264780497654c53022b11af0a2b23ac05ea328c6dd55627c191ccd004aef9c7de0888c424a537ee0074e0dbacebea1a89d74c97529272b867c42222c6e457b067d26d63b949ed9b1103889b0754d6efea9c5096fb472979f62e11ec1d4539b471b0af008fa225a1e7bd697e86e3b87c2c85a3c060906f2611171a8264c2e2a859f7fcd3116749269f6309dab832aab9ada9ea652a8b3e53e4c183245bc26979b58a8f2286623b8c334bd8a36b0a45a1f15ee0ffcf9edaea69fc15c6df27efb88cd3058b2e6004249ff0afdf8b165d42efb86377434402cc249b8d2c24d017e7d30d35eb40de39b0b1f418493e6d926b1d5e2f929473b5b4d7290ac45a4faaa009fb54881cda265a6b2785c7c42347c916afd80f7fdb6b181a3d2c5dcd901fa66eb4a62b1e6802c4bcd2b66479065e94d206dfb21197b24341ca105525658dd15cf1c22ea2485e580fdde08d64e8ba036e299bbc6acd0d48f7cdf287ba249eaadde631695c3a3240a4f0d32d7baf2759224235fc17eff0c432c761bc0c299f556829071d10caf1898612c3a621008a6353df7a55bb6b223cd2339cd446b619d2eb004fc4526a25731ca7755be5eec9879101e3f41a7ca43bf3433ecdb1dc44c9168af76a829659e60171af3e1685871b0972e61ab2043c282510e289c2065cb77ca461640e0b3e433c7f618ae7ebbfe31f1350edf8d3680befe0e718064a7ca8c9a1d526ca78c4aa4079717ac8bcd6219a800eed8746ec0bed42f1943647122f9927df2c8683adfa16c8fc972a5428bb1e6e4d5d98d8fd2708d960edd4802f05f6d40eca95adf44f916c42f92b3e3892baa1387d4451fcfdac05eb3db6e0f6dd67e62e3222b6211073097cfcb2ded0a49510729e3eb362f4d171c1d8dc75760661ab0759a14eddf13913a30ea7f744292cb5c05aaf8283584ea835898b79b1f135c143349fa906333f5bcfa4291da6036f3b964a0b7ce31ba12e9493a01fa33a3741027397401d8cf85dc2c5b16959714fba4a58fbf1bc6bfe1cf31401f82ee0130545f781fb2adb8b2feb9bbc6cc00961660a8bf04d5f2205c0a3bd4c5064756dae35d64f34609c56c78352224ceb6e07a9a0a4c4a5632da6553f50a1b87463f5a00b3c4e8c6a8cfc9d217cab948a02e8fc9f22718850d295a4f52168423cfbc8535a8d3bd188af1b21239f5b67ec4d632666a33e4a61cb789b319c49d6de428d0e2a55576aac682532ccb061fea90d8c40f6ae0e8dcf3c4ea0664a8dd1843f593b3b910740771fc788d53ade3a0a490d405d18f153921fbb4969c87335c8a01beee463a20edb93362e369a71457c1f1bd07ead02adf1fe0132e38ac8c8c783eaa0a4f3853ebc880c755b0f42c878c67d6d3d1963880550545a19cfee51bec19b57d75b22ec7b427ec1c214158c5b81c08d5b0062a338fd0f28033251d53fab0ab12b5df515c07bca7b1b89ac16d8f57751a34f53f46f53e09595342f671502f8ff14223b1e8b659e569456d529d37ed5dbbabd418bb4909dde26e383074b06a74961ad2eafcc8d51f72edc0c27255b0f18415260a4dd7890023a2ae9d70fb5ee394c301b02f4a144e915f95820f879c39cfcb29b44759aaa17c703f8732e42346b6c7c31bb88e5044a37919eb58ca2ada699d36905677ff82776a9bb0e40001d1b0bf2c5e5a3248bfd429507acc78242536c28b59f0c8898216ced7a6823e4064a03a06323bd65077e2f9568996c5d945d3fe2a6e7338ef9cd4d3784b9ced97184c6df6841793f64f768c0c6327aeb775cb186dea645c9ebb34a4e8dc67d904304c1fbaa69d77859dfcc2c4ff7d9afe7a0fb37d9d83061aa5f0ebca84f510f3779c43b90718168b0a35a469e89d965bc43570f14f7898981916b954e030ae7841ad33cb96c6740bf8979e2504311ad6db1d551fb8dd2d14df5b47b2d719d920a44ef9186c141343f14555d76d545165f8ede11d57f309bf78439b7b1cd83ed1acfd94b3e06d07137cc9372978276173fd48ede04828e1d89f96c9fd3dab155f60833d4a5f2b483a11cc7d110a75ba42683be493d26b11bbfbc9a8c6be5ef55916ca9c492610731ba64d2cdec2375af24fcf8112e325f0c056dc9bc67ecd8c599cfee46231d06fa16cf072c728e02db1ace9cb833fb613588cec0dcf58fd295da5bbf5495b9397bf8224dbc930ae69961c2b1c3a89c67d9aa3c6a95f4177bc3508b94817696613dd6066f51842015ce7d749328c396c1d5c3ca7248975d4b74bd939e7afc8f3a074b44a68021aa85ca74df1b36dff1697668c3bbcab88fee1b5e990fca66bb099d4d697e6091056714e3ae944285f61421c9d54885c58cd73d1574b1192f61e4cff28bda0fe0854b59c9d58c1ad6f3976d4f5eb0167ae3891d61a081bd8dd10fe014b8d679c7f836c06e385a9479826a4585db46b0a8205c4add73b4da4c32c8f505d4b6f2ac635fb2f28d1e450808fbb2488267ca411a66a91b91782acdb61864573dff6772f48f866c32a2584b8b9dff228d78c33ab28f20f725c1629ed61fed32cb63c789bd1114e9468474f4a141d29d640fc724b6eeece4646315e766016f58d9d2d22f61740f218f6e3a68a9245a0a243ef30a53fa86524354fb693cd526cd2c8a397b1248c2d16e1a7c20425826ba959234479f3bc9ce36dac59fb769c35635f00bc2923ed6bc5ad0e9a3971cb4fc5b2526b0e2159e8da8e924b3065ec5c5241be60e9ef293806d84c511b9eb66615d212912ea6ccf739d1146863d3356f6c941015a8b90f6cf36f27c4a60a35cd5c93403ea648b41045dc9e155bab7aa59db38bd86ee37bcd9bb858a597ccdbf7a3e8c68c02f517a81cbd95d4bd879337fdcf5ff4db732a67daa6f7dac5cd4a25ec3dcd242234a868ea007474a000e3e1be95e896a9656b6a4b56fff894ff2deaacd58cead7813a281920b16d6fcd3fc367031fbeb996612e8dd769148467207dd21963abf07270ddf0fd592586fa33b291251b1820d2f1455eefc87f7ca725ef48d0880c84da8231e90c3af365abe50480851263e2d399d8b80fa836207911400c0cbe5233e568e6150db467f04d4f3ba6baca947c5b1921320d0acba75dc228f376db3435913af271ee780554bc036aa08de43d498b5e1af8ed3f138f0b49c1ab293f99149a7ef8fde00583854fdf0c6542ac50852786eef98a04ed86adc817fa160fe4a5d2b4d308bd5b5ec3d4cc04a544d6dee0b881a4f0ee5af50e346c99130f36fe2d6d49347ff67fd4ebc3ce85a343ca3cb79e4b8bee93480cab545941a629a07a9c7e0342a598fbb315145f7b360bf04310d2b0530a0d7131fd2ae1b7e9e3b7216524382a36107444861aac944dc89082f4f8e93408167211df56ec6c9a2d58b63112e263917519a5e16b7a42a5755913eda62916aa205b750772c5cb558cf75dc2c191d02ee95e1e96376e9edd293fa46974e771ed08b44efa45fde18f85fb7fc414c03d6671c39e98f9ba94e1a71e8c58c1be41d419b07c3ae727bcc3d3c25e20f6284188a5473a9a1b30ad20abe568bd01f634a60c8a4f05508fa4beb7bdaa81ef10616d8bd53553730a1a59b886f9c3cf0acbab450e66ed8a3ad1d6c7e60585bdbfcb861556bec84393c92d2314dfb73cda3c9397cb25df11912b28e37270856bae81687cb8a3b825f9e6f532020f5e183b9efafe4e838ff11bf3540c97f338387add109fd23eb99052ef8739e882a48f8c02c13deb4a01c03098c20afcc2b79d51c3347c9b2212b348aaf272c4021bac8d2dba916dae950f561718226020a527de32475b9dcb3237463cce653bb0e433f02fb7880de285b6a530a830d53026da52d87f462e3b393e089f169a9e1c52b55a1f2d2ef13045bee9036569b39366d", 0xf2f}], 0x1) 1m53.762027319s ago: executing program 6 (id=3287): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000630127"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x24088000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[], 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 1m53.616799346s ago: executing program 6 (id=3289): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) getpid() bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000940)={0xffffffffffffffff, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000680)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3, &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000700)=[0x0, 0x0, 0x0], 0x0, 0x8, &(0x7f0000000740)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000780), &(0x7f00000007c0), 0x8, 0xc7, 0x8, 0x8, &(0x7f0000000800)}}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000080)={0x50, 0x0, r2, {0x7, 0x29, 0x9, 0xffffffff90acadc6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9}}, 0x50) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) syz_fuse_handle_req(r1, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getdents64(r3, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x20004014) epoll_create(0x89a) r4 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x600, 0x90, [0x200000000140, 0x0, 0x0, 0x200000000170, 0x2000000001a0], 0x0, 0x0, &(0x7f0000000140)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x108) 1m52.526894048s ago: executing program 6 (id=3291): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0xc, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) socket$netlink(0x10, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f00000008c0)="bae2bf808214ff98d8d00b4e4aa5b63a86342a471feaedd023fe0d23081a02d33e4a469ab9d700b98dbc637a1ab17ee404dfa6c5d5a144ee59221d4b94680ba508343a208a525cff39a2733191ec729e1ed6ee89970d901cdde9274de2a14d16d4b60efff4a823051100a4766a36baa70307cd088fcc9e7146a60c52282f525d113a20c411358bfa0b288791cc9dba6ba75a160cb7beda4a2a7f1a2fa5c565ff344c6b7550c85aeec24195055e0cb2b5ed37875be4e627ef1027ef44c76edb024b67d2dd316c9025880d70300e9ac5abae459e1de4d6868facadaf5c07042ba04768b47d542ef67510bc6a31e1c671cd366d1060843996078b8bceab4299a1fd7ff0318b010dfc8a95b9163505bdde7f92bccfb94a227d620c7fbf355564d75dadaeb40bfa148575d175ba6b276dd1f08de275305c679ed2ca319a0d0ea310eee868429deb863319197812d62a2961765536e8b81edabf419b3ee6c60e17b9c61353366cb3e11572e94b996053feb7854704a86cd638976f8373557ca455e43463252bff8f4835f05ac57cc3e29031d648a942c4f83823378367ff5ff6157e59ccb6b7236eeca6a5f962d3f79b677fa1d2b8baa374f5aab9ecabd7f024941d73db13ba01090a7544d51c2e1ffc35d383b355c359568623715caadca70f1125419af0a5ec9832a5885c29ac40b3fe2f9f173934bb57eef3c9ab71d1b747554fb403d22cd39f98d2ac6df121c75ea827d1790db6fc7c21f601f75bc9b7d5facd83cf77e4b666e3257fb81ac213d2afccd3cc5e2bab7db075d051cd5c9f860f421e672e6d3c2ffce5f51b45e24a1dcf27de17e47ad0d34fa1ead3fc3892593f29f94f26413603c490f9c7d0682de6f9048ae911615975cee4e8b1349133192bfe71130368238688b67b74631a1a524699d28d86427694f753daf88e009c4d34ed310fea1c7356e5abc256595589f704a69b36b6dd05060f3abd79af70d2eb438b85b3d35d300eabaf51bdf479e07ff1338eba821f0c2a395cd355103df33032c1cd8edcdc5425f4418f18b7c1e85fceeb6f41fbaed2573052cf087659520618fe64ec82ae8484b2ddb50a41762fc3f90b3ceb8b2d10bac688e2d35d35e93639ab72384bebe7690c467f0f678bd75c9aa67bc96d94c98ced73d22c6776c918fe50143b80dc80d97326858cbbff3d66f7dc788b788ef275c5037081e9f025e3becca7cf496f7cddd0da37a4ea323d5037bfbcb61edf8b5980269c788605be92bd56b2399e1d5c6dfb43b65d6c9fb9a1ea1c8c548833c48a255b81ac0f7029be6234823bcf232efdc8116d530b652bc6aeab4367f7a33b4d152646003c2064a0b1cabaef6c2391e71c822409130fc4d0a3c9d2895b3f3468a51b33c512711e36632597b3e582af545f29b698d2d41f8362080977d0a0d48d492cc4f61816b7fedd27b826f81e1cbffed54c31dc6ef4b986bad01da626237a2e6bca61e2329bc4e06de64fa68d371a2f0b5dfe017d321e09bd5fc8fba5416e8d7ea329ec0f9be877dc406b6f592dfb3176cffcd9a82ac7479e674d6f3c346fcd3cd2f65e724693b5ace04bb74c2e8a47717162a3b14fcd0b9045b48545ec9dd4d2d1926da207371dbb8e339bd5456f7e00dfb73a9ad86e5e902311644a9a0ce2cb9483b90c25c8e30984bac1c462c06f1b76c68f5a8ef8e6414c67b6a0f77e9eb2e56a8b9ebe6af0a8fa69a92ea6ffde0eee16696a065da53bb4cb51c5985fcb0434589b4628efcf14ddd5f17ec6bd1f219096e02dc364d036b21df65c16a7a83a2145996f2154719317f49444f6ba380b821e4ca10ebba5795d6f04fe252cfabc4ffba1ae5938450b6da37ad734cf298029bfdac3b28cf86f27696fb2b7707702606e3bf5ae65e0d74b3ba450cb36af1c975aead56e69d4e61d3b1941b15d4e017f46552caf43c5ac8beafcf4c0e64c8247136d8e36409ef2986b79c806f4122a44cf988ce789797ec8919f6daff8e353e2391e45f4a2dd9984fbc8646132e2502d462d04b2d7be73cca3ede4240e3368585083f7721da55c95fc49b43a28c3e09c5fb7b43e4dc48d1095d7327ec859d657cf9cc8eef62aac5f1948358727267b87741c27fcc4b3577552e8ad3393a28261a1f754e8130c5b696509b608eb18a0cea00709ec2698527182412559deb8158e2caac436d000b4fb0f98cf920be07f0cbf3eb042bf865f68ca9295e541ae1ec6620b657ffd021794c9e2af3fdaeb5d453c30f8f915b28f230deb1f0717992d9b33425b79106de94e1cdb79dd14627413af70a2d34c908d0c165a3601b0339a335bb44ae635fe96c932111f6eef5216e32a46085216ad85423ef9b0e335ff7028464ccaaaf146d846c436e1db3c77877dce48b92d6b7e1d04f455f66093a9b24c07ef58cbfa7626c03cdf2153f14b055eb6c3c98a28ca85a74c48773f829a35433f11078249dd0a4295dbc3cf539a2b68c472a3000bb1b8e0faee8ea405270532c20ef4955b54d768d99d83ba165f37061bad1d1dcb1d90162b2a6c7678068e665dfa9501d367e4ba272238a3f8919d7f19cb692f2679fb1ea43d3fcf7119ce967529450de7fb3a2bb9902bf5b146e37661a934554f12dfec8647a96c5efc7bf3256af35cc94b64ad1a6902c6b052bb7334a364b0eaa485dee260d1331620e59260517f5d79c5eefc11148062fc6d8296d40a0e832b406c39440945ef986f7bd5beeef8954a86d4efb2f0b1215a3860df643bfa2f8bc99113ea1401188b580ee168a3b62201529b581e360754ae9528f9a2339e9b91a60111bd31a0079f739219cc44f909291b62f120154f6b52acde04dbccf990fcc7a69ce2038abcb3a67c6486096646dda436b4a95e50c18756554c60c6c1cc54ce217b56bdc191ed7eb7878913203bc227b28d5fdf65953a59a2ee1e1238e2c661777a9159a101fccee86d1ce2b95f5ad3d91466d9c466f5eca143b29c2609c13f708d1467c3be9834a7846eb6914861aa7b44f63c509484ffca1cfb2e561af51cbde7ee3fc2e07fc5e0e81df9d935b09f9f9476b1f3dd14952ca4d110933ee4d92eb98ea6fac1111a33", 0x887) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x78, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb}, {0x0, 0xfff3}, {0xd, 0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x48, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0xc1f5}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_ACT={0x34, 0x9, 0x0, 0x1, [@m_csum={0x30, 0x6, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x6, 0xfffffffffffffffd, 0xe, 0xac, 0x3, 0x4, {0x0, 0xff00000000000000, 0x5, 0x40000000005, 0x85, 0x7fffffff, 0x8000, 0x7fffffff, 0xfffffffe, 0x4000, 0x0, 0xee00, 0x0, 0x3ff, 0x401}}, {0x0, 0x11}}}, 0xa0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 1m49.981947432s ago: executing program 6 (id=3295): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x1ce}, 0x0) socket(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) utimensat(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, 0x0, 0x4000000) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, 0x0) 1m48.82455517s ago: executing program 6 (id=3297): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000630127"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x24088000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[], 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 1m48.46055933s ago: executing program 6 (id=3298): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e26}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x7, 0x2, 0x2, 0x0, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) unshare(0x8000000) shmget$private(0x0, 0x1000, 0x1, &(0x7f000073c000/0x1000)=nil) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) 1m32.066190244s ago: executing program 43 (id=3298): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e26}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x7, 0x2, 0x2, 0x0, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) unshare(0x8000000) shmget$private(0x0, 0x1000, 0x1, &(0x7f000073c000/0x1000)=nil) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) 1m3.891449339s ago: executing program 0 (id=3378): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ff2000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff2000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x1000)=nil, 0x0, 0x3e}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x70c1, &(0x7f0000000380)={0x0, 0x3cb1, 0x0, 0xa, 0x20002f7}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20040804}, 0x400c0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000340)={0x0, 0x1, 0x0, &(0x7f00000001c0)=""/131, 0x0, 0x3332f000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000000)) dup(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001080)={0x200000, 0x200000, 0x0, 0x0, 0xb, 0x40000}) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000f00)='.\x00', 0x1948028, &(0x7f0000000280)=ANY=[], 0xa, 0x0, &(0x7f0000000180)) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000180)='./file1\x00', 0x1a5f421, 0x0, 0x38, 0x0, &(0x7f0000000140)) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_mount_image$squashfs(&(0x7f0000000340), &(0x7f0000000000)='./file1\x00', 0x200402, &(0x7f0000000200)=ANY=[], 0x1, 0x19c, &(0x7f0000000040)="$eJzsVb1uGkEQ/pbb40iUgjptUCBFwt2RoLxBqFLlAXKCC0E+/MMh2SCKc8WjIPkpXPgdXFhygwsKu8ClJeus3Z07FsmFJdsySPtJt983s7Mzs4s0/I8PYgfA/XLSRhkSDB9wwRg4gCpTvt+O4tui4ibZC67YI/8J8RVxPBojiKJwEI/GO0ExE9EzREqlc8/j0RZeotjbCYaNaMOIrRUlbEQbryPspwSvzF/HBdzIWXa+nLSF+AsgTdNU+DrqY3qMBeBMi/nI5ccspHkMl9MSqAKoD/v79Xg0/trrB92wG+76fqPpfnfdH379Xy8KXbUyrURBDTII/gJADLZ32r4N4JIG7Hu52sjAtNZon+lnxfxdJCqg9glrKGhn9Rwq72megwYtxFP8wWeUABwmTPNWZDYOebUWGCwyPK71qWqW5Ma39l7UmYKBZcdm4HkObw47N3zdaPxMshanxBXiFvGMeE7ssPX/JC4zXJNVS1aXFq6jYDgceEJL5ec+v5zQbyMfTlS9K65fruLAwMDAwMDAwGBL8BAAAP//KbFdPg==") unshare(0x8040480) ioctl$AUTOFS_IOC_PROTOSUBVER(0xffffffffffffffff, 0x80049367, &(0x7f00000000c0)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) socket(0x840000000002, 0x3, 0xff) 59.935776679s ago: executing program 0 (id=3386): prlimit64(0x0, 0xe, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x40000, &(0x7f0000000040)={[], [{@dont_appraise}], 0x3a}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) close(0xffffffffffffffff) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180), 0x4) preadv(0xffffffffffffffff, 0x0, 0x0, 0x401, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000206010200000000000000000000000015000300686173683a69702c706f72742c6e6574000000000900020073797a32000000000500040000000000140007800800124000000000050015002200000005000500020000000500010006"], 0x64}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c00000004060148a60df3a7d8082f000200000a05000100070000005f4e517bd27a2c84319718ca0a222fe1289cc1887bebd30ccc40b4f576459f375642d2950f91b91f017f88a47f924f623e1d50e7ea21528f17ae040aba4e3311d448da89b88db7746114b84245ec0fd3bf4996101e8aad829687b3fef7d697e30ef37b0b8b05c54ca6bad11bb8fcfe69fa73ec55c5eecdd4c2bea50587048c112ab4258963285063e93da3d465dd63f84d2000098fce5c10e1ca8d01485d857774b25826627eeff880d4b63346518e82d3dff4cba00ae1dad8fbf9c817405331d1b7d28d52829dc04d1b8eedebce732f22237d388ea320017e8baee41346c8c34b31ed666d00000000"], 0x1c}, 0x1, 0x0, 0x0, 0xc011}, 0x800) 58.61447406s ago: executing program 0 (id=3389): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ff2000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff2000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x1000)=nil, 0x0, 0x3e}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x70c1, &(0x7f0000000380)={0x0, 0x3cb1, 0x0, 0xa, 0x20002f7}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20040804}, 0x400c0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000340)={0x0, 0x1, 0x0, &(0x7f00000001c0)=""/131, 0x0, 0x3332f000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000000)) dup(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001080)={0x200000, 0x200000, 0x0, 0x0, 0xb, 0x40000}) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000f00)='.\x00', 0x1948028, &(0x7f0000000280)=ANY=[], 0xa, 0x0, &(0x7f0000000180)) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000180)='./file1\x00', 0x1a5f421, 0x0, 0x38, 0x0, &(0x7f0000000140)) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_mount_image$squashfs(&(0x7f0000000340), &(0x7f0000000000)='./file1\x00', 0x200402, &(0x7f0000000200)=ANY=[], 0x1, 0x19c, &(0x7f0000000040)="$eJzsVb1uGkEQ/pbb40iUgjptUCBFwt2RoLxBqFLlAXKCC0E+/MMh2SCKc8WjIPkpXPgdXFhygwsKu8ClJeus3Z07FsmFJdsySPtJt983s7Mzs4s0/I8PYgfA/XLSRhkSDB9wwRg4gCpTvt+O4tui4ibZC67YI/8J8RVxPBojiKJwEI/GO0ExE9EzREqlc8/j0RZeotjbCYaNaMOIrRUlbEQbryPspwSvzF/HBdzIWXa+nLSF+AsgTdNU+DrqY3qMBeBMi/nI5ccspHkMl9MSqAKoD/v79Xg0/trrB92wG+76fqPpfnfdH379Xy8KXbUyrURBDTII/gJADLZ32r4N4JIG7Hu52sjAtNZon+lnxfxdJCqg9glrKGhn9Rwq72megwYtxFP8wWeUABwmTPNWZDYOebUWGCwyPK71qWqW5Ma39l7UmYKBZcdm4HkObw47N3zdaPxMshanxBXiFvGMeE7ssPX/JC4zXJNVS1aXFq6jYDgceEJL5ec+v5zQbyMfTlS9K65fruLAwMDAwMDAwGBL8BAAAP//KbFdPg==") openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x2040, 0x120) ioctl$AUTOFS_IOC_PROTOSUBVER(0xffffffffffffffff, 0x80049367, &(0x7f00000000c0)) 57.310290261s ago: executing program 0 (id=3392): sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000540)=@nat={'nat\x00', 0x670, 0x5, 0x4d8, 0x2c8, 0x0, 0xffffffff, 0x228, 0x370, 0x440, 0x440, 0xffffffff, 0x440, 0x440, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010104, @local, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'wg1\x00', {}, {0xff}, 0x16}, 0x0, 0x1f0, 0x228, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "9401d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@dev={0xfe, 0x80, '\x00', 0x10}, [0xffffff00, 0xffffffff, 0x0, 0xff000000], @ipv4=@dev={0xac, 0x14, 0x14, 0x29}, [0x0, 0xffffff00, 0xff000000, 0xffffffff], @ipv6=@local, [0xff000000, 0xff, 0x0, 0xff], @ipv4=@broadcast, [0xffffffff, 0x0, 0xff], 0x7, 0x1, 0x5c, 0x4e1c, 0x4e22, 0x4e24, 0x4e24, 0x814, 0x20c0}, 0x80, 0x2}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x65, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x538) 52.598859318s ago: executing program 0 (id=3401): socket$netlink(0x10, 0x3, 0xc) socket$igmp(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0), 0x3) getsockopt$bt_hci(r0, 0x11a, 0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$key(0xf, 0x3, 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r2], 0x90}}, 0x0) 52.119204953s ago: executing program 0 (id=3404): exit(0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000280)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x7, 0x2}]}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) r4 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$binfmt_register(r4, 0x0, 0x0) 51.1259263s ago: executing program 4 (id=3406): socket(0x2, 0xa, 0x300) r0 = socket(0x2c, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000200), &(0x7f0000001500)=@tcp=r0}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'team_slave_0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) write$tun(0xffffffffffffffff, &(0x7f0000000740)=ANY=[@ANYBLOB="70000000ffffffffffff0180c200000e0800450000780000000000177c2275e687350016c82f9078ac1e0001e000000164006558006490780200000004000000020000002915a94a11e4"], 0x8a) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x410cd}, 0x400c084) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000080000", @ANYBLOB='\x00'/16, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000080", @ANYRES32=r2, @ANYBLOB="00000000010000801801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000600b70300000d0000008500000006000000852000000400000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 48.62046849s ago: executing program 4 (id=3410): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x3000c005) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = io_uring_setup(0x364b, &(0x7f00000002c0)={0x0, 0xfb6b, 0x800, 0x0, 0x20000004}) listen(0xffffffffffffffff, 0xfffffffc) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10008095, 0x0, 0x0) 47.26410521s ago: executing program 4 (id=3411): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[], 0xc0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="b80000001900674c000000000000000000000000000000000000000000000000e000000200000000000000000000000000000000000000000a"], 0xb8}}, 0x0) syz_usb_connect$uac2(0x3, 0x7b, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x2466, 0x8010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x0, 0xf0, 0x4e, {0x8, 0xb, 0x0, 0x0, 0x1, 0xb, 0x20, 0x5}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x0, 0x9, 0x9, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x5, 0x6, 0x3f, {0x8, 0x25, 0x1, 0x3, 0x0, 0x0, 0x8000}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x7, 0x6, 0x2, {0x8, 0x25, 0x1, 0x2, 0xc, 0xd, 0x6}}}}}}}}]}}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='cmdline\x00') munmap(&(0x7f00001d2000/0x2000)=nil, 0x2000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f000000f000/0x3000)=nil, &(0x7f000000d000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) preadv(r2, &(0x7f0000001200)=[{0x0}], 0x1, 0x3f, 0x6a76) 44.683560388s ago: executing program 4 (id=3419): r0 = fsopen(&(0x7f0000000180)='debugfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x82) inotify_init1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r4, r2, 0x25, 0x0, @val=@tcx={@void, @value=r4}}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r3, &(0x7f00000003c0), &(0x7f0000000040)=@tcp6=r5, 0x1}, 0x20) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0fe104", 0x14, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @empty}}}}}}, 0x0) 43.522083351s ago: executing program 4 (id=3421): socket(0x2, 0xa, 0x300) r0 = socket(0x2c, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000200), &(0x7f0000001500)=@tcp=r0}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'team_slave_0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) write$tun(0xffffffffffffffff, &(0x7f0000000740)=ANY=[@ANYBLOB="70000000ffffffffffff0180c200000e0800450000780000000000177c2275e687350016c82f9078ac1e0001e000000164006558006490780200000004000000020000002915a94a11e4"], 0x8a) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x410cd}, 0x400c084) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000080000", @ANYBLOB='\x00'/16, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000080", @ANYRES32=r2, @ANYBLOB="00000000010000801801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000600b70300000d0000008500000006000000852000000400000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 38.304729295s ago: executing program 4 (id=3428): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e26}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x7, 0x2, 0x2, 0x0, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) unshare(0x8000000) shmget$private(0x0, 0x1000, 0x1, &(0x7f000073c000/0x1000)=nil) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010200000000000000000000000014000780060004404e230000080012400015000805000400000000000900020073797a3000000000140007800800080000000000060005404e20000005000500020000000500010006000000"], 0x60}}, 0x6) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 35.492706989s ago: executing program 44 (id=3404): exit(0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000280)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x7, 0x2}]}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) r4 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$binfmt_register(r4, 0x0, 0x0) 21.786132125s ago: executing program 45 (id=3428): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e26}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x7, 0x2, 0x2, 0x0, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) unshare(0x8000000) shmget$private(0x0, 0x1000, 0x1, &(0x7f000073c000/0x1000)=nil) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010200000000000000000000000014000780060004404e230000080012400015000805000400000000000900020073797a3000000000140007800800080000000000060005404e20000005000500020000000500010006000000"], 0x60}}, 0x6) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 19.89885593s ago: executing program 9 (id=3459): io_uring_setup(0x70c1, &(0x7f0000000380)={0x0, 0x3cb1, 0x0, 0xa, 0x20002f7}) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20040804}, 0x400c0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001080)={0x200000, 0x200000, 0x0, 0x0, 0xb, 0x40000}) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f0000000f00)='.\x00', 0x1948028, &(0x7f0000000280)=ANY=[], 0xa, 0x0, &(0x7f0000000180)) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000180)='./file1\x00', 0x1a5f421, 0x0, 0x38, 0x0, &(0x7f0000000140)) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_mount_image$squashfs(&(0x7f0000000340), &(0x7f0000000000)='./file1\x00', 0x200402, &(0x7f0000000200)=ANY=[], 0x1, 0x19c, &(0x7f0000000040)="$eJzsVb1uGkEQ/pbb40iUgjptUCBFwt2RoLxBqFLlAXKCC0E+/MMh2SCKc8WjIPkpXPgdXFhygwsKu8ClJeus3Z07FsmFJdsySPtJt983s7Mzs4s0/I8PYgfA/XLSRhkSDB9wwRg4gCpTvt+O4tui4ibZC67YI/8J8RVxPBojiKJwEI/GO0ExE9EzREqlc8/j0RZeotjbCYaNaMOIrRUlbEQbryPspwSvzF/HBdzIWXa+nLSF+AsgTdNU+DrqY3qMBeBMi/nI5ccspHkMl9MSqAKoD/v79Xg0/trrB92wG+76fqPpfnfdH379Xy8KXbUyrURBDTII/gJADLZ32r4N4JIG7Hu52sjAtNZon+lnxfxdJCqg9glrKGhn9Rwq72megwYtxFP8wWeUABwmTPNWZDYOebUWGCwyPK71qWqW5Ma39l7UmYKBZcdm4HkObw47N3zdaPxMshanxBXiFvGMeE7ssPX/JC4zXJNVS1aXFq6jYDgceEJL5ec+v5zQbyMfTlS9K65fruLAwMDAwMDAwGBL8BAAAP//KbFdPg==") openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x2040, 0x120) ioctl$AUTOFS_IOC_PROTOSUBVER(0xffffffffffffffff, 0x80049367, &(0x7f00000000c0)) 18.352603818s ago: executing program 9 (id=3462): socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x1440, 0x0) socket$l2tp6(0xa, 0x2, 0x73) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498", 0x4e}], 0x1}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) 16.534307528s ago: executing program 9 (id=3465): r0 = fsopen(&(0x7f0000000180)='debugfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x82) inotify_init1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r4, r2, 0x25, 0x0, @val=@tcx={@void, @value=r4}}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r3, &(0x7f00000003c0), &(0x7f0000000040)=@tcp6=r5, 0x1}, 0x20) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0fe104", 0x14, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @empty}}}}}}, 0x0) 16.381580948s ago: executing program 9 (id=3466): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007a1ff00", @ANYRES32, @ANYBLOB="00000000100000001c001a80", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 16.080905224s ago: executing program 9 (id=3468): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) r5 = syz_open_dev$sg(&(0x7f00000008c0), 0x0, 0x1) ioctl$SG_IO(r5, 0x2285, 0x0) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x4c}}, 0x884) 14.256752351s ago: executing program 9 (id=3471): r0 = getpgid(0x0) sched_setattr(r0, &(0x7f0000000080)={0x38, 0x0, 0x24, 0x800, 0x2, 0xd, 0x2, 0x5, 0x8, 0x7}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x13732000) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) r2 = syz_io_uring_setup(0x24a9, &(0x7f0000000200)={0x0, 0xfffffffd, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, 0x0) io_uring_enter(r2, 0x2def, 0x0, 0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f00000000c0)=0x33, 0x8) listen(r1, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r7 = epoll_create1(0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{0x0}], 0x1) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r5, &(0x7f0000000300)={0x3000200b}) epoll_ctl$EPOLL_CTL_MOD(r7, 0x3, r6, &(0x7f0000000c40)={0x8000203d}) r8 = accept4(r1, 0x0, 0x0, 0x0) sendto(r8, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvfrom(r5, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000000840)={0x10, 0x0, 0x25dfdbfe, 0x8}, 0xc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 11.147381597s ago: executing program 2 (id=3476): socket(0x2, 0xa, 0x300) r0 = socket(0x2c, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000200), &(0x7f0000001500)=@tcp=r0}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'team_slave_0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) write$tun(0xffffffffffffffff, &(0x7f0000000740)=ANY=[@ANYBLOB="70000000ffffffffffff0180c200000e0800450000780000000000177c2275e687350016c82f9078ac1e0001e000000164006558006490780200000004000000020000002915a94a11e4"], 0x8a) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x410cd}, 0x400c084) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000080000", @ANYBLOB='\x00'/16, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000008085", @ANYRES32=r2, @ANYBLOB="00000000010000801801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000600b70300000d0000008500000006000000852000000400000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 10.72577737s ago: executing program 8 (id=3479): prlimit64(0x0, 0xe, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x40000, &(0x7f0000000040)={[], [{@dont_appraise}], 0x3a}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180), 0x4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x401, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000206010200000000000000000000000015000300686173683a69702c706f72742c6e6574000000000900020073797a32000000000500040000000000140007800800124000000000050015002200000005000500020000000500010006"], 0x64}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc011}, 0x800) 9.976741384s ago: executing program 8 (id=3480): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000002e00090027bd700000000000040000002400118031f9e05e2f"], 0x38}, 0x1, 0x0, 0x0, 0x42890}, 0x4004004) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) 9.840374502s ago: executing program 2 (id=3481): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000001d80)={0x0, @in6={{0xa, 0x4e23, 0x20006, @empty, 0x6}}, 0x7f, 0x2, 0x0, 0x5, 0x392, 0x94}, 0x9c) shutdown(r2, 0x0) socket$key(0xf, 0x3, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x4e24, 0x40, @local, 0x1}]}, &(0x7f0000000100)=0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, 0x0, &(0x7f0000002280)='//\xf2b\x06\b\xba\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b///\x00\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x97\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8DD\x9bp\x01\xcc:\xa6\xc5n\x9f\xfb\x81 \x10\x0fQ\x90}Zd\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x39c, 0xffffffff, 0x0, 0x0, 0x0, 0xfeffffff, 0xffffffff, 0x2d4, 0x2d4, 0x2d4, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xfc, 0x120, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'team0\x00', {0x6d, 0x6, 0x81, 0x9, 0x8, 0xf, 0x5, 0x20, 0x80}, {0x7}}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @REJECT={0x24}}, {{@uncond, 0x0, 0xc8, 0xec, 0x0, {}, [@common=@inet=@dscp={{0x24}, {0x4, 0x1}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x6}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x40c) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f00000006c0), 0x28c9c1, 0x0) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000940)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff92"], 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f00000005c0)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r5, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) clock_adjtime(0x0, &(0x7f0000001680)={0x2, 0x6a, 0x5, 0x8000000000000001, 0x48c, 0x5, 0xd, 0x424, 0x2, 0x7, 0xf423f, 0xfffffffffffffff9, 0x800007, 0x2, 0x83, 0x5, 0x0, 0x5, 0x0, 0xffffffff, 0x3, 0x0, 0x80000001, 0x0, 0x40005, 0xa}) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x19) socket$tipc(0x1e, 0x5, 0x0) getsockopt$inet_mptcp_buf(0xffffffffffffffff, 0x11c, 0x4, &(0x7f0000001740)=""/74, &(0x7f00000017c0)=0x4a) r6 = socket$tipc(0x1e, 0x5, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) fcntl$lock(r7, 0x25, &(0x7f0000000100)={0x0, 0x0, 0x4, 0x4000007fffffff}) fcntl$lock(r7, 0x6, &(0x7f0000000300)={0x1, 0x2, 0x7}) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000280)=@filter={'filter\x00', 0xe, 0x4, 0x38c, 0xffffffff, 0x268, 0x0, 0x268, 0xffffffff, 0xffffffff, 0x330, 0x330, 0x330, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @remote, [0xffffffff, 0xff, 0xff, 0xff], [0xff000000, 0xff000000, 0xff], 'netdevsim0\x00', 'pim6reg1\x00', {0xff}, {0xff}, 0x0, 0xd, 0x0, 0x2}, 0x0, 0xec, 0x110, 0x0, {}, [@common=@dst={{0x48}, {0x1, 0x1, 0x1, [0x6, 0x47de, 0x5, 0x3, 0x20, 0xe000, 0x0, 0x5400, 0x1222, 0x1, 0x7, 0x40, 0x8, 0x400, 0x3, 0x400], 0xb}}]}, @common=@unspec=@STANDARD={0x24, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0xa4, 0xec}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xf6fa, 'syz1\x00', {0xab7}}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @common=@unspec=@CONNSECMARK={0x24, 'CONNSECMARK\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x3e8) mremap(&(0x7f0000c04000/0x2000)=nil, 0x2000, 0x3000, 0x7, &(0x7f000022c000/0x3000)=nil) 6.590359406s ago: executing program 3 (id=3431): mount$overlay(0x0, 0x0, 0x0, 0x40000, &(0x7f0000000040)={[], [{@dont_appraise}], 0x3a}) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) close(0xffffffffffffffff) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000900"/15, @ANYBLOB="4422057394e16e1948d21b17ab2393f3b54cec1cbd4cd6767991cc4afab9d6a5ced27e1231a71fcc75746ebc5fd72ef63159213a65a12e57fa66f51579af6ed52493f151cb2c2d914aa039243ea55db73dd1b833872414252a270fad3a8d4258ce8c5620823a432037dfa64d505d35557ae3c03e75f90d4330c6cd7363c5703b603c4d98c5d468a2f57c1b70d27f9fd3eb995276c1b8a4fa71cb11b749", @ANYBLOB="0bb1000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704020002000000009500000000000000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x40002, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000800)=ANY=[@ANYBLOB="140100002f00010000000000fcdbdf250301f2800c00180008ac0f00000000001400010000000000000000000000ffffac14141650bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b96ec72dd71265fc2e882348c26c2126237dd5b37f5ae655cc727b3240e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be0400e90000bff2a6a9db393039f0a638a7bb9a85bc6293570f48eda1711fd37e3a393e3bb7105f9437b6dafe1e8db063c1323d1150d2735b09674d9a193d74a791d3737256cb01c01ee13c1679dbb3f2f21b84df2f8fef2f9492c6d8620f1e44ef9ae6e3817546bd33dc3d4a30657b29dfbbcccc94aa36ec"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r3 = io_uring_setup(0x8, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x2, 0x1}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) 4.753857862s ago: executing program 3 (id=3487): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./bus\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x6, 0x376, &(0x7f0000000280)="$eJzs3c9rK1UUwPGTNEmTPF4nC1EUpBffRjdDG12LQd4DIeCj70V8TxCm7URDxqTMhGpEbLtyK+5dCS5KdxZcFLT/QDfudCOCu24EF3ahjsyvZJJM0hhTo+33AyU3994zc+/MLZxJmMz5m5++16w7et3oSDqvJCUiciFSkrREUuFr2i/nJG5fXrj16/fPPnhUywcV6l7l4YtlpdTK6jfvf1QIu50sy1np7fNfyj+fPXn29PmfD99tOKrhqFa7owy12f6xY2xaptpuOE1dqfuWaTimarQc0w7avwq3Y7V3drrKaG3fLu7YpuMoo9VVTbOrOm3VsbvKeMdotJSu6+p2USbJTmy9KWqHGxtGZcbgrTkPBlfEtl1jSUQKIy21w4UMCAAALNRw/p/2UvpZ8v/HslKt3t1QXud+/n/03Gnn1hvHK2H+f5JLyv9f+iHY1kD+711O9PP/dnB9UL88//9cpsr/A6MZ0c0yc/5fuoLBYDaruZGq1MA7264YxfD/13fw1tGaXyD/BwAAAAAAAAAAAAAAAAAAAADg/+DCdTXXdbXoNfrr30IQvse1lB9z/pe9Nu/su5z/6+zBo8eS92/c886x9clubbcWvIYdTkXEEvMPN+WthRhvbUR3HilPSb619sL4vd3akt9SqUvDi5d10aQkMhjvuvdeq95dV4EwvnebUjEeXxZNnojHf+2vTi++PBgf7j8nz9+JxeuiyXdb0hZLtv3I/v4/Xlfq1derQ/EFv5+I/PSvnxQAAAAAAOZMVz2J1++6Pq49+JWRSt3/mMiUNdHk9+Tr+7XE6/OM9kxm0bMHAAAAAOBmcLofNg1Jm7ZfsKykQkEGa6Jv/RM7e4VC8naSC5mBmqyIJHbODdVkJ215KTbDKYdh5CR4gslUnScUvoiO6t+Jig6pN/BeU/6y4zyxEM3fr0llZp2OZaX2xV8A+/GmtEwRnhke/KpXoRI73xm7nYNwIr2a6GOj3JjjLPeHa5bDiORdZEdq3NRsC+Cpz7787Z+un37h5eNwBXxweecDy3T3xk1wUiGfeFh4PA4AAABwDfWT/qjmlXhz/EEi8Yfl8M09AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzNJcfKvMLrjauadFzBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP4r/goAAP//Di7sEA==") r0 = gettid() timer_create(0x0, &(0x7f00000001c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) socket$nl_generic(0x10, 0x3, 0x10) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 4.007441656s ago: executing program 5 (id=3489): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x401, 0xfe, 0x0, {0x0, 0x0, 0x0, 0x0, 0x44f81}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8}, @IFLA_HSR_SLAVE1={0x8}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x80c0) 3.915543776s ago: executing program 2 (id=3490): prlimit64(0x0, 0xe, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x40000, &(0x7f0000000040)={[], [{@dont_appraise}], 0x3a}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000180), 0x4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x401, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000206010200000000000000000000000015000300686173683a69702c706f72742c6e6574000000000900020073797a32000000000500040000000000140007800800124000000000050015002200000005000500020000000500010006"], 0x64}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc011}, 0x800) 3.812959507s ago: executing program 5 (id=3491): socket(0x2, 0xa, 0x300) r0 = socket(0x2c, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000200), &(0x7f0000001500)=@tcp=r0}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'team_slave_0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) write$tun(0xffffffffffffffff, &(0x7f0000000740)=ANY=[@ANYBLOB="70000000ffffffffffff0180c200000e0800450000780000000000177c2275e687350016c82f9078ac1e0001e000000164006558006490780200000004000000020000002915a94a11e4"], 0x8a) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x410cd}, 0x400c084) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000080000", @ANYBLOB='\x00'/16, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000008085", @ANYRES32=r2, @ANYBLOB="00000000010000801801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000600b70300000d0000008500000006000000852000000400000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 3.760294069s ago: executing program 3 (id=3492): r0 = getpgid(0x0) sched_setattr(r0, &(0x7f0000000080)={0x38, 0x0, 0x24, 0x800, 0x2, 0xd, 0x2, 0x5, 0x8, 0x7}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x13732000) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) r2 = syz_io_uring_setup(0x24a9, &(0x7f0000000200)={0x0, 0xfffffffd, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, 0x0) io_uring_enter(r2, 0x2def, 0x0, 0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f00000000c0)=0x33, 0x8) listen(r1, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r7 = epoll_create1(0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{0x0}], 0x1) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r5, &(0x7f0000000300)={0x3000200b}) epoll_ctl$EPOLL_CTL_MOD(r7, 0x3, r6, &(0x7f0000000c40)={0x8000203d}) r8 = accept4(r1, 0x0, 0x0, 0x0) sendto(r8, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvfrom(r5, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000000840)={0x10, 0x0, 0x25dfdbfe, 0x8}, 0xc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) 3.57983436s ago: executing program 1 (id=3455): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0xb7f, &(0x7f0000000500)={0x0, 0x38ab, 0x800, 0x0, 0x1e6}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r2, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0x0, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="200000000307010300000000000000000500000d090001"], 0x20}, 0x1, 0x0, 0x0, 0x8050}, 0x10) syz_io_uring_submit(r3, r4, &(0x7f0000000240)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x68, 0x12, r5, 0x0, 0x0, 0x0, 0x40000222, 0x0, {0x1}}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) 3.357755358s ago: executing program 5 (id=3493): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast1, @local}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast2, @dev={0xac, 0x14, 0x14, 0x38}}, 0xc) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) unshare(0x28000400) unshare(0x8000800) shmctl$IPC_INFO(0x0, 0x3, &(0x7f00000002c0)=""/4096) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) write$apparmor_exec(r3, &(0x7f0000000600)=ANY=[@ANYBLOB='stack #(%#{//&@\\)//&'], 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$RTC_EPOCH_READ(0xffffffffffffffff, 0x8004700d, &(0x7f0000000140)) preadv2(r1, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000280)=""/216, 0x48}], 0x2, 0x4, 0x58c8, 0x2) 2.829479079s ago: executing program 2 (id=3494): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) read$FUSE(r0, 0x0, 0x0) 2.677291139s ago: executing program 2 (id=3495): socket$netlink(0x10, 0x3, 0xc) socket$igmp(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0), 0x3) getsockopt$bt_hci(r0, 0x11a, 0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$key(0xf, 0x3, 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="900000001000030500000000000000", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r2], 0x90}}, 0x0) 2.084973624s ago: executing program 8 (id=3496): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) inotify_init() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket(0x1, 0x800, 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x2000400}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176}}], 0x400000000000172, 0x4000000) 1.975426573s ago: executing program 2 (id=3497): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket(0x1, 0x800, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a31000000000800054000000004"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = socket$inet6(0xa, 0x80002, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000580)={{{@in6, @in6=@loopback}}, {{@in6=@local}, 0x0, @in6=@initdev}}, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x2000400}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176}}], 0x400000000000172, 0x4000000) 1.746293386s ago: executing program 5 (id=3498): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'syz_tun\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x4e, &(0x7f00000000c0)=ANY=[], 0x0) 1.284278535s ago: executing program 5 (id=3499): r0 = fsopen(&(0x7f0000000180)='debugfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x82) inotify_init1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r4, r2, 0x25, 0x0, @val=@tcx={@void, @value=r4}}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r3, &(0x7f00000003c0), &(0x7f0000000040)=@tcp6=r5, 0x1}, 0x20) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0fe104", 0x14, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @empty}}}}}}, 0x0) 553.326424ms ago: executing program 1 (id=3500): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) 373.109952ms ago: executing program 1 (id=3501): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000000c0)=0x3, 0x4) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000100), 0x103902, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0x2a11, 0x400, 0x1, 0x40000335}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r1, 0x0, 0x0}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = syz_io_uring_setup(0x494, &(0x7f0000000400)={0x0, 0x2003f73, 0x100, 0x4, 0x1a}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r9, 0x16, 0x0, 0x1) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r7, 0x0, 0x0, 0x0, 0x2000, 0x1, {0x1}}) io_uring_enter(r9, 0x3516, 0xf4f5, 0x0, 0x0, 0x0) 0s ago: executing program 5 (id=3502): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x401, 0xfe, 0x0, {0x0, 0x0, 0x0, 0x0, 0x44f81}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8}, @IFLA_HSR_SLAVE1={0x8}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x80c0) kernel console output (not intermixed with test programs): 99 code=0x7ffc0000 [ 810.602868][T15141] veth0_macvtap: entered promiscuous mode [ 810.611908][ T31] audit: type=1326 audit(1774398508.881:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 810.691422][T15141] veth1_macvtap: entered promiscuous mode [ 810.767097][ T31] audit: type=1326 audit(1774398508.881:369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 810.818957][T15141] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 810.935773][ T31] audit: type=1326 audit(1774398508.891:370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fcc6359c502 code=0x7ffc0000 [ 811.020265][T15141] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 811.111318][ T995] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 811.158166][ T995] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 811.167151][ T995] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 811.191019][ T31] audit: type=1326 audit(1774398508.994:371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fcc6359c502 code=0x7ffc0000 [ 811.292675][ T995] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 811.459602][ T31] audit: type=1326 audit(1774398508.994:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 811.575380][ T31] audit: type=1326 audit(1774398508.994:373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 811.767343][ T31] audit: type=1326 audit(1774398509.003:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 811.863526][ T30] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 812.084352][ T31] audit: type=1326 audit(1774398509.489:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 812.124085][ T30] usb 9-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 812.175809][ T30] usb 9-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 812.201459][ T31] audit: type=1326 audit(1774398509.489:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15450 comm="syz.7.2935" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 812.235478][ T30] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.284986][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 812.316990][ T30] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 812.337887][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 813.482037][ T9868] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 813.497228][ T30] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 813.528482][ T30] stv0680 9-1:4.0: STV(e): camera ping failed!! [ 813.535362][ T9868] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 813.591607][ T30] stv0680 9-1:4.0: last error: 50, command = 0x65 [ 813.807431][ T30] usb 9-1: USB disconnect, device number 15 [ 814.725110][ T13] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 815.717745][T15509] 9pnet_virtio: no channels available for device syz [ 825.676304][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 825.683104][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 831.834685][ T38] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 833.876163][T15602] loop9: detected capacity change from 0 to 8 [ 834.415565][T15600] SQUASHFS error: Failed to read block 0xdfa: -5 [ 834.428818][T15600] SQUASHFS error: Unable to read metadata cache entry [dfa] [ 834.440704][T15600] SQUASHFS error: Failed to read block 0x4e8: -5 [ 834.451249][T15600] SQUASHFS error: Failed to read block 0x4de: -5 [ 834.457848][T15600] SQUASHFS error: Failed to read block 0x4de: -5 [ 834.464386][T15600] SQUASHFS error: Failed to read block 0x4de: -5 [ 834.470873][T15600] SQUASHFS error: Failed to read block 0x4de: -5 [ 834.477605][T15600] SQUASHFS error: Failed to read block 0x4de: -5 [ 834.484051][T15600] SQUASHFS error: Failed to read block 0x4de: -5 [ 834.490563][T15600] SQUASHFS error: Failed to read block 0x4de: -5 [ 834.497077][T15600] SQUASHFS error: Failed to read block 0x4de: -5 [ 834.503569][T15600] SQUASHFS error: Failed to read block 0x4e8: -5 [ 834.511239][ T31] kauditd_printk_skb: 38 callbacks suppressed [ 834.511261][ T31] audit: type=1800 audit(1774398531.883:415): pid=15600 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.2968" name="file1" dev="loop9" ino=5 res=0 errno=0 [ 834.588958][T15606] lo speed is unknown, defaulting to 1000 [ 836.283197][T15617] loop3: detected capacity change from 0 to 8 [ 836.954332][ T5912] usb 10-1: new low-speed USB device number 14 using dummy_hcd [ 837.211221][ T5912] usb 10-1: device descriptor read/64, error -71 [ 837.488854][ T5912] usb 10-1: new low-speed USB device number 15 using dummy_hcd [ 837.713394][ T5912] usb 10-1: device descriptor read/64, error -71 [ 837.831352][ T5912] usb usb10-port1: attempt power cycle [ 838.076963][T15631] loop1: detected capacity change from 0 to 2048 [ 838.236410][T15631] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 838.831960][ T5912] usb 10-1: new low-speed USB device number 16 using dummy_hcd [ 839.181639][ T5912] usb 10-1: device descriptor read/8, error -71 [ 841.192606][ T5912] usb 10-1: new low-speed USB device number 17 using dummy_hcd [ 841.476465][ T5912] usb 10-1: device not accepting address 17, error -71 [ 841.705028][ T5912] usb usb10-port1: unable to enumerate USB device [ 842.792731][T15663] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2975'. [ 842.803909][T15663] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2975'. [ 844.396818][T15684] loop9: detected capacity change from 0 to 128 [ 844.444148][T15684] EXT4-fs (loop9): Test dummy encryption mode enabled [ 844.526161][T15684] EXT4-fs (loop9): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 844.539015][T15684] ext4 filesystem being mounted at /57/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 846.148483][T14047] EXT4-fs (loop9): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 846.211817][ T31] audit: type=1326 audit(1774398542.818:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 846.311424][ T31] audit: type=1326 audit(1774398542.818:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 846.413718][ T31] audit: type=1326 audit(1774398542.827:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 846.599284][ T31] audit: type=1326 audit(1774398542.827:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fcc6359c502 code=0x7ffc0000 [ 846.668765][T15699] netlink: 'syz.9.2987': attribute type 1 has an invalid length. [ 846.711517][T15699] netlink: 224 bytes leftover after parsing attributes in process `syz.9.2987'. [ 846.772708][ T31] audit: type=1326 audit(1774398542.827:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fcc6359c502 code=0x7ffc0000 [ 847.676747][ T31] audit: type=1326 audit(1774398542.827:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 847.827385][ T31] audit: type=1326 audit(1774398542.855:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 847.974015][ T31] audit: type=1326 audit(1774398542.855:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 848.147404][ T31] audit: type=1326 audit(1774398542.855:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 848.273390][ T31] audit: type=1326 audit(1774398542.855:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15683 comm="syz.7.2985" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 848.302637][T15714] netlink: 'syz.8.2989': attribute type 1 has an invalid length. [ 848.398519][T15714] netlink: 224 bytes leftover after parsing attributes in process `syz.8.2989'. [ 849.780932][T15731] loop9: detected capacity change from 0 to 2048 [ 849.793763][ T30] usb 2-1: new low-speed USB device number 5 using dummy_hcd [ 851.237032][ T30] usb 2-1: device descriptor read/64, error -71 [ 851.888174][ T13] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 852.044157][T15731] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 853.117879][T15748] siw: device registration error -23 [ 854.828657][T15745] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2997'. [ 855.523966][ T9] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 856.988498][ T9] usb 10-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 857.008359][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.018950][ T9] usb 10-1: Product: syz [ 857.023505][ T9] usb 10-1: Manufacturer: syz [ 857.028311][ T9] usb 10-1: SerialNumber: syz [ 857.041054][ T9] usb 10-1: config 0 descriptor?? [ 857.823152][T15778] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3004'. [ 860.002583][ T5989] usb 10-1: USB disconnect, device number 18 [ 860.410903][T15787] 9pnet_virtio: no channels available for device syz [ 864.741669][ T9] usb 10-1: new low-speed USB device number 19 using dummy_hcd [ 865.070593][ T9] usb 10-1: device descriptor read/64, error -71 [ 865.327947][ T9] usb 10-1: new low-speed USB device number 20 using dummy_hcd [ 865.843965][ T9] usb 10-1: device descriptor read/64, error -71 [ 865.958419][ T9] usb usb10-port1: attempt power cycle [ 866.044667][ T13] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 866.321415][ T9] usb 10-1: new low-speed USB device number 21 using dummy_hcd [ 866.343533][ T9] usb 10-1: device descriptor read/8, error -71 [ 866.513508][T15837] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3003'. [ 868.919236][ T31] kauditd_printk_skb: 20 callbacks suppressed [ 868.919261][ T31] audit: type=1800 audit(1774398564.032:446): pid=15851 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3019" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 869.336869][ T9] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 869.410242][T15854] lo speed is unknown, defaulting to 1000 [ 869.625543][ T9] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 869.625576][ T9] usb 10-1: config 0 has no interface number 0 [ 869.713825][ T9] usb 10-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 869.713855][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 869.713874][ T9] usb 10-1: Product: syz [ 869.713888][ T9] usb 10-1: Manufacturer: syz [ 869.713902][ T9] usb 10-1: SerialNumber: syz [ 869.770301][ T9] usb 10-1: config 0 descriptor?? [ 869.781209][T15859] netlink: 'syz.1.3020': attribute type 1 has an invalid length. [ 869.781236][T15859] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3020'. [ 870.360788][ T9] dvb_usb_ec168 10-1:0.1: probe with driver dvb_usb_ec168 failed with error -32 [ 870.419698][ T9] usb 10-1: USB disconnect, device number 22 [ 873.802050][T15890] siw: device registration error -23 [ 874.757019][ T5989] usb 8-1: new low-speed USB device number 11 using dummy_hcd [ 874.895317][ T5989] usb 8-1: device descriptor read/64, error -71 [ 875.041103][T15909] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 875.152368][ T5989] usb 8-1: new low-speed USB device number 12 using dummy_hcd [ 875.244278][T15916] loop9: detected capacity change from 0 to 1024 [ 875.251766][T15916] hfsplus: Unknown parameter 'Ж«7Дг/‘W3ђTjBr?S*zнрҐќгєш'•HПЄ†2fЦМYЗђ¦z»bЕН“Ґj6Іt±zќ5гшріyЋD7о_хs' [ 875.431123][ T5989] usb 8-1: device descriptor read/64, error -71 [ 876.140321][ T5989] usb usb8-port1: attempt power cycle [ 876.605758][ T5989] usb 8-1: new low-speed USB device number 13 using dummy_hcd [ 876.630111][ T5989] usb 8-1: device descriptor read/8, error -71 [ 876.905396][ T5989] usb 8-1: new low-speed USB device number 14 using dummy_hcd [ 877.447637][ T5989] usb 8-1: device descriptor read/8, error -71 [ 877.579286][ T5989] usb usb8-port1: unable to enumerate USB device [ 877.700220][T15925] netlink: 'syz.9.3036': attribute type 1 has an invalid length. [ 877.700250][T15925] netlink: 224 bytes leftover after parsing attributes in process `syz.9.3036'. [ 879.020331][T15938] 9pnet_virtio: no channels available for device syz [ 883.202162][T15142] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 883.203973][T15142] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 883.204549][T15142] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 883.206364][T15142] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 883.213520][T15142] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 883.517795][T15954] lo speed is unknown, defaulting to 1000 [ 883.668460][T15967] netlink: 76 bytes leftover after parsing attributes in process `syz.7.3050'. [ 884.837672][ T9] usb 4-1: new low-speed USB device number 31 using dummy_hcd [ 886.283898][ T52] Bluetooth: hci5: command tx timeout [ 886.286268][ T9] usb 4-1: device descriptor read/64, error -71 [ 886.552436][ T9] usb 4-1: new low-speed USB device number 32 using dummy_hcd [ 886.690701][ T9] usb 4-1: device descriptor read/64, error -71 [ 886.829037][ T9] usb usb4-port1: attempt power cycle [ 887.232223][ T9] usb 4-1: new low-speed USB device number 33 using dummy_hcd [ 887.255078][ T9] usb 4-1: device descriptor read/8, error -71 [ 887.255462][ T12] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 887.520856][ T9] usb 4-1: new low-speed USB device number 34 using dummy_hcd [ 887.543360][ T9] usb 4-1: device descriptor read/8, error -71 [ 887.665096][ T9] usb usb4-port1: unable to enumerate USB device [ 888.485260][ T52] Bluetooth: hci5: command tx timeout [ 889.872884][T14599] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 889.914696][ T9] IPVS: starting estimator thread 0... [ 890.022933][T16010] IPVS: using max 30 ests per chain, 72000 per kthread [ 890.047115][T14599] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 890.047145][T14599] usb 8-1: config 0 has no interface number 0 [ 890.049624][T14599] usb 8-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 890.049650][T14599] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.049670][T14599] usb 8-1: Product: syz [ 890.049684][T14599] usb 8-1: Manufacturer: syz [ 890.049699][T14599] usb 8-1: SerialNumber: syz [ 890.053787][T14599] usb 8-1: config 0 descriptor?? [ 890.286487][T14599] dvb_usb_ec168 8-1:0.1: probe with driver dvb_usb_ec168 failed with error -32 [ 890.296426][T14599] usb 8-1: USB disconnect, device number 15 [ 890.664439][ T52] Bluetooth: hci5: command tx timeout [ 891.352974][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 891.353027][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 892.177461][T16024] siw: device registration error -23 [ 892.887908][ T52] Bluetooth: hci5: command tx timeout [ 893.706612][T15954] chnl_net:caif_netlink_parms(): no params data found [ 894.234703][ T5989] usb 4-1: new low-speed USB device number 35 using dummy_hcd [ 894.323324][ T31] audit: type=1800 audit(1774398587.838:447): pid=16038 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.3070" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 894.361375][T15954] bridge0: port 1(bridge_slave_0) entered blocking state [ 894.361591][T15954] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.361994][T15954] bridge_slave_0: entered allmulticast mode [ 894.417491][T15954] bridge_slave_0: entered promiscuous mode [ 894.418898][ T5989] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 894.418931][ T5989] usb 4-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 894.420018][ T5989] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 894.420049][ T5989] usb 4-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 894.421219][ T5989] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 894.421247][ T5989] usb 4-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 894.422901][T15954] bridge0: port 2(bridge_slave_1) entered blocking state [ 894.423115][T15954] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.423286][T15954] bridge_slave_1: entered allmulticast mode [ 894.427918][T15954] bridge_slave_1: entered promiscuous mode [ 894.431052][ T5989] usb 4-1: string descriptor 0 read error: -22 [ 894.431239][ T5989] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 894.431270][ T5989] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 894.432256][T16036] tipc: Started in network mode [ 894.432282][T16036] tipc: Node identity 463e592db436, cluster identity 4711 [ 894.432427][T16036] tipc: Enabled bearer , priority 0 [ 894.495116][ T5989] usb 4-1: rejected 3 configurations due to insufficient available bus power [ 894.495177][ T5989] usb 4-1: no configuration chosen from 3 choices [ 894.585774][T16036] tipc: Resetting bearer [ 894.695328][T16035] tipc: Disabling bearer [ 894.716192][T15954] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 894.742159][T15954] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 894.831081][T15954] team0: Port device team_slave_0 added [ 894.841051][T15954] team0: Port device team_slave_1 added [ 895.033252][T16044] netlink: 'syz.1.3073': attribute type 1 has an invalid length. [ 895.033281][T16044] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3073'. [ 895.630730][T15954] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 895.630748][T15954] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 895.630772][T15954] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 895.632313][T15954] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 895.632329][T15954] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 895.632360][T15954] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 895.725936][T16050] siw: device registration error -23 [ 895.753192][T15954] hsr_slave_0: entered promiscuous mode [ 895.759637][T15954] hsr_slave_1: entered promiscuous mode [ 895.766365][T15954] debugfs: 'hsr0' already exists in 'hsr' [ 895.766386][T15954] Cannot create hsr debugfs directory [ 895.808667][T16043] lo speed is unknown, defaulting to 1000 [ 896.447783][T14599] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 896.618964][T14599] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 896.618997][T14599] usb 10-1: config 0 has no interface number 0 [ 896.621165][T14599] usb 10-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 896.621191][T14599] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 896.621210][T14599] usb 10-1: Product: syz [ 896.621224][T14599] usb 10-1: Manufacturer: syz [ 896.621238][T14599] usb 10-1: SerialNumber: syz [ 896.635489][T14599] usb 10-1: config 0 descriptor?? [ 896.867903][T14599] dvb_usb_ec168 10-1:0.1: probe with driver dvb_usb_ec168 failed with error -32 [ 896.901494][ T5989] usb 10-1: USB disconnect, device number 23 [ 897.210131][T14599] usb 4-1: USB disconnect, device number 35 [ 898.309162][T15954] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 898.520459][T15954] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 898.603956][T15954] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 898.702791][T15954] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 899.307657][T15954] 8021q: adding VLAN 0 to HW filter on device bond0 [ 899.389322][T15954] 8021q: adding VLAN 0 to HW filter on device team0 [ 899.391841][T16108] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3088'. [ 899.391870][T16108] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3088'. [ 899.435588][ T9222] bridge0: port 1(bridge_slave_0) entered blocking state [ 899.435714][ T9222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 899.437560][ T9222] bridge0: port 2(bridge_slave_1) entered blocking state [ 899.437647][ T9222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 899.997043][T16114] siw: device registration error -23 [ 900.765216][T15954] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 900.929309][ T38] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 901.327556][ T5912] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 901.511958][ T5912] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 901.518393][ T5912] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 901.518418][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 901.518437][ T5912] usb 2-1: Product: syz [ 901.518451][ T5912] usb 2-1: Manufacturer: syz [ 901.518466][ T5912] usb 2-1: SerialNumber: syz [ 901.540271][ T5912] usb 2-1: config 0 descriptor?? [ 902.628660][ T10] usb 4-1: new low-speed USB device number 36 using dummy_hcd [ 902.731104][T15954] veth0_vlan: entered promiscuous mode [ 902.755457][T15954] veth1_vlan: entered promiscuous mode [ 902.790952][ T10] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 902.790989][ T10] usb 4-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 902.792977][ T10] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 902.793007][ T10] usb 4-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 902.798039][ T10] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 902.798069][ T10] usb 4-1: config 168 has 0 interfaces, different from the descriptor's value: 1 [ 902.817084][ T10] usb 4-1: string descriptor 0 read error: -22 [ 902.817229][ T10] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 902.817258][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.833600][ T10] usb 4-1: rejected 3 configurations due to insufficient available bus power [ 902.833637][ T10] usb 4-1: no configuration chosen from 3 choices [ 902.872326][T15954] veth0_macvtap: entered promiscuous mode [ 902.885677][T15954] veth1_macvtap: entered promiscuous mode [ 902.955553][T15954] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 902.978550][T15954] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 903.002409][T15124] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.002483][T15124] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.002779][T15124] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.002923][T15124] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.607627][ T9222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 903.607657][ T9222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 903.689717][T15124] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 903.689749][T15124] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 904.519180][T15142] Bluetooth: hci6: command 0x0406 tx timeout [ 905.040217][ T5912] usb 2-1: USB disconnect, device number 7 [ 905.534894][ T9] usb 4-1: USB disconnect, device number 36 [ 906.073108][ T10] IPVS: starting estimator thread 0... [ 906.108491][T16207] overlayfs: failed to clone upperpath [ 906.186718][T16208] IPVS: using max 32 ests per chain, 76800 per kthread [ 908.288436][T16218] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 910.441823][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 910.525744][T16246] lo speed is unknown, defaulting to 1000 [ 910.681702][ T10] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 910.681741][ T10] usb 5-1: config 0 has no interface number 0 [ 911.707126][ T10] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 911.707159][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 911.707179][ T10] usb 5-1: Product: syz [ 911.707194][ T10] usb 5-1: Manufacturer: syz [ 911.707209][ T10] usb 5-1: SerialNumber: syz [ 911.717250][ T10] usb 5-1: config 0 descriptor?? [ 911.964934][ T10] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in cold state [ 911.968091][ T10] usb 5-1: Direct firmware load for dvb-usb-ec168.fw failed with error -2 [ 911.968120][ T10] usb 5-1: Falling back to sysfs fallback for: dvb-usb-ec168.fw [ 912.120032][ T5912] usb 10-1: new full-speed USB device number 24 using dummy_hcd [ 912.308135][ T5912] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 912.308198][ T5912] usb 10-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 912.310693][ T5912] usb 10-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 912.310727][ T5912] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 912.310756][ T5912] usb 10-1: Product: syz [ 912.310777][ T5912] usb 10-1: Manufacturer: syz [ 912.310797][ T5912] usb 10-1: SerialNumber: syz [ 912.312684][T14599] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 912.337114][ T5912] usb 10-1: config 0 descriptor?? [ 912.358409][ T5912] radio-si470x 10-1:0.0: could not find interrupt in endpoint [ 912.358502][ T5912] radio-si470x 10-1:0.0: probe with driver radio-si470x failed with error -5 [ 912.358891][ T5912] usbhid 10-1:0.0: couldn't find an input interrupt endpoint [ 912.485763][T14599] usb 4-1: Using ep0 maxpacket: 8 [ 912.488104][T14599] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 912.490706][T14599] usb 4-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 912.490744][T14599] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.490771][T14599] usb 4-1: Product: syz [ 912.490791][T14599] usb 4-1: Manufacturer: syz [ 912.490811][T14599] usb 4-1: SerialNumber: syz [ 914.530133][T14599] usb 4-1: failed waiting for Axe-Fx III to boot: -71 [ 914.530343][T14599] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 914.570178][T14599] usb 4-1: USB disconnect, device number 37 [ 915.176809][ T9] usb 10-1: USB disconnect, device number 24 [ 917.696293][T16320] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3126'. [ 919.303511][T16323] lo speed is unknown, defaulting to 1000 [ 921.493650][ T38] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 921.829509][T16352] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3134'. [ 921.829555][T16352] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3134'. [ 922.169160][ T5892] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 922.352751][ T5892] usb 2-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 922.352814][ T5892] usb 2-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 922.354330][ T5892] usb 2-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 922.354389][ T5892] usb 2-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 922.355700][ T5892] usb 2-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 922.355750][ T5892] usb 2-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 922.358831][ T5892] usb 2-1: string descriptor 0 read error: -22 [ 922.358975][ T5892] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 922.359035][ T5892] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.443280][ T5892] adutux 2-1:168.0: interrupt endpoints not found [ 922.468842][T16363] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3136'. [ 922.694664][T16366] netlink: 76 bytes leftover after parsing attributes in process `syz.5.3137'. [ 923.453008][T16368] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3138'. [ 923.453033][T16368] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3138'. [ 923.553255][ T791] usb 2-1: USB disconnect, device number 8 [ 926.275966][T16401] loop9: detected capacity change from 0 to 128 [ 926.311486][T16401] EXT4-fs (loop9): Test dummy encryption mode enabled [ 926.337529][T16401] EXT4-fs (loop9): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 926.337930][T16401] ext4 filesystem being mounted at /83/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 926.535417][T16407] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3149'. [ 926.535461][T16407] netlink: 60 bytes leftover after parsing attributes in process `syz.7.3149'. [ 926.565458][T14047] EXT4-fs (loop9): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 927.450762][ T5892] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 927.712411][ T5892] usb 10-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 927.712477][ T5892] usb 10-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 927.712508][ T5892] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.724745][ T31] audit: type=1326 audit(1774398619.071:448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 927.731563][ T31] audit: type=1326 audit(1774398619.081:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 927.732173][ T31] audit: type=1326 audit(1774398619.081:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fcc6359c502 code=0x7ffc0000 [ 927.763429][ T5892] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 927.803919][ T31] audit: type=1326 audit(1774398619.118:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fcc6359c502 code=0x7ffc0000 [ 927.803978][ T31] audit: type=1326 audit(1774398619.118:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 927.804020][ T31] audit: type=1326 audit(1774398619.118:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 927.804060][ T31] audit: type=1326 audit(1774398619.118:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 927.804101][ T31] audit: type=1326 audit(1774398619.118:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 927.804142][ T31] audit: type=1326 audit(1774398619.128:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 927.804184][ T31] audit: type=1326 audit(1774398619.128:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16415 comm="syz.7.3153" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcc6359c799 code=0x7ffc0000 [ 928.894888][ T5892] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -32 [ 929.716959][ T5892] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 929.716995][ T5892] stv0680 10-1:4.0: last error: 86, command = 0x78 [ 929.719234][ T5892] usb 10-1: USB disconnect, device number 25 [ 932.314795][ T5892] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 932.491501][ T5892] usb 2-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 932.491547][ T5892] usb 2-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 932.500959][ T5892] usb 2-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 932.501013][ T5892] usb 2-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 932.507253][ T5892] usb 2-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 932.507304][ T5892] usb 2-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 932.519538][ T5892] usb 2-1: string descriptor 0 read error: -22 [ 932.519689][ T5892] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 932.519720][ T5892] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 932.525357][ T5892] adutux 2-1:168.0: interrupt endpoints not found [ 932.800328][T16467] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3161'. [ 932.810787][T16466] loop3: detected capacity change from 0 to 1024 [ 932.814081][T16466] hfsplus: Unknown parameter 'Ж«7Дг/‘W3ђTjBr?S*zнрҐќгєш'•HПЄ†2fЦМYЗђ¦z»bЕН“Ґj6Іt±zќ5гшріyЋD7о_хs' [ 934.486819][T16478] loop3: detected capacity change from 0 to 128 [ 934.536343][ T37] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 934.537938][T16478] EXT4-fs (loop3): Test dummy encryption mode enabled [ 934.598646][T16478] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 934.599244][T16478] ext4 filesystem being mounted at /510/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 935.828457][ T791] usb 2-1: USB disconnect, device number 9 [ 936.026165][ T5822] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 936.163248][T16492] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3165'. [ 936.163289][T16492] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3165'. [ 937.687227][T16506] lo speed is unknown, defaulting to 1000 [ 937.972701][T15142] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 937.974558][T15142] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 937.975836][T15142] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 937.988151][T15142] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 937.991997][T15142] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 938.152120][ T5892] usb 10-1: new high-speed USB device number 26 using dummy_hcd [ 939.317270][ T5892] usb 10-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 939.317340][ T5892] usb 10-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 939.317374][ T5892] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.366093][ T5892] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 939.804162][T16513] lo speed is unknown, defaulting to 1000 [ 940.182877][ T52] Bluetooth: hci7: command tx timeout [ 940.448744][T16536] siw: device registration error -23 [ 941.038294][ T5892] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 941.038329][ T5892] stv0680 10-1:4.0: STV(e): camera ping failed!! [ 941.041150][ T5892] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 941.041169][ T5892] stv0680 10-1:4.0: last error: 0, command = 0x0 [ 941.074977][ T5892] usb 10-1: USB disconnect, device number 26 [ 941.401901][T16543] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3176'. [ 942.033028][ T5892] usb 4-1: new low-speed USB device number 38 using dummy_hcd [ 942.425282][ T52] Bluetooth: hci7: command tx timeout [ 942.533892][ T5892] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 942.533944][ T5892] usb 4-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 942.543115][ T5892] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 942.543162][ T5892] usb 4-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 942.546161][ T5892] usb 4-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 942.546203][ T5892] usb 4-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 942.576119][ T5892] usb 4-1: string descriptor 0 read error: -22 [ 942.576275][ T5892] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 942.576307][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 942.622361][ T5892] adutux 4-1:168.0: interrupt endpoints not found [ 942.871056][T14445] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 944.630271][ T52] Bluetooth: hci7: command tx timeout [ 944.822147][T16562] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 944.822223][T16562] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 944.822249][T16562] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 945.513751][ T5892] usb 4-1: USB disconnect, device number 38 [ 945.912267][T14445] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 946.674540][T16513] chnl_net:caif_netlink_parms(): no params data found [ 946.853913][ T52] Bluetooth: hci7: command tx timeout [ 947.213788][T14445] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 947.313628][ T791] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 947.422639][ T5912] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 947.467806][T14445] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 947.480993][T16595] binder: BINDER_SET_CONTEXT_MGR already set [ 947.481050][T16595] binder: 16589:16595 ioctl 4018620d 200000000040 returned -16 [ 947.505900][ T791] usb 4-1: Using ep0 maxpacket: 8 [ 947.540890][ T791] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 947.547492][ T791] usb 4-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 947.547533][ T791] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.547561][ T791] usb 4-1: Product: syz [ 947.547588][ T791] usb 4-1: Manufacturer: syz [ 947.547608][ T791] usb 4-1: SerialNumber: syz [ 947.629235][ T5912] usb 10-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 947.629317][ T5912] usb 10-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 947.629360][ T5912] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.659233][ T5912] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 948.445446][ T791] usb 4-1: failed waiting for Axe-Fx III to boot: -71 [ 948.445485][ T791] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 948.464166][T16513] bridge0: port 1(bridge_slave_0) entered blocking state [ 948.624205][T16513] bridge0: port 1(bridge_slave_0) entered disabled state [ 948.624500][T16513] bridge_slave_0: entered allmulticast mode [ 948.648494][T16513] bridge_slave_0: entered promiscuous mode [ 948.655524][ T791] usb 4-1: USB disconnect, device number 39 [ 948.665478][T16513] bridge0: port 2(bridge_slave_1) entered blocking state [ 948.665603][T16513] bridge0: port 2(bridge_slave_1) entered disabled state [ 948.666138][T16513] bridge_slave_1: entered allmulticast mode [ 948.698261][T16513] bridge_slave_1: entered promiscuous mode [ 948.972121][ T5912] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 948.972146][ T5912] stv0680 10-1:4.0: last error: 2, command = 0x7 [ 948.985061][ T5912] usb 10-1: USB disconnect, device number 27 [ 949.318824][T16513] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 949.333250][T16513] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 949.965421][T16513] team0: Port device team_slave_0 added [ 950.075765][T16513] team0: Port device team_slave_1 added [ 950.188229][T16623] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3192'. [ 950.299104][T16513] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 950.299133][T16513] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 950.299162][T16513] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 950.310744][T16513] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 950.310764][T16513] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 950.310796][T16513] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 952.744414][ T9] usb 10-1: new low-speed USB device number 28 using dummy_hcd [ 952.944445][T16644] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3197'. [ 953.092871][ T9] usb 10-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 953.092934][ T9] usb 10-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 953.093020][ T9] usb 10-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 953.106032][ T9] usb 10-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 953.106088][ T9] usb 10-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 953.106122][ T9] usb 10-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 953.110889][ T9] usb 10-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 953.112118][ T9] usb 10-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 953.112313][ T9] usb 10-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 953.326833][ T9] usb 10-1: string descriptor 0 read error: -22 [ 953.327079][ T9] usb 10-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 953.327105][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 953.333064][ T9] adutux 10-1:168.0: interrupt endpoints not found [ 953.630529][T16630] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 953.630585][T16630] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 953.630611][T16630] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 953.798591][T14445] bridge_slave_1: left allmulticast mode [ 953.798648][T14445] bridge_slave_1: left promiscuous mode [ 953.798833][T14445] bridge0: port 2(bridge_slave_1) entered disabled state [ 953.806566][T14445] bridge_slave_0: left allmulticast mode [ 953.806586][T14445] bridge_slave_0: left promiscuous mode [ 953.806855][T14445] bridge0: port 1(bridge_slave_0) entered disabled state [ 955.110944][ T9] usb 10-1: USB disconnect, device number 28 [ 955.289641][ T791] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 955.450974][ T791] usb 8-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 955.451039][ T791] usb 8-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 955.451069][ T791] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 955.490388][ T791] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 955.502674][T16670] netlink: 'syz.9.3204': attribute type 1 has an invalid length. [ 955.663124][ T9868] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 955.664351][T14445] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 955.751285][T14445] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 955.753349][T14445] bond0 (unregistering): Released all slaves [ 955.799722][T16513] hsr_slave_0: entered promiscuous mode [ 955.800767][T16513] hsr_slave_1: entered promiscuous mode [ 955.801475][T16513] debugfs: 'hsr0' already exists in 'hsr' [ 955.801494][T16513] Cannot create hsr debugfs directory [ 956.065101][T16673] bond1: (slave gretap1): making interface the new active one [ 956.067605][T16673] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 956.153186][T16674] macvlan2: entered promiscuous mode [ 956.153218][T16674] macvlan2: entered allmulticast mode [ 956.154154][T16674] bond1: entered promiscuous mode [ 956.154180][T16674] gretap1: entered promiscuous mode [ 956.161691][T16674] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 956.162663][T16674] bond1: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 956.162762][T16674] bond1: left promiscuous mode [ 956.162776][T16674] gretap1: left promiscuous mode [ 956.395031][T16690] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3206'. [ 956.405406][T16679] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 956.761098][T14445] hsr_slave_0: left promiscuous mode [ 956.765377][T14445] hsr_slave_1: left promiscuous mode [ 956.766198][T14445] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 956.766220][T14445] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 956.799464][T14445] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 956.799494][T14445] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 956.829842][ T791] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 956.829864][ T791] stv0680 8-1:4.0: last error: 2, command = 0x7 [ 956.834029][ T791] usb 8-1: USB disconnect, device number 16 [ 956.869694][T14445] veth1_macvtap: left promiscuous mode [ 956.869741][T14445] veth0_macvtap: left promiscuous mode [ 956.869818][T14445] veth1_vlan: left promiscuous mode [ 956.869868][T14445] veth0_vlan: left promiscuous mode [ 957.053321][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 957.053395][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 959.247523][T16705] netlink: 'syz.3.3209': attribute type 1 has an invalid length. [ 959.247570][T16705] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3209'. [ 960.475188][T16711] netlink: 16 bytes leftover after parsing attributes in process `syz.9.3210'. [ 960.767663][T16716] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3214'. [ 960.767702][T16716] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3214'. [ 960.854795][T14445] team0 (unregistering): Port device team_slave_1 removed [ 960.888804][T14445] team0 (unregistering): Port device team_slave_0 removed [ 960.974058][T16595] syz.1.3188 (16595): drop_caches: 2 [ 961.095312][ T791] usb 10-1: new low-speed USB device number 29 using dummy_hcd [ 961.226113][T16706] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 961.226153][T16706] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 961.226172][T16706] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 961.390279][ T791] usb 10-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 961.390345][ T791] usb 10-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 961.390380][ T791] usb 10-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 961.403694][ T791] usb 10-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 961.403740][ T791] usb 10-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 961.403766][ T791] usb 10-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 961.436247][ T791] usb 10-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 961.436312][ T791] usb 10-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 961.436348][ T791] usb 10-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 961.939418][ T791] usb 10-1: string descriptor 0 read error: -22 [ 961.939586][ T791] usb 10-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 961.939617][ T791] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 962.045284][ T791] adutux 10-1:168.0: interrupt endpoints not found [ 962.381556][T16736] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3220'. [ 962.737493][ T791] usb 10-1: USB disconnect, device number 29 [ 963.692000][T16747] netlink: 'syz.1.3223': attribute type 1 has an invalid length. [ 963.692030][T16747] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3223'. [ 964.767455][T16760] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3226'. [ 964.878140][ T9] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 965.039335][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 965.041513][ T9] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 965.044268][ T9] usb 8-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 965.044305][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 965.044330][ T9] usb 8-1: Product: syz [ 965.044349][ T9] usb 8-1: Manufacturer: syz [ 965.044367][ T9] usb 8-1: SerialNumber: syz [ 965.222379][T16767] tmpfs: Unknown parameter 'fscontext' [ 965.975010][ T9] usb 8-1: failed waiting for Axe-Fx III to boot: -71 [ 965.975056][ T9] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 966.014598][ T9] usb 8-1: USB disconnect, device number 17 [ 966.191863][T16772] netlink: 'syz.3.3228': attribute type 1 has an invalid length. [ 966.191894][T16772] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3228'. [ 967.438400][T16513] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 967.460790][T16513] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 967.504551][T16513] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 967.540127][ T5912] usb 8-1: new low-speed USB device number 18 using dummy_hcd [ 967.557056][T16513] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 967.713104][ T5912] usb 8-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 967.713150][ T5912] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 967.713175][ T5912] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 967.714064][ T5912] usb 8-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 967.714109][ T5912] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 967.714134][ T5912] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 967.715020][ T5912] usb 8-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 967.715058][ T5912] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 967.715082][ T5912] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 967.718283][ T5912] usb 8-1: string descriptor 0 read error: -22 [ 967.718439][ T5912] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 967.718469][ T5912] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.728480][ T5912] adutux 8-1:168.0: interrupt endpoints not found [ 967.964469][T16803] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3234'. [ 969.032242][T16513] 8021q: adding VLAN 0 to HW filter on device bond0 [ 969.115892][T16811] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3236'. [ 969.291372][T16513] 8021q: adding VLAN 0 to HW filter on device team0 [ 969.334172][T15124] bridge0: port 1(bridge_slave_0) entered blocking state [ 969.334264][T15124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 969.354404][T15124] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 969.431893][ T995] bridge0: port 2(bridge_slave_1) entered blocking state [ 969.431983][ T995] bridge0: port 2(bridge_slave_1) entered forwarding state [ 970.353066][T16513] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 970.578910][ T9] usb 8-1: USB disconnect, device number 18 [ 970.947117][T16827] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3240'. [ 971.100118][ T791] usb 8-1: new low-speed USB device number 19 using dummy_hcd [ 971.267226][ T791] usb 8-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 971.267282][ T791] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 971.267307][ T791] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 971.270974][ T791] usb 8-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 971.272631][ T791] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 971.272665][ T791] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 971.274746][ T791] usb 8-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 971.274788][ T791] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 971.274814][ T791] usb 8-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 971.280996][ T791] usb 8-1: string descriptor 0 read error: -22 [ 971.281110][ T791] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 971.281131][ T791] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.290571][ T791] adutux 8-1:168.0: interrupt endpoints not found [ 972.516492][T16513] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 973.296958][T16850] tipc: Enabled bearer , priority 0 [ 973.297884][T16850] syzkaller0: entered promiscuous mode [ 973.297910][T16850] syzkaller0: entered allmulticast mode [ 973.730218][T16845] tipc: Resetting bearer [ 973.910667][T16845] tipc: Disabling bearer [ 974.150935][T14367] usb 8-1: USB disconnect, device number 19 [ 977.357752][T16513] veth0_vlan: entered promiscuous mode [ 977.393447][T16513] veth1_vlan: entered promiscuous mode [ 977.422483][T16884] binder: BINDER_SET_CONTEXT_MGR already set [ 977.422514][T16884] binder: 16881:16884 ioctl 4018620d 200000000040 returned -16 [ 978.050815][T16513] veth0_macvtap: entered promiscuous mode [ 978.093032][T16513] veth1_macvtap: entered promiscuous mode [ 978.177907][T16513] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 978.243353][T16513] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 979.209641][ T10] usb 5-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-ec168.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 979.209731][ T10] dvb_usb_ec168 5-1:0.1: probe with driver dvb_usb_ec168 failed with error -110 [ 979.278379][ T9868] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 979.278458][ T9868] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 979.278498][ T9868] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 979.278531][ T9868] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 979.883421][T16513] ieee80211 phy37: Selected rate control algorithm 'minstrel_ht' [ 980.215783][ T77] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 980.215814][ T77] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 980.244348][T16513] ieee80211 phy38: Selected rate control algorithm 'minstrel_ht' [ 980.370770][T14445] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 980.370798][T14445] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 980.470956][ T10] usb 5-1: USB disconnect, device number 2 [ 982.767712][T15142] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 982.785038][T15142] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 982.812197][T15142] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 982.889548][T15142] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 982.895758][T15142] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 983.108725][T16916] lo speed is unknown, defaulting to 1000 [ 983.999914][T16923] tipc: Started in network mode [ 983.999946][T16923] tipc: Node identity 9ec7f0a1c9f6, cluster identity 4711 [ 984.000098][T16923] tipc: Enabled bearer , priority 0 [ 984.105655][T16928] syzkaller0: entered promiscuous mode [ 984.105684][T16928] syzkaller0: entered allmulticast mode [ 984.112124][T16923] tipc: Resetting bearer [ 984.242784][T16922] tipc: Resetting bearer [ 984.341300][T16922] tipc: Disabling bearer [ 984.505017][T16916] chnl_net:caif_netlink_parms(): no params data found [ 985.085210][T15142] Bluetooth: hci5: command tx timeout [ 985.884998][T16938] loop6: detected capacity change from 0 to 131072 [ 985.908928][T16938] F2FS-fs (loop6): invalid crc value [ 986.041294][T16938] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 986.056355][T16938] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 986.117131][T16916] bridge0: port 1(bridge_slave_0) entered blocking state [ 986.117345][T16916] bridge0: port 1(bridge_slave_0) entered disabled state [ 986.117623][T16916] bridge_slave_0: entered allmulticast mode [ 986.119884][T16916] bridge_slave_0: entered promiscuous mode [ 986.143394][T16916] bridge0: port 2(bridge_slave_1) entered blocking state [ 986.143587][T16916] bridge0: port 2(bridge_slave_1) entered disabled state [ 986.143841][T16916] bridge_slave_1: entered allmulticast mode [ 986.163957][T16916] bridge_slave_1: entered promiscuous mode [ 986.316487][T16916] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 986.320345][T16916] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 986.499862][T16916] team0: Port device team_slave_0 added [ 986.517434][T16916] team0: Port device team_slave_1 added [ 986.679153][T16916] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 986.679177][T16916] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 986.679211][T16916] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 986.681168][T16916] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 986.681185][T16916] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 986.681218][T16916] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 987.307568][T15142] Bluetooth: hci5: command tx timeout [ 987.931713][T16916] hsr_slave_0: entered promiscuous mode [ 987.953296][T16916] hsr_slave_1: entered promiscuous mode [ 987.971181][T16916] debugfs: 'hsr0' already exists in 'hsr' [ 987.971212][T16916] Cannot create hsr debugfs directory [ 989.531562][T15142] Bluetooth: hci5: command tx timeout [ 989.882795][ T9222] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 991.247155][ T52] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 991.250546][ T52] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 991.256221][T16916] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 991.264706][ T52] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 991.265737][ T52] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 991.266381][ T52] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 991.299975][T16916] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 991.331366][T16916] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 991.350859][T16916] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 991.477377][T16991] lo speed is unknown, defaulting to 1000 [ 991.765131][ T52] Bluetooth: hci5: command tx timeout [ 991.935537][T16916] 8021q: adding VLAN 0 to HW filter on device bond0 [ 992.067763][T16916] 8021q: adding VLAN 0 to HW filter on device team0 [ 992.152790][ T9222] bridge0: port 1(bridge_slave_0) entered blocking state [ 992.152911][ T9222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 992.212119][ T9222] bridge0: port 2(bridge_slave_1) entered blocking state [ 992.212237][ T9222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 992.583768][T16991] chnl_net:caif_netlink_parms(): no params data found [ 993.562770][ T52] Bluetooth: hci8: command tx timeout [ 993.920253][T16991] bridge0: port 1(bridge_slave_0) entered blocking state [ 993.920432][T16991] bridge0: port 1(bridge_slave_0) entered disabled state [ 993.920719][T16991] bridge_slave_0: entered allmulticast mode [ 993.926872][T16991] bridge_slave_0: entered promiscuous mode [ 993.929752][T16991] bridge0: port 2(bridge_slave_1) entered blocking state [ 993.929867][T16991] bridge0: port 2(bridge_slave_1) entered disabled state [ 993.930030][T16991] bridge_slave_1: entered allmulticast mode [ 993.967502][T16991] bridge_slave_1: entered promiscuous mode [ 994.622662][T16991] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 994.626507][T16991] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 994.679566][T16991] team0: Port device team_slave_0 added [ 994.698338][T16991] team0: Port device team_slave_1 added [ 994.771333][T16991] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 994.771357][T16991] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 994.771393][T16991] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 994.773561][T16991] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 994.773580][T16991] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 994.773615][T16991] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 994.981626][T16991] hsr_slave_0: entered promiscuous mode [ 994.996257][T16991] hsr_slave_1: entered promiscuous mode [ 994.997202][T16991] debugfs: 'hsr0' already exists in 'hsr' [ 994.997226][T16991] Cannot create hsr debugfs directory [ 995.584608][T16916] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 995.813332][ T52] Bluetooth: hci8: command tx timeout [ 995.850236][T15142] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 995.851525][T15142] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 995.852107][T15142] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 995.852924][T15142] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 995.853496][T15142] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 996.705436][T16916] veth0_vlan: entered promiscuous mode [ 996.821886][T16916] veth1_vlan: entered promiscuous mode [ 996.874171][T17053] siw: device registration error -23 [ 997.012149][T17047] lo speed is unknown, defaulting to 1000 [ 997.875121][T17059] loop6: detected capacity change from 0 to 131072 [ 997.946443][T17059] F2FS-fs (loop6): invalid crc value [ 997.998106][T15142] Bluetooth: hci8: command tx timeout [ 998.063274][T17059] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 998.065266][T17059] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 998.096285][T15142] Bluetooth: hci9: command tx timeout [ 998.159296][T16916] veth0_macvtap: entered promiscuous mode [ 998.870605][ T52] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 998.882722][ T52] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 998.891220][ T52] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 998.908924][ T52] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 998.993868][ T52] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 999.683042][T16916] veth1_macvtap: entered promiscuous mode [ 1000.224507][ T52] Bluetooth: hci8: command tx timeout [ 1000.263529][T17067] lo speed is unknown, defaulting to 1000 [ 1000.328525][ T52] Bluetooth: hci9: command tx timeout [ 1001.227737][ T52] Bluetooth: hci10: command tx timeout [ 1001.731614][T16916] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1002.059693][T16916] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1002.086992][T17106] loop2: detected capacity change from 0 to 7 [ 1002.088415][T17106] Dev loop2: unable to read RDB block 7 [ 1002.088458][T17106] loop2: AHDI p1 p2 p3 [ 1002.088483][T17106] loop2: partition table partially beyond EOD, truncated [ 1002.088686][T17106] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1002.088708][T17106] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1002.429044][ T77] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.429119][ T77] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.429166][ T77] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.429210][ T77] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.541200][ T52] Bluetooth: hci9: command tx timeout [ 1002.888887][T17047] chnl_net:caif_netlink_parms(): no params data found [ 1002.909069][T16884] syz.1.3248 (16884): drop_caches: 2 [ 1003.386267][ T52] Bluetooth: hci10: command tx timeout [ 1003.583739][ T77] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1004.819419][ T52] Bluetooth: hci9: command tx timeout [ 1004.912285][T16916] ieee80211 phy39: Selected rate control algorithm 'minstrel_ht' [ 1005.171010][T17142] siw: device registration error -23 [ 1005.571821][T17047] bridge0: port 1(bridge_slave_0) entered blocking state [ 1005.572023][T17047] bridge0: port 1(bridge_slave_0) entered disabled state [ 1005.572206][T17047] bridge_slave_0: entered allmulticast mode [ 1005.574284][T17047] bridge_slave_0: entered promiscuous mode [ 1005.578940][T17047] bridge0: port 2(bridge_slave_1) entered blocking state [ 1005.579051][T17047] bridge0: port 2(bridge_slave_1) entered disabled state [ 1005.579208][T17047] bridge_slave_1: entered allmulticast mode [ 1005.588710][T17047] bridge_slave_1: entered promiscuous mode [ 1005.632896][ T52] Bluetooth: hci10: command tx timeout [ 1005.659422][T17047] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1005.673887][T17047] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1006.861053][T16991] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1006.997284][T17047] team0: Port device team_slave_0 added [ 1007.010017][T17047] team0: Port device team_slave_1 added [ 1007.014974][T14445] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1007.014999][T14445] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1007.135653][T16991] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1007.141224][T17067] chnl_net:caif_netlink_parms(): no params data found [ 1007.163828][T16916] ieee80211 phy40: Selected rate control algorithm 'minstrel_ht' [ 1007.181011][T17047] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1007.181034][T17047] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1007.181069][T17047] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1007.183606][T17047] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1007.183624][T17047] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1007.183659][T17047] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1007.200709][T16991] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1007.417762][T16991] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1007.561520][T17162] loop2: detected capacity change from 0 to 7 [ 1007.562264][T17162] Dev loop2: unable to read RDB block 7 [ 1007.562291][T17162] loop2: AHDI p1 p2 p3 [ 1007.562313][T17162] loop2: partition table partially beyond EOD, truncated [ 1007.562490][T17162] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1007.562510][T17162] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1007.833725][ T52] Bluetooth: hci10: command tx timeout [ 1008.255974][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1008.255996][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1008.446544][T17047] hsr_slave_0: entered promiscuous mode [ 1008.447751][T17047] hsr_slave_1: entered promiscuous mode [ 1008.448684][T17047] debugfs: 'hsr0' already exists in 'hsr' [ 1008.448711][T17047] Cannot create hsr debugfs directory [ 1008.451490][T17067] bridge0: port 1(bridge_slave_0) entered blocking state [ 1008.451581][T17067] bridge0: port 1(bridge_slave_0) entered disabled state [ 1008.451772][T17067] bridge_slave_0: entered allmulticast mode [ 1008.454250][T17067] bridge_slave_0: entered promiscuous mode [ 1008.457415][T17067] bridge0: port 2(bridge_slave_1) entered blocking state [ 1008.630122][T17067] bridge0: port 2(bridge_slave_1) entered disabled state [ 1008.631131][T17067] bridge_slave_1: entered allmulticast mode [ 1008.633427][T17067] bridge_slave_1: entered promiscuous mode [ 1008.788078][T17180] tmpfs: Unknown parameter 'fscontext' [ 1009.405993][T17067] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1009.709257][T17188] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3292'. [ 1010.526273][T17067] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1010.580287][T17193] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3253'. [ 1011.388780][T17067] team0: Port device team_slave_0 added [ 1011.488962][T17067] team0: Port device team_slave_1 added [ 1011.613131][T17067] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1011.613155][T17067] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1011.613189][T17067] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1011.669870][T17067] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1011.669891][T17067] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1011.669917][T17067] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1011.810238][T14599] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1012.428899][T16991] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1012.430227][T14599] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1012.430273][T14599] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1012.430296][T14599] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1012.473426][T14599] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1012.654198][T17207] loop2: detected capacity change from 0 to 7 [ 1012.655537][T17207] Dev loop2: unable to read RDB block 7 [ 1012.655562][T17207] loop2: AHDI p1 p2 p3 [ 1012.655585][T17207] loop2: partition table partially beyond EOD, truncated [ 1012.655795][T17207] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1012.655816][T17207] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1012.716647][T16991] 8021q: adding VLAN 0 to HW filter on device team0 [ 1012.743797][T17067] hsr_slave_0: entered promiscuous mode [ 1012.751107][T17067] hsr_slave_1: entered promiscuous mode [ 1012.752075][T17067] debugfs: 'hsr0' already exists in 'hsr' [ 1012.752098][T17067] Cannot create hsr debugfs directory [ 1013.117831][T17211] binder: BINDER_SET_CONTEXT_MGR already set [ 1013.121728][T17211] binder: 17208:17211 ioctl 4018620d 200000000040 returned -16 [ 1013.198338][T17047] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1013.249829][ T9222] bridge0: port 1(bridge_slave_0) entered blocking state [ 1013.249916][ T9222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1013.293384][T17047] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1013.303400][ T995] bridge0: port 2(bridge_slave_1) entered blocking state [ 1013.303519][ T995] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1013.799248][T14599] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 1013.799272][T14599] stv0680 1-1:4.0: Could not get descriptor 0200 [ 1013.799587][T14599] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1013.799603][T14599] stv0680 1-1:4.0: last error: 62, command = 0x7 [ 1013.801929][T14599] usb 1-1: USB disconnect, device number 17 [ 1014.065066][T17047] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1014.147916][T16991] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1014.168389][T17220] siw: device registration error -23 [ 1014.247906][T17047] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1014.350294][T16991] veth0_vlan: entered promiscuous mode [ 1014.374767][T16991] veth1_vlan: entered promiscuous mode [ 1014.486350][T16991] veth0_macvtap: entered promiscuous mode [ 1014.579588][T16991] veth1_macvtap: entered promiscuous mode [ 1014.644688][T16991] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1014.684058][T16991] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1014.864403][ T38] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.864455][ T38] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.864487][ T38] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1014.864519][ T38] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.476536][T16991] ieee80211 phy41: Selected rate control algorithm 'minstrel_ht' [ 1015.745900][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1015.745930][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1015.754432][T16991] ieee80211 phy42: Selected rate control algorithm 'minstrel_ht' [ 1016.181399][T17047] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1016.484773][T17047] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1016.511909][ T9222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1016.511939][ T9222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1016.597205][T17047] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1016.611017][T17047] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1016.705285][T17242] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3304'. [ 1017.116201][T17244] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3305'. [ 1019.341275][T17261] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3309'. [ 1019.508637][ T10] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 1019.700345][T14367] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1019.744414][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1019.744453][ T10] usb 1-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 1019.744485][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1019.744510][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 255 [ 1019.745664][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1019.745705][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1019.745731][ T10] usb 1-1: SerialNumber: syz [ 1019.868538][T14367] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1019.868597][T14367] usb 3-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1019.868624][T14367] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1019.882076][T14367] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1019.915792][ T37] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1020.043820][T14599] usb 1-1: USB disconnect, device number 18 [ 1020.110223][ T37] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1020.227603][ T37] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1020.286801][T17067] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1020.327193][T17276] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3316'. [ 1020.440635][ T37] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1020.452148][T17067] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1020.463319][T17279] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3317'. [ 1020.465372][T17067] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1020.492189][T17047] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1020.495857][T17067] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1020.558424][T17047] 8021q: adding VLAN 0 to HW filter on device team0 [ 1020.630936][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 1020.631025][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1020.634367][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 1020.634463][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1020.912137][ T37] bridge_slave_1: left allmulticast mode [ 1020.912171][ T37] bridge_slave_1: left promiscuous mode [ 1020.912502][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 1020.948599][ T37] bridge_slave_0: left allmulticast mode [ 1020.948633][ T37] bridge_slave_0: left promiscuous mode [ 1020.948882][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 1021.313100][T14367] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 1021.313134][T14367] stv0680 3-1:4.0: Could not get descriptor 0200 [ 1021.314908][T14367] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1021.314934][T14367] stv0680 3-1:4.0: last error: 53, command = 0x7 [ 1021.317287][T14367] usb 3-1: USB disconnect, device number 29 [ 1023.484080][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1023.484158][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1023.978054][ T37] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1023.980452][ T37] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1023.981862][ T37] bond0 (unregistering): Released all slaves [ 1024.083024][ T995] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1024.103964][ T37] tipc: Left network mode [ 1024.916294][T17326] netlink: 'syz.5.3325': attribute type 1 has an invalid length. [ 1024.977165][T17329] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3325'. [ 1025.062323][T17067] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1025.122764][T17326] macvlan2: entered promiscuous mode [ 1025.122787][T17326] macvlan2: entered allmulticast mode [ 1025.125080][T17326] bond10: entered promiscuous mode [ 1025.130970][T17326] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1025.136029][T17326] bond10: left promiscuous mode [ 1025.347748][T17067] 8021q: adding VLAN 0 to HW filter on device team0 [ 1025.395520][ T37] hsr_slave_0: left promiscuous mode [ 1025.410150][ T37] hsr_slave_1: left promiscuous mode [ 1025.411113][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1025.411134][ T37] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1025.900925][ T37] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1025.900951][ T37] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1025.956327][ T37] veth1_macvtap: left promiscuous mode [ 1025.956391][ T37] veth0_macvtap: left promiscuous mode [ 1025.956513][ T37] veth1_vlan: left promiscuous mode [ 1025.956582][ T37] veth0_vlan: left promiscuous mode [ 1026.023638][T17341] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3327'. [ 1026.347907][T17349] loop2: detected capacity change from 0 to 7 [ 1026.350069][ T6196] Dev loop2: unable to read RDB block 7 [ 1026.350108][ T6196] loop2: AHDI p1 p2 p3 [ 1026.350144][ T6196] loop2: partition table partially beyond EOD, truncated [ 1026.350457][ T6196] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1026.350487][ T6196] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1026.354660][T17349] Dev loop2: unable to read RDB block 7 [ 1026.354686][T17349] loop2: AHDI p1 p2 p3 [ 1026.354711][T17349] loop2: partition table partially beyond EOD, truncated [ 1026.354896][T17349] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1026.354916][T17349] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1026.691894][T17356] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3330'. [ 1027.234374][ T37] team0 (unregistering): Port device team_slave_1 removed [ 1027.280563][ T37] team0 (unregistering): Port device team_slave_0 removed [ 1029.235630][T11496] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1029.303597][T17047] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1029.306536][T14445] bridge0: port 1(bridge_slave_0) entered blocking state [ 1029.306652][T14445] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1029.314599][T14445] bridge0: port 2(bridge_slave_1) entered blocking state [ 1029.314684][T14445] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1029.400512][T11496] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1029.400644][T11496] usb 3-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1029.400700][T11496] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1029.443245][T11496] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1029.561159][T17067] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1029.998304][ T37] IPVS: stop unused estimator thread 0... [ 1030.255810][ T52] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1030.259277][ T52] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1030.270865][ T52] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1030.283477][ T52] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1030.292593][ T52] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1030.481834][T17389] lo speed is unknown, defaulting to 1000 [ 1030.813454][T11496] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 1030.813486][T11496] stv0680 3-1:4.0: Could not get descriptor 0200 [ 1030.813852][T11496] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1030.813876][T11496] stv0680 3-1:4.0: last error: 53, command = 0x7 [ 1030.816515][T11496] usb 3-1: USB disconnect, device number 30 [ 1031.041636][T17067] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1032.464344][T15142] Bluetooth: hci6: command tx timeout [ 1032.521041][T17047] veth0_vlan: entered promiscuous mode [ 1032.565261][T17047] veth1_vlan: entered promiscuous mode [ 1033.068739][T17389] chnl_net:caif_netlink_parms(): no params data found [ 1034.257277][T17430] loop2: detected capacity change from 0 to 7 [ 1034.281333][ T6196] Dev loop2: unable to read RDB block 7 [ 1034.281376][ T6196] loop2: AHDI p1 p2 p3 [ 1034.281409][ T6196] loop2: partition table partially beyond EOD, truncated [ 1034.282415][ T6196] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1034.282447][ T6196] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1034.284073][T17430] Dev loop2: unable to read RDB block 7 [ 1034.284106][T17430] loop2: AHDI p1 p2 p3 [ 1034.284139][T17430] loop2: partition table partially beyond EOD, truncated [ 1034.284783][T17430] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1034.284814][T17430] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1034.426508][T17047] veth0_macvtap: entered promiscuous mode [ 1034.455406][T17047] veth1_macvtap: entered promiscuous mode [ 1034.503132][T17047] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1034.585068][T17047] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1034.590369][T14445] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1034.590425][T14445] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1034.590489][T14445] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1034.590545][T14445] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1034.714317][T15142] Bluetooth: hci6: command tx timeout [ 1035.426556][T17445] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3342'. [ 1035.429615][T17389] bridge0: port 1(bridge_slave_0) entered blocking state [ 1035.435494][T17389] bridge0: port 1(bridge_slave_0) entered disabled state [ 1035.435652][T17389] bridge_slave_0: entered allmulticast mode [ 1035.446299][T17389] bridge_slave_0: entered promiscuous mode [ 1035.454573][T17389] bridge0: port 2(bridge_slave_1) entered blocking state [ 1035.454686][T17389] bridge0: port 2(bridge_slave_1) entered disabled state [ 1035.454864][T17389] bridge_slave_1: entered allmulticast mode [ 1035.463098][T17389] bridge_slave_1: entered promiscuous mode [ 1035.596575][T14367] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 1035.638660][T17047] ieee80211 phy43: Selected rate control algorithm 'minstrel_ht' [ 1035.712186][T17389] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1035.727573][T17389] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1035.784633][T14367] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1035.784671][T14367] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 1035.784713][T14367] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1035.784742][T14367] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 255 [ 1035.786553][T14367] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1035.786577][T14367] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1035.786598][T14367] usb 3-1: SerialNumber: syz [ 1035.862937][T15124] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1035.862963][T15124] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1035.973765][T17047] ieee80211 phy44: Selected rate control algorithm 'minstrel_ht' [ 1036.025781][T17389] team0: Port device team_slave_0 added [ 1036.067402][T17389] team0: Port device team_slave_1 added [ 1036.279059][T17067] veth0_vlan: entered promiscuous mode [ 1036.282502][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1036.282626][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1036.287800][T17389] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1036.287819][T17389] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1036.287855][T17389] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1036.290076][T17389] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1036.290097][T17389] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1036.290132][T17389] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1036.355500][ T791] usb 3-1: USB disconnect, device number 31 [ 1036.744732][T17067] veth1_vlan: entered promiscuous mode [ 1036.826986][T17389] hsr_slave_0: entered promiscuous mode [ 1036.828277][T17389] hsr_slave_1: entered promiscuous mode [ 1036.838480][T17389] debugfs: 'hsr0' already exists in 'hsr' [ 1036.838508][T17389] Cannot create hsr debugfs directory [ 1036.911783][T15142] Bluetooth: hci6: command tx timeout [ 1037.042460][T17457] siw: device registration error -23 [ 1037.930042][ T13] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1039.136903][T15142] Bluetooth: hci6: command tx timeout [ 1040.502119][T17481] tmpfs: Unknown parameter 'fscontext' [ 1041.153307][T17067] veth0_macvtap: entered promiscuous mode [ 1041.808520][T17493] netlink: 'syz.2.3350': attribute type 4 has an invalid length. [ 1042.448692][T17389] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.659128][T17499] siw: device registration error -23 [ 1042.781910][T17067] veth1_macvtap: entered promiscuous mode [ 1044.216921][T17389] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1044.696975][T17067] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1044.770401][T17389] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1044.841888][T17067] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1044.899698][T14445] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.899763][T14445] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.899802][T14445] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.899835][T14445] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1045.087923][T17389] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1045.854933][T17067] ieee80211 phy45: Selected rate control algorithm 'minstrel_ht' [ 1046.397891][T14445] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1046.397920][T14445] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1046.468346][T17067] ieee80211 phy46: Selected rate control algorithm 'minstrel_ht' [ 1046.561057][T17389] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1046.715901][T17389] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1046.729095][T17389] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1046.744655][T17389] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1046.747057][T14445] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1046.747081][T14445] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1047.274522][T17389] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1047.365227][T17389] 8021q: adding VLAN 0 to HW filter on device team0 [ 1047.406226][T14445] bridge0: port 1(bridge_slave_0) entered blocking state [ 1047.406338][T14445] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1047.444009][T14445] bridge0: port 2(bridge_slave_1) entered blocking state [ 1047.444095][T14445] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1048.866658][T17561] loop4: detected capacity change from 0 to 131072 [ 1048.913356][T17211] syz.6.3298 (17211): drop_caches: 2 [ 1049.017123][T17561] F2FS-fs (loop4): invalid crc value [ 1049.109967][T17561] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1049.121551][T17561] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 1050.094810][T17389] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1051.804273][T17593] tipc: Started in network mode [ 1051.804312][T17593] tipc: Node identity 066f10c8e37e, cluster identity 4711 [ 1051.804475][T17593] tipc: Enabled bearer , priority 0 [ 1051.805187][T17593] syzkaller0: entered promiscuous mode [ 1051.805212][T17593] syzkaller0: entered allmulticast mode [ 1051.823276][T17593] tipc: Resetting bearer [ 1052.090094][T17601] loop2: detected capacity change from 0 to 8 [ 1052.197152][T17591] tipc: Resetting bearer [ 1053.911403][T17591] tipc: Disabling bearer [ 1054.062355][T14367] tipc: Node number set to 3843100872 [ 1055.557293][T17635] siw: device registration error -23 [ 1055.810701][T17389] veth0_vlan: entered promiscuous mode [ 1055.954673][T17389] veth1_vlan: entered promiscuous mode [ 1056.558083][T17389] veth0_macvtap: entered promiscuous mode [ 1056.641368][T17655] netlink: 'syz.0.3376': attribute type 4 has an invalid length. [ 1057.402436][T17389] veth1_macvtap: entered promiscuous mode [ 1057.579355][T17389] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1057.645421][T17389] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1057.673153][ T12] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1057.673294][ T12] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1057.673418][ T12] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1057.673545][ T12] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1057.903795][T17664] siw: device registration error -23 [ 1058.293462][ T3005] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1059.487861][T17681] siw: device registration error -23 [ 1060.771603][T17690] loop8: detected capacity change from 0 to 8 [ 1061.290328][T17690] SQUASHFS error: Failed to read block 0xdfa: -5 [ 1061.290413][T17690] SQUASHFS error: Unable to read metadata cache entry [dfa] [ 1061.292227][T17690] SQUASHFS error: Failed to read block 0x4e8: -5 [ 1061.292890][T17690] SQUASHFS error: Failed to read block 0x4de: -5 [ 1061.293023][T17690] SQUASHFS error: Failed to read block 0x4de: -5 [ 1061.293168][T17690] SQUASHFS error: Failed to read block 0x4de: -5 [ 1061.293306][T17690] SQUASHFS error: Failed to read block 0x4de: -5 [ 1061.293535][T17690] SQUASHFS error: Failed to read block 0x4de: -5 [ 1061.293674][T17690] SQUASHFS error: Failed to read block 0x4de: -5 [ 1061.293808][T17690] SQUASHFS error: Failed to read block 0x4de: -5 [ 1061.293945][T17690] SQUASHFS error: Failed to read block 0x4de: -5 [ 1061.294117][T17690] SQUASHFS error: Failed to read block 0x4e8: -5 [ 1061.294807][ T31] kauditd_printk_skb: 37 callbacks suppressed [ 1061.294823][ T31] audit: type=1800 audit(1774398744.013:495): pid=17690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3384" name="file1" dev="loop8" ino=5 res=0 errno=0 [ 1061.357397][T17389] ieee80211 phy47: Selected rate control algorithm 'minstrel_ht' [ 1061.646783][T14445] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1061.646810][T14445] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1063.683202][T17389] ieee80211 phy48: Selected rate control algorithm 'minstrel_ht' [ 1063.950456][T17339] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1063.950484][T17339] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1064.947587][T17726] Cannot find del_set index 2 as target [ 1066.242556][T17746] loop2: detected capacity change from 0 to 8 [ 1066.688087][T17756] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1066.692654][T17751] loop4: detected capacity change from 0 to 8 [ 1066.702669][T17756] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1066.706285][T17756] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1066.707453][T17756] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1066.708197][T17756] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1066.835925][T17751] SQUASHFS error: Failed to read block 0xdfa: -5 [ 1066.835954][T17751] SQUASHFS error: Unable to read metadata cache entry [dfa] [ 1066.836462][T17751] SQUASHFS error: Failed to read block 0x4e8: -5 [ 1066.846275][T17758] netlink: 'syz.8.3397': attribute type 1 has an invalid length. [ 1066.846299][T17758] netlink: 224 bytes leftover after parsing attributes in process `syz.8.3397'. [ 1066.905742][T17751] SQUASHFS error: Failed to read block 0x4de: -5 [ 1066.929510][T17751] SQUASHFS error: Failed to read block 0x4de: -5 [ 1066.941589][T17751] SQUASHFS error: Failed to read block 0x4de: -5 [ 1066.941708][T17751] SQUASHFS error: Failed to read block 0x4de: -5 [ 1066.941826][T17751] SQUASHFS error: Failed to read block 0x4de: -5 [ 1066.942357][T17751] SQUASHFS error: Failed to read block 0x4de: -5 [ 1066.945244][T17751] SQUASHFS error: Failed to read block 0x4de: -5 [ 1066.945395][T17751] SQUASHFS error: Failed to read block 0x4de: -5 [ 1066.949221][T17751] SQUASHFS error: Failed to read block 0x4e8: -5 [ 1066.949444][ T31] audit: type=1800 audit(1774398749.307:496): pid=17751 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3396" name="file1" dev="loop4" ino=5 res=0 errno=0 [ 1067.495243][T17755] lo speed is unknown, defaulting to 1000 [ 1068.415769][T17755] chnl_net:caif_netlink_parms(): no params data found [ 1068.727527][T17756] Bluetooth: hci7: command 0x0406 tx timeout [ 1068.898784][T17756] Bluetooth: hci11: command tx timeout [ 1069.561276][T17789] siw: device registration error -23 [ 1070.214799][T17755] bridge0: port 1(bridge_slave_0) entered blocking state [ 1070.225013][T17755] bridge0: port 1(bridge_slave_0) entered disabled state [ 1070.225307][T17755] bridge_slave_0: entered allmulticast mode [ 1070.256135][T17755] bridge_slave_0: entered promiscuous mode [ 1070.273113][T17755] bridge0: port 2(bridge_slave_1) entered blocking state [ 1070.273286][T17755] bridge0: port 2(bridge_slave_1) entered disabled state [ 1070.273579][T17755] bridge_slave_1: entered allmulticast mode [ 1070.286820][T17755] bridge_slave_1: entered promiscuous mode [ 1070.457914][T17755] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1070.470987][T17755] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1071.133450][T15142] Bluetooth: hci11: command tx timeout [ 1071.610841][T17821] loop2: detected capacity change from 0 to 8 [ 1072.463842][T17755] team0: Port device team_slave_0 added [ 1072.471721][T17755] team0: Port device team_slave_1 added [ 1072.703239][T17755] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1072.703264][T17755] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1072.703314][T17755] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1072.709942][T17755] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1072.709956][T17755] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1072.709983][T17755] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1073.409249][T15142] Bluetooth: hci11: command tx timeout [ 1073.625897][T17755] hsr_slave_0: entered promiscuous mode [ 1073.638953][T17755] hsr_slave_1: entered promiscuous mode [ 1073.645081][T17755] debugfs: 'hsr0' already exists in 'hsr' [ 1073.645106][T17755] Cannot create hsr debugfs directory [ 1073.972670][T17814] syz.8.3407 (17814): drop_caches: 2 [ 1074.385857][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1074.467568][ T30] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1074.628299][ T30] usb 5-1: Using ep0 maxpacket: 8 [ 1074.642164][ T30] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1074.650883][ T30] usb 5-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 1074.650917][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1074.650944][ T30] usb 5-1: Product: syz [ 1074.650965][ T30] usb 5-1: Manufacturer: syz [ 1074.650984][ T30] usb 5-1: SerialNumber: syz [ 1074.813473][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1075.020529][T17846] siw: device registration error -23 [ 1075.373372][ T30] usb 5-1: failed waiting for Axe-Fx III to boot: -71 [ 1075.373736][ T30] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 1075.425549][ T77] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1075.569261][T15142] Bluetooth: hci11: command tx timeout [ 1075.660825][ T30] usb 5-1: USB disconnect, device number 3 [ 1076.006863][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1076.372389][ T13] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1077.676576][T17871] netlink: 'syz.9.3418': attribute type 1 has an invalid length. [ 1077.676600][T17871] netlink: 224 bytes leftover after parsing attributes in process `syz.9.3418'. [ 1079.764091][ T13] bridge_slave_1: left allmulticast mode [ 1079.764126][ T13] bridge_slave_1: left promiscuous mode [ 1079.764364][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1080.010108][ T13] bridge_slave_0: left allmulticast mode [ 1080.013441][ T13] bridge_slave_0: left promiscuous mode [ 1080.019383][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1080.199780][T17902] siw: device registration error -23 [ 1080.775115][ T13] ip6gretap0 (unregistering): left promiscuous mode [ 1081.039680][ T13] bridge0 (unregistering): left promiscuous mode [ 1081.252591][ T13] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1081.264306][ T13] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1081.265267][ T13] .` (unregistering): Released all slaves [ 1081.297263][ T13] bond1 (unregistering): Released all slaves [ 1081.354871][ T13] bond2 (unregistering): Released all slaves [ 1081.453750][ T13] bond3 (unregistering): Released all slaves [ 1081.636386][ T13] bond4 (unregistering): Released all slaves [ 1082.010512][ T13] bond5 (unregistering): Released all slaves [ 1082.071921][ T13] bond6 (unregistering): Released all slaves [ 1082.140162][ T13] bond7 (unregistering): Released all slaves [ 1082.288081][ T13] bond0 (unregistering): Released all slaves [ 1082.328526][ T13] bond8 (unregistering): Released all slaves [ 1082.387774][ T13] bond9 (unregistering): Released all slaves [ 1082.467156][ T13] bond10 (unregistering): Released all slaves [ 1083.211498][ T13] tipc: Left network mode [ 1083.590486][T17934] loop9: detected capacity change from 0 to 8 [ 1085.555732][T17755] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1086.241408][T17755] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1086.769051][T17755] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1087.498584][T17755] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1087.731626][ T13] hsr_slave_0: left promiscuous mode [ 1087.737813][ T13] hsr_slave_1: left promiscuous mode [ 1087.738947][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1087.741710][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1088.418840][T17972] siw: device registration error -23 [ 1088.494157][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1088.494241][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1088.752049][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1088.760520][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1088.804137][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1088.805220][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1088.805851][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1091.112790][T15142] Bluetooth: hci1: command tx timeout [ 1091.599204][T17966] netlink: 'syz.2.3435': attribute type 1 has an invalid length. [ 1091.599227][T17966] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3435'. [ 1091.599512][T17966] workqueue: Failed to create a rescuer kthread for wq "phy16": -EINTR [ 1091.731217][T17970] lo speed is unknown, defaulting to 1000 [ 1092.189197][T17755] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1092.254279][T17755] 8021q: adding VLAN 0 to HW filter on device team0 [ 1092.305907][ T9222] bridge0: port 1(bridge_slave_0) entered blocking state [ 1092.306006][ T9222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1092.347043][ T9222] bridge0: port 2(bridge_slave_1) entered blocking state [ 1092.347128][ T9222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1092.856606][ T13] IPVS: stop unused estimator thread 0... [ 1093.197932][ T9222] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1093.219879][T17970] chnl_net:caif_netlink_parms(): no params data found [ 1093.283906][T15142] Bluetooth: hci1: command tx timeout [ 1093.420846][T18036] netlink: 'syz.9.3444': attribute type 1 has an invalid length. [ 1093.420869][T18036] netlink: 224 bytes leftover after parsing attributes in process `syz.9.3444'. [ 1094.499572][T17755] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1094.527886][T17970] bridge0: port 1(bridge_slave_0) entered blocking state [ 1094.528059][T17970] bridge0: port 1(bridge_slave_0) entered disabled state [ 1094.528377][T17970] bridge_slave_0: entered allmulticast mode [ 1094.530741][T17970] bridge_slave_0: entered promiscuous mode [ 1094.552444][T17970] bridge0: port 2(bridge_slave_1) entered blocking state [ 1094.552623][T17970] bridge0: port 2(bridge_slave_1) entered disabled state [ 1094.552930][T17970] bridge_slave_1: entered allmulticast mode [ 1094.562011][T17970] bridge_slave_1: entered promiscuous mode [ 1094.711634][T17970] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1094.742211][T17970] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1095.052750][T18059] siw: device registration error -23 [ 1095.103845][T17970] team0: Port device team_slave_0 added [ 1095.377276][T17931] syz.4.3428 (17931): drop_caches: 2 [ 1095.496507][T15142] Bluetooth: hci1: command tx timeout [ 1095.955188][T17970] team0: Port device team_slave_1 added [ 1096.163252][T17970] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1096.163276][T17970] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1096.163311][T17970] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1096.165585][T17970] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1096.165604][T17970] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1096.165638][T17970] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1097.049972][T17970] hsr_slave_0: entered promiscuous mode [ 1097.052357][T17970] hsr_slave_1: entered promiscuous mode [ 1097.053183][T17970] debugfs: 'hsr0' already exists in 'hsr' [ 1097.053206][T17970] Cannot create hsr debugfs directory [ 1097.719710][T15142] Bluetooth: hci1: command tx timeout [ 1099.537107][ T9] usb 10-1: new full-speed USB device number 30 using dummy_hcd [ 1099.704385][ T9] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1099.704433][ T9] usb 10-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 1099.704480][ T9] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1099.704523][ T9] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 255 [ 1099.705253][T17755] veth0_vlan: entered promiscuous mode [ 1099.722582][ T9] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1099.722611][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1099.722630][ T9] usb 10-1: SerialNumber: syz [ 1099.794894][T17755] veth1_vlan: entered promiscuous mode [ 1099.974192][T17755] veth0_macvtap: entered promiscuous mode [ 1100.039015][T17755] veth1_macvtap: entered promiscuous mode [ 1100.187318][T17755] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1100.265629][ T791] usb 10-1: USB disconnect, device number 30 [ 1100.666064][T17755] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1100.766783][ T37] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.766865][ T37] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.766899][ T37] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.766933][ T37] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.940937][ T52] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 1100.945675][ T52] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 1100.946321][ T52] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 1100.956418][ T52] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 1100.959071][ T52] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 1101.639662][T18135] loop9: detected capacity change from 0 to 8 [ 1102.143065][T18134] SQUASHFS error: Failed to read block 0xdfa: -5 [ 1102.143091][T18134] SQUASHFS error: Unable to read metadata cache entry [dfa] [ 1102.143484][T18134] SQUASHFS error: Failed to read block 0x4e8: -5 [ 1102.144026][T18134] SQUASHFS error: Failed to read block 0x4de: -5 [ 1102.144131][T18134] SQUASHFS error: Failed to read block 0x4de: -5 [ 1102.144231][T18134] SQUASHFS error: Failed to read block 0x4de: -5 [ 1102.144332][T18134] SQUASHFS error: Failed to read block 0x4de: -5 [ 1102.144433][T18134] SQUASHFS error: Failed to read block 0x4de: -5 [ 1102.144539][T18134] SQUASHFS error: Failed to read block 0x4de: -5 [ 1102.144639][T18134] SQUASHFS error: Failed to read block 0x4de: -5 [ 1102.144739][T18134] SQUASHFS error: Failed to read block 0x4de: -5 [ 1102.144868][T18134] SQUASHFS error: Failed to read block 0x4e8: -5 [ 1102.145577][ T31] audit: type=1800 audit(1774398782.224:497): pid=18134 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.3459" name="file1" dev="loop9" ino=5 res=0 errno=0 [ 1102.672035][T18125] lo speed is unknown, defaulting to 1000 [ 1103.369577][T18160] netlink: 112 bytes leftover after parsing attributes in process `syz.8.3463'. [ 1103.553782][T17755] ieee80211 phy49: Selected rate control algorithm 'minstrel_ht' [ 1103.707988][T15142] Bluetooth: hci12: command tx timeout [ 1105.039882][ T995] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1105.039912][ T995] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1105.121157][T17755] ieee80211 phy50: Selected rate control algorithm 'minstrel_ht' [ 1105.290424][T17339] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1105.290447][T17339] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1105.898507][T18188] netlink: 'syz.9.3468': attribute type 1 has an invalid length. [ 1105.932264][T15142] Bluetooth: hci12: command tx timeout [ 1106.343522][T18199] binder: BINDER_SET_CONTEXT_MGR already set [ 1106.343544][T18199] binder: 18192:18199 ioctl 4018620d 200000000040 returned -16 [ 1106.710750][T18125] chnl_net:caif_netlink_parms(): no params data found [ 1107.098263][T17970] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1107.369982][T17970] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1107.481056][T17970] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1107.504512][T17970] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1107.612069][T18199] syz.5.3395 (18199): drop_caches: 2 [ 1108.164303][T15142] Bluetooth: hci12: command tx timeout [ 1108.328655][T18125] bridge0: port 1(bridge_slave_0) entered blocking state [ 1108.328792][T18125] bridge0: port 1(bridge_slave_0) entered disabled state [ 1108.328937][T18125] bridge_slave_0: entered allmulticast mode [ 1108.330687][T18125] bridge_slave_0: entered promiscuous mode [ 1108.333491][T18125] bridge0: port 2(bridge_slave_1) entered blocking state [ 1108.334656][T18125] bridge0: port 2(bridge_slave_1) entered disabled state [ 1108.334791][T18125] bridge_slave_1: entered allmulticast mode [ 1108.338406][T18125] bridge_slave_1: entered promiscuous mode [ 1108.480307][T18125] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1108.495586][T18125] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1108.675481][T18125] team0: Port device team_slave_0 added [ 1108.690118][T18125] team0: Port device team_slave_1 added [ 1109.466458][T18125] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1109.466479][T18125] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1109.466505][T18125] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1109.478262][T18125] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1109.478282][T18125] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1109.478316][T18125] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1109.584727][T17970] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1109.600206][T18239] netlink: 112 bytes leftover after parsing attributes in process `syz.5.3473'. [ 1109.608214][ T77] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1109.856808][T17970] 8021q: adding VLAN 0 to HW filter on device team0 [ 1109.886734][ T77] bridge0: port 1(bridge_slave_0) entered blocking state [ 1109.886831][ T77] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1109.909448][T18125] hsr_slave_0: entered promiscuous mode [ 1109.921491][T18125] hsr_slave_1: entered promiscuous mode [ 1109.922429][T18125] debugfs: 'hsr0' already exists in 'hsr' [ 1109.922453][T18125] Cannot create hsr debugfs directory [ 1110.284281][ T9222] bridge0: port 2(bridge_slave_1) entered blocking state [ 1110.284398][ T9222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1110.380315][T15142] Bluetooth: hci12: command tx timeout [ 1110.593430][T18257] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3478'. [ 1110.593475][T18257] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3478'. [ 1110.667046][T18257] bridge0: entered promiscuous mode [ 1111.101273][T18257] ip6gretap0: entered promiscuous mode [ 1111.368946][T18266] ieee80211 1ща^!: Selected rate control algorithm 'minstrel_ht' [ 1112.802215][T17970] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1113.026085][T18294] netlink: 112 bytes leftover after parsing attributes in process `syz.8.3484'. [ 1113.244540][T18125] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1113.345683][T18125] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1113.520453][T17970] veth0_vlan: entered promiscuous mode [ 1113.543315][T18125] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1113.724277][T18125] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1113.774550][T17970] veth1_vlan: entered promiscuous mode [ 1113.874573][T17970] veth0_macvtap: entered promiscuous mode [ 1113.894224][T17970] veth1_macvtap: entered promiscuous mode [ 1113.942748][T17970] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1114.006152][T17970] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1114.071295][ T995] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1114.071343][ T995] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1114.071377][ T995] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1114.071409][ T995] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1114.108318][ T5892] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1114.176238][T18125] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1114.259491][T18125] 8021q: adding VLAN 0 to HW filter on device team0 [ 1114.259919][T17970] ieee80211 phy52: Selected rate control algorithm 'minstrel_ht' [ 1114.305151][ T77] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1114.305175][ T77] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1114.313761][T17970] ieee80211 phy53: Selected rate control algorithm 'minstrel_ht' [ 1114.349760][ T77] bridge0: port 1(bridge_slave_0) entered blocking state [ 1114.349885][ T77] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1114.444263][T17339] bridge0: port 2(bridge_slave_1) entered blocking state [ 1114.444371][T17339] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1114.478097][ T995] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1114.478125][ T995] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1114.598703][ T5892] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1114.598738][ T5892] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1114.598760][ T5892] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 1114.617658][ T5892] usb 9-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 1114.617688][ T5892] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1114.617707][ T5892] usb 9-1: Product: syz [ 1114.617721][ T5892] usb 9-1: Manufacturer: syz [ 1114.617737][ T5892] usb 9-1: SerialNumber: syz [ 1114.620548][ T5892] usb 9-1: config 0 descriptor?? [ 1115.045038][ T5892] adutux 9-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 1115.238935][T18125] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1115.323433][ T5892] usb 9-1: USB disconnect, device number 16 [ 1115.501807][T18125] veth0_vlan: entered promiscuous mode [ 1115.518918][T18125] veth1_vlan: entered promiscuous mode [ 1115.646225][T18125] veth0_macvtap: entered promiscuous mode [ 1115.652234][T18319] netlink: 'syz.3.3431': attribute type 1 has an invalid length. [ 1115.652262][T18319] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3431'. [ 1115.668365][T18125] veth1_macvtap: entered promiscuous mode [ 1115.709552][T18125] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1115.721988][T18125] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1115.762255][ T995] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1115.762312][ T995] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1115.762345][ T995] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1115.762379][ T995] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.558625][T18327] loop3: detected capacity change from 0 to 128 [ 1116.588715][T18327] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x61ff7272 (sector = 1) [ 1116.832592][T18125] ieee80211 phy54: Selected rate control algorithm 'minstrel_ht' [ 1117.202744][ T9222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1117.202779][ T9222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1117.212555][T18125] ieee80211 phy55: Selected rate control algorithm 'minstrel_ht' [ 1117.341343][ T995] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1117.341365][ T995] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1118.019714][ T52] Bluetooth: hci5: command 0x0406 tx timeout [ 1118.480524][ T31] audit: type=1400 audit(1774398797.508:498): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name="#(%#{//&@\)//&" pid=18347 comm="syz.5.3493" [ 1118.785430][T18360] netlink: 112 bytes leftover after parsing attributes in process `syz.2.3495'. [ 1119.865989][T18377] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3497'. [ 1121.252883][ T32] INFO: task syz.9.3227:16766 blocked for more than 143 seconds. [ 1121.252910][ T32] Tainted: G L syzkaller #0 [ 1121.252922][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1121.252933][ T32] task:syz.9.3227 state:D stack:27016 pid:16766 tgid:16763 ppid:14047 task_flags:0x400040 flags:0x00080002 [ 1121.253000][ T32] Call Trace: [ 1121.253008][ T32] [ 1121.253022][ T32] __schedule+0x15dd/0x52d0 [ 1121.253053][ T32] ? __lock_acquire+0x6b5/0x2cf0 [ 1121.253091][ T32] ? trace_sched_exit_tp+0x3a/0x150 [ 1121.253126][ T32] ? __pfx___schedule+0x10/0x10 [ 1121.253154][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.253181][ T32] ? schedule+0x90/0x360 [ 1121.253206][ T32] schedule+0x164/0x360 [ 1121.253230][ T32] schedule_timeout+0xc3/0x2c0 [ 1121.253262][ T32] ? irqentry_exit+0x59e/0x620 [ 1121.253285][ T32] ? rcu_is_watching+0x15/0xb0 [ 1121.253315][ T32] ? __pfx_schedule_timeout+0x10/0x10 [ 1121.253348][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.253375][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.253408][ T32] ? _raw_spin_unlock_irq+0x23/0x50 [ 1121.253432][ T32] __down_common+0x321/0x730 [ 1121.253469][ T32] ? __pfx___down_common+0x10/0x10 [ 1121.253504][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.253529][ T32] ? rcu_is_watching+0x15/0xb0 [ 1121.253565][ T32] down+0x80/0xd0 [ 1121.253594][ T32] console_lock+0x58/0x90 [ 1121.253612][ T32] con_install+0x97/0x770 [ 1121.253640][ T32] ? __pfx_con_install+0x10/0x10 [ 1121.253670][ T32] tty_init_dev+0xd7/0x4d0 [ 1121.253707][ T32] tty_open+0x862/0xd70 [ 1121.253743][ T32] ? __pfx_tty_open+0x10/0x10 [ 1121.253767][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.253794][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.253818][ T32] ? do_raw_spin_unlock+0xf5/0x210 [ 1121.253844][ T32] chrdev_open+0x4cd/0x5e0 [ 1121.253874][ T32] ? __pfx_chrdev_open+0x10/0x10 [ 1121.253899][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.253923][ T32] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 1121.253951][ T32] ? __pfx_chrdev_open+0x10/0x10 [ 1121.253975][ T32] do_dentry_open+0x785/0x14e0 [ 1121.254017][ T32] vfs_open+0x3b/0x340 [ 1121.254044][ T32] ? path_openat+0x2df0/0x3860 [ 1121.254070][ T32] path_openat+0x2e08/0x3860 [ 1121.254104][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.254130][ T32] ? __pfx_stack_trace_save+0x10/0x10 [ 1121.254155][ T32] ? stack_depot_save_flags+0x33/0x810 [ 1121.254195][ T32] ? __pfx_path_openat+0x10/0x10 [ 1121.254217][ T32] ? __x64_sys_openat+0x138/0x170 [ 1121.254245][ T32] ? do_syscall_64+0x14d/0xf80 [ 1121.254268][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1121.254296][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.254319][ T32] ? __lock_acquire+0x6b5/0x2cf0 [ 1121.254353][ T32] do_file_open+0x23e/0x4a0 [ 1121.254381][ T32] ? __pfx_do_file_open+0x10/0x10 [ 1121.254424][ T32] ? _raw_spin_unlock+0x28/0x50 [ 1121.254443][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.254467][ T32] ? alloc_fd+0x64b/0x6c0 [ 1121.254511][ T32] do_sys_openat2+0x113/0x200 [ 1121.254540][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.254564][ T32] ? __se_sys_futex+0x3a8/0x450 [ 1121.254592][ T32] ? __pfx_do_sys_openat2+0x10/0x10 [ 1121.254627][ T32] ? rcu_is_watching+0x15/0xb0 [ 1121.254655][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.254683][ T32] __x64_sys_openat+0x138/0x170 [ 1121.254718][ T32] do_syscall_64+0x14d/0xf80 [ 1121.254742][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1121.254762][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.254790][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1121.254811][ T32] RIP: 0033:0x7ff9d455cfce [ 1121.254830][ T32] RSP: 002b:00007ff9d5391b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1121.254852][ T32] RAX: ffffffffffffffda RBX: 00007ff9d53926c0 RCX: 00007ff9d455cfce [ 1121.254868][ T32] RDX: 0000000000000002 RSI: 00007ff9d5391c00 RDI: ffffffffffffff9c [ 1121.254883][ T32] RBP: 00007ff9d4632c99 R08: 0000000000000000 R09: 0000000000000000 [ 1121.254896][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1121.254910][ T32] R13: 00007ff9d4816218 R14: 00007ff9d4816180 R15: 00007fffb53a6938 [ 1121.254942][ T32] [ 1121.255004][ T32] [ 1121.255004][ T32] Showing all locks held in the system: [ 1121.255015][ T32] 1 lock held by khungtaskd/32: [ 1121.255028][ T32] #0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1121.255096][ T32] 3 locks held by kworker/u8:5/87: [ 1121.255116][ T32] 2 locks held by getty/5581: [ 1121.255128][ T32] #0: ffff8880367b20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1121.255206][ T32] #1: ffffc9000331e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 1121.255270][ T32] 3 locks held by kworker/u9:1/15142: [ 1121.255283][ T32] #0: ffff888027011148 ((wq_completion)hci8){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 1121.255364][ T32] #1: ffffc9000f2b7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 1121.255426][ T32] #2: ffff88803f6d4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 1121.255485][ T32] 6 locks held by syz.8.3008/15802: [ 1121.255504][ T32] 2 locks held by syz.9.3227/16766: [ 1121.255523][ T32] #0: ffffffff8eff4508 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x22d/0xd70 [ 1121.255606][ T32] #1: ffff8880348b81c0 (&tty->legacy_mutex){+.+.}-{4:4}, at: tty_init_dev+0x74/0x4d0 [ 1121.255702][ T32] 1 lock held by syz.3.3245/16867: [ 1121.255722][ T32] #0: ffffffff8eff4508 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x22d/0xd70 [ 1121.255786][ T32] 1 lock held by syz.7.3252/16904: [ 1121.255799][ T32] #0: ffffffff8eff4508 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x22d/0xd70 [ 1121.255857][ T32] 4 locks held by syz-executor/17755: [ 1121.255871][ T32] 1 lock held by syz.0.3404/17823: [ 1121.255883][ T32] #0: ffffffff8eff4508 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x22d/0xd70 [ 1121.255950][ T32] 2 locks held by syz.4.3428/17931: [ 1121.255966][ T32] 1 lock held by syz.9.3471/18214: [ 1121.255981][ T32] #0: ffffffff8eff4508 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0x108/0x340 [ 1121.256059][ T32] 1 lock held by syz.3.3492/18344: [ 1121.256074][ T32] #0: ffffffff8eff4508 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0x108/0x340 [ 1121.256149][ T32] 1 lock held by syz.8.3496/18365: [ 1121.256163][ T32] 2 locks held by syz.8.3496/18368: [ 1121.256179][ T32] 1 lock held by syz.1.3501/18392: [ 1121.256194][ T32] 1 lock held by cmp/18391: [ 1121.256208][ T32] [ 1121.256216][ T32] ============================================= [ 1121.256216][ T32] [ 1121.256227][ T32] NMI backtrace for cpu 0 [ 1121.256243][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1121.256272][ T32] Tainted: [L]=SOFTLOCKUP [ 1121.256281][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1121.256295][ T32] Call Trace: [ 1121.256303][ T32] [ 1121.256312][ T32] dump_stack_lvl+0xe8/0x150 [ 1121.256346][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 1121.256381][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1121.256414][ T32] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1121.256453][ T32] sys_info+0x135/0x170 [ 1121.256483][ T32] watchdog+0xfd9/0x1030 [ 1121.256530][ T32] ? watchdog+0x21a/0x1030 [ 1121.256575][ T32] kthread+0x388/0x470 [ 1121.256598][ T32] ? __pfx_watchdog+0x10/0x10 [ 1121.256633][ T32] ? __pfx_kthread+0x10/0x10 [ 1121.256657][ T32] ret_from_fork+0x51e/0xb90 [ 1121.256691][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 1121.256724][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.256752][ T32] ? __switch_to+0xc7d/0x1450 [ 1121.256783][ T32] ? __pfx_kthread+0x10/0x10 [ 1121.256807][ T32] ret_from_fork_asm+0x1a/0x30 [ 1121.256860][ T32] [ 1121.256869][ T32] Sending NMI from CPU 0 to CPUs 1: [ 1121.256907][ C1] NMI backtrace for cpu 1 [ 1121.256926][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1121.256961][ C1] Tainted: [L]=SOFTLOCKUP [ 1121.256972][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1121.256989][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1121.257021][ C1] Code: 5e 6c 02 e9 8e 82 61 f5 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 a2 1a 00 fb f4 67 82 61 f5 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 1121.257044][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000246 [ 1121.257068][ C1] RAX: 000000000280b935 RBX: ffffffff819a913a RCX: 0000000080000001 [ 1121.257088][ C1] RDX: 0000000000000001 RSI: ffffffff8def8bf9 RDI: ffffffff8c27c900 [ 1121.257108][ C1] RBP: ffffc90000197f10 R08: ffff8880b873399b R09: 1ffff110170e6733 [ 1121.257130][ C1] R10: dffffc0000000000 R11: ffffed10170e6734 R12: 0000000000000001 [ 1121.257150][ C1] R13: 1ffff11003ad0000 R14: 0000000000000001 R15: 1ffff11003ad0000 [ 1121.257173][ C1] FS: 0000000000000000(0000) GS:ffff88812555d000(0000) knlGS:0000000000000000 [ 1121.257196][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1121.257219][ C1] CR2: 00007fcbc71456b8 CR3: 00000000a1bd7000 CR4: 0000000000350ef0 [ 1121.257242][ C1] Call Trace: [ 1121.257252][ C1] [ 1121.257262][ C1] default_idle+0x9/0x20 [ 1121.257297][ C1] default_idle_call+0x72/0xb0 [ 1121.257334][ C1] do_idle+0x36a/0x5f0 [ 1121.257371][ C1] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1121.257405][ C1] ? __pfx_do_idle+0x10/0x10 [ 1121.257453][ C1] cpu_startup_entry+0x43/0x60 [ 1121.257496][ C1] start_secondary+0x101/0x110 [ 1121.257530][ C1] common_startup_64+0x13e/0x147 [ 1121.257572][ C1] [ 1121.257894][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 1121.257911][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1121.257942][ T32] Tainted: [L]=SOFTLOCKUP [ 1121.257952][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1121.257967][ T32] Call Trace: [ 1121.257976][ T32] [ 1121.257985][ T32] vpanic+0x56c/0xa60 [ 1121.258016][ T32] ? __pfx_vpanic+0x10/0x10 [ 1121.258044][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.258075][ T32] panic+0xc5/0xd0 [ 1121.258101][ T32] ? __pfx_panic+0x10/0x10 [ 1121.258127][ T32] ? printk_trigger_flush+0x13d/0x180 [ 1121.258150][ T32] ? lockdep_hardirqs_on+0x7a/0x110 [ 1121.258173][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.258197][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.258224][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.258248][ T32] ? nmi_trigger_cpumask_backtrace+0x234/0x300 [ 1121.258281][ T32] watchdog+0x1023/0x1030 [ 1121.258316][ T32] ? watchdog+0x21a/0x1030 [ 1121.258354][ T32] kthread+0x388/0x470 [ 1121.258374][ T32] ? __pfx_watchdog+0x10/0x10 [ 1121.258403][ T32] ? __pfx_kthread+0x10/0x10 [ 1121.258424][ T32] ret_from_fork+0x51e/0xb90 [ 1121.258453][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 1121.258478][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1121.258519][ T32] ? __switch_to+0xc7d/0x1450 [ 1121.258546][ T32] ? __pfx_kthread+0x10/0x10 [ 1121.258567][ T32] ret_from_fork_asm+0x1a/0x30 [ 1121.258611][ T32] [ 1121.259207][ T32] Kernel Offset: disabled