last executing test programs: 2m22.377297826s ago: executing program 4 (id=1576): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$unix(r0, 0x0, 0x8841) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$XFS_IOC_SCRUBV_METADATA(0xffffffffffffffff, 0xc0285840, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000110000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000040c0001800800014000000004540000000e0a01010000000000000000020000000900020073797a31000000000900010073797a30"], 0x100}}, 0x0) 2m22.279680193s ago: executing program 4 (id=1577): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000280)=0x4000000) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x17, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1808000000000000000000000700000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a008500000008010000bc0900001800000045090100002000009500000000000000bf9800000000000056090000000000008500000085000000b7000000000000009500000000000000f3266c7a5e947beb4a489bb41d9d16f0231d5e71134d130bc5b0c5481ab9aad529fbcd11b6a033bdb10e9ccc8e3037cedaace72dafd093989f22e8b3534e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl(r3, 0x3b8f, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r4, 0x40bc5311, &(0x7f0000000300)={0x3, 0x2, 'client1\x00', 0x3, "92b2d5891e89b375", "882bcaf2e2f686376a72d43c8f97d75461aad552b34cdc674d33b14eb4f09088", 0xe, 0x7fffffff}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f00000000c0)=@arm64={0x5a, 0xf7, 0x5, '\x00', 0x2}) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, 0x0, 0x4040000) openat$sndseq(0xffffffffffffff9c, 0x0, 0x42202) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0xc, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87, '\x00', 0xc3}, {0x9, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0x9, '\x00', 0x67}, {0x0, 0x5, 0xd4, '\x00', 0xf}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0x8}, {0x7f, 0xd, 0xb, '\x00', 0xb}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x6, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xc7, 0x4, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x0, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x9, 0x5, '\x00', 0x1c}, {0x7, 0xe1, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7b}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4}]}}) 2m22.170241141s ago: executing program 4 (id=1578): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x2400c000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x8401, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x5) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000580)=[@text64={0x40, 0x0}], 0x1, 0x26, 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000005c0)={0xd000}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) write$ppp(0xffffffffffffffff, &(0x7f0000000180)="1d89ae882494ba64e1d1bdf4427dbc52102d8aac2840424da8bbc73d83216315625bebb2f9dac47c1f6a80c6806cd8a6930c948013aff74e9bcdfe9285e889afca", 0x41) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f00000002c0)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e", 0x0, 0xb1}) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000380)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x6, 0xff, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1, '\x00', 0xfd}) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r6 = syz_open_dev$I2C(&(0x7f00000003c0), 0x1, 0x2603) ioctl$I2C_RDWR(r6, 0x707, &(0x7f0000000400)={&(0x7f0000000480)=[{0x1b, 0x2211, 0x50, &(0x7f00000004c0)="705f9d4c4bfa0b0b01d632c1c0084354ee86dee120fea643a8ba7c47935561b6a130b20745baa898c423cc9acf30609be4233f0120ae8899b99620d304c8af8422544b9302ba671b914fb2fb8e9d3d71"}], 0x1}) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='coredump_filter\x00') writev(r7, &(0x7f0000000200)=[{&(0x7f0000000240)='0', 0x1}, {0x0, 0x2}], 0x2) ioctl$KVM_SET_VAPIC_ADDR(r5, 0x4008ae93, &(0x7f0000000100)=0x9000) ioctl$KVM_RUN(r5, 0xae80, 0x0) 2m20.361221808s ago: executing program 4 (id=1587): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000180), 0x5bc, 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000044402, 0x0) r0 = syz_ublk_setup_io_uring(0x1a, &(0x7f0000000500)={0x0, 0x30bc, 0x100, 0x2, 0x1a6}, &(0x7f0000000080)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x2a, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000040)=0x2, 0x4) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x1, 0x1, 0x257}, &(0x7f0000000680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x4, 0x2000, 0x10000004, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe0a4, 0x1, 0x6, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x8000, 0x0, 0x8080362, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x2000, 0x1, {}, 0x1f, 0x0, '\x00', {0xfffa, 0x7b, 0x0, 0x0}}, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs]}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$inet6(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02"], 0x48) 2m19.85521637s ago: executing program 4 (id=1592): r0 = socket(0x10, 0x3, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x34, 0x6, @thr={&(0x7f0000000000)="4c1e5aa05613794a7be4b650e950f7c55c05ea10c8d2e6753f019c58a1f7634aa9481c4eaac18d87d42003473da4e1baae1d5d95394ec08471c38cc20e09aab963035ff1e966ec8759606779d27ff1510298347d07365b5d6bc9a335c51fd03b8c214c0b4447e52d0eb428bc70dd0bfc875652bc7735", &(0x7f0000000080)="ae6c"}}, &(0x7f0000000100)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys_mnt\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys_mnt\x00', 0x0, 0x0) r3 = fsopen(&(0x7f0000000580)='sysfs\x00', 0x0) inotify_init1(0x0) (async) inotify_init1(0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) move_mount(r4, 0x0, r2, 0x0, 0x44) (async) move_mount(r4, 0x0, r2, 0x0, 0x44) fsmount(r3, 0x1, 0x2) timer_settime(r1, 0x0, &(0x7f0000000140), &(0x7f0000000180)) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000400)={0x3}, 0x10) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000400)={0x3}, 0x10) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x2241, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x2241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000600)={'syzkaller0\x00', 0x5005}) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setuid(0xee01) r7 = socket$netlink(0x10, 0x3, 0x4) writev(r7, 0x0, 0x0) (async) writev(r7, 0x0, 0x0) ioctl$KDGKBTYPE(r6, 0x4b48, &(0x7f0000000640)) ioctl$TIOCSWINSZ(r6, 0x5414, &(0x7f0000000680)={0x4089, 0x3, 0x0, 0x400}) (async) ioctl$TIOCSWINSZ(r6, 0x5414, &(0x7f0000000680)={0x4089, 0x3, 0x0, 0x400}) socket$inet6(0xa, 0x3, 0x7) (async) r8 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_int(r8, 0x29, 0x4b, &(0x7f00000006c0)=0x2, 0x4) (async) setsockopt$inet6_int(r8, 0x29, 0x4b, &(0x7f00000006c0)=0x2, 0x4) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x8, 0x3, 0x2f8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x260, 0xffffff7a, 0xffffffff, 0x260, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0x130, 0x190, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "007f0100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a54f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000300000000a1602a6800", 0x80, 0x3, {0x4}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x1, 0x1, 0x3, 0x1, 0x2, 0x4], 0x6}, {0x4, [0x6, 0x4, 0x3, 0x3, 0x1], 0x4, 0x2}}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, 0x0, 0xff000000, 'team_slave_0\x00', 'ip6gre0\x00', {0xff}, {}, 0x1d, 0x3}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @random="50c338e088a8", 0x6, 0x8, [0x31, 0xc, 0x2a, 0x39, 0xa, 0x24, 0x6, 0x4, 0x18, 0x2f, 0x2c, 0x2e, 0x2, 0x3a, 0x2a, 0xd], 0x2, 0x80000000, 0x40}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) sendmmsg$inet6(r8, &(0x7f0000000a80)=[{{&(0x7f0000000ac0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x002'], 0x28}}], 0x1, 0x0) ioctl$SIOCGSTAMPNS(r8, 0x8907, 0x0) recvfrom$inet6(r8, 0x0, 0x0, 0x10000, &(0x7f0000000b40)={0xa, 0x4e20, 0x5, @private0, 0x1b9}, 0x1c) (async) recvfrom$inet6(r8, 0x0, 0x0, 0x10000, &(0x7f0000000b40)={0xa, 0x4e20, 0x5, @private0, 0x1b9}, 0x1c) ioctl$TIOCSWINSZ(r6, 0x5414, &(0x7f0000000b80)={0x1, 0x8, 0x3, 0xa22}) 2m18.911658057s ago: executing program 4 (id=1605): r0 = memfd_create(&(0x7f0000000000)='-&:{-\xaa]{\x00', 0x2) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000080)='C', 0x6e71e3461140eb5a}], 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="0200000001000500000000000400050000000000100002000000000020"], 0x24, 0x5000000) 2m3.895716009s ago: executing program 32 (id=1605): r0 = memfd_create(&(0x7f0000000000)='-&:{-\xaa]{\x00', 0x2) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000080)='C', 0x6e71e3461140eb5a}], 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="0200000001000500000000000400050000000000100002000000000020"], 0x24, 0x5000000) 39.087284397s ago: executing program 2 (id=2392): add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000140), 0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000001c0)={'netdevsim0\x00', &(0x7f0000002fc0)=@ethtool_wolinfo={0x3, 0x8, 0xfffffffd, "050000009582"}}) dup2(0xffffffffffffffff, 0xffffffffffffffff) r3 = fsopen(&(0x7f00000004c0)='hpfs\x00', 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000300)=[{0x30, 0x6, 0x4, 0xfffff000}]}, 0x10) syz_usb_connect$uac2(0x5, 0xcf, &(0x7f0000000680)=ANY=[@ANYBLOB="1201500900000008732b13004001010000010902bd000301f40006080b0002010020400904000000010120000924010300063f00130f240805050100010000000000010010240206ff0101056f070000000000000724080106030091949bf01e2f9ab20f5b00000006d47f0904010000010220000904010101010220000a2402025200050003030a24020211ff0a005905090501090800030509082501030f0c080009040200"], 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='source', 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r7 = memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\x96\xa7f\x9ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\x15n\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z\t\x00\x00\x00\x00\x00\x00\x00\x9b\x01\xf9t\xbb\x1er\x04\xdb\xd3\xcd\xfd\xbdnC\xec#]\xbf\xa2\xa2H\x86\x86[8\x05\xfe\xdc\x11\x04\xa1u\x81', 0x0) fsetxattr$security_capability(r7, &(0x7f0000000080), 0x0, 0x0, 0x1) fsetxattr(r7, &(0x7f0000000280)=@known='user.incfs.size\x00', 0x0, 0x0, 0x0) r8 = getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, r8, 0x1, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 39.085893084s ago: executing program 5 (id=2394): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) (async) r0 = syz_io_uring_setup(0x111, &(0x7f0000000040)={0x0, 0x39c4, 0x2, 0x4, 0xfffffffe}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000180)='n', 0x1) (async) close(0xffffffffffffffff) (async) poll(0x0, 0x0, 0x2) madvise(&(0x7f000048c000/0x1000)=nil, 0x1000, 0xc) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'xfrm0\x00'}) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000814}, 0x24000840) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1400000010000100000000000a010100000000000000000a00000a0900010fc826007379ab09c82e9892af3f0240000000000000000120000000080a010100000000000000000a0000090900010073797a00"/116], 0x74}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) r4 = syz_open_dev$loop(&(0x7f0000000640), 0xffff, 0x14f600) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) (async) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) ptrace$ARCH_GET_FS(0x1e, r5, &(0x7f00000002c0), 0x1003) (async) write$binfmt_misc(r6, &(0x7f00000006c0), 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000000700)={r6, 0x0, {0x2a00, 0x80010000, 0x0, 0x80000000, 0x800080000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979f36e00d96072000001ea89de2b7fb0000e60080b8785d96000100008000000000000000000000000000000000000000002300", "2809e8dbe1085989481f4ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e9f747d3c458dd4992861ac00", "f4bd000000801900", [0x4000, 0x10]}}) (async) io_pgetevents(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000840)=@abs={0x0, 0x0, 0x3}, 0x6e) (async) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x4000) (async) recvmmsg(0xffffffffffffffff, &(0x7f00000008c0), 0x10106, 0x2, 0x0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r7, &(0x7f0000000900)={0xa, 0x0, 0x7, @mcast2, 0x8001}, 0x1c) 38.667742895s ago: executing program 5 (id=2397): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000f0000002800000d006c030000000095"], &(0x7f0000000440)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) 38.490982437s ago: executing program 5 (id=2398): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@private2, @in6=@local, 0x4e28, 0x0, 0x4, 0xf000, 0x2}, {0xffffffffffffffff, 0x802, 0x913e, 0x0, 0xfffffffffffffffc, 0xfffffffffffff207, 0x5}, {0x0, 0x0, 0x0, 0x8}, 0x3, 0x0, 0x1, 0x0, 0x4, 0x3}, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d2, 0x33}, 0x0, @in6=@empty, 0x3507, 0x0, 0x2, 0x4, 0x4, 0xfffffffe, 0xfffffffd}}, 0xe8) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x0, 0x1000, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="340000004100010026bd7000040000000100000004004880100001800c00108004000580040008800c0002"], 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 38.247752122s ago: executing program 5 (id=2399): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000}) r1 = openat$kvm(0x0, &(0x7f0000000300), 0x9c3400, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000004c0)='./cgroup/pids.max\x00', 0x88101) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup\x00', 0x100) move_mount(r2, 0x0, r3, 0x0, 0x46) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4004000) socket(0x10, 0x2, 0x0) r4 = socket(0x1d, 0x2, 0x6) open(0x0, 0x103802, 0xed) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r5, 0x0, 0x0) r6 = io_uring_setup(0x899, 0x0) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x6a, 0x3, 0x0, 0x4c) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(0xffffffffffffffff, 0x8008ae9d, 0xfffffffffffffffe) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r8 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f0000000340)={0x7c, 0x3000, 0x0, r8}) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f0000000380)={0x5, 0x3000, 0x1, r8, 0x1}) io_setup(0x3, &(0x7f0000000080)=0x0) io_submit(r9, 0x1, &(0x7f0000000280)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}]) 37.845647688s ago: executing program 5 (id=2400): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) unshare(0x2040400) (async) fcntl$lock(r0, 0x24, &(0x7f0000000080)={0x1, 0x1, 0x80000000000033, 0xc1b2}) syz_emit_ethernet(0xe7, &(0x7f0000000140)={@broadcast, @multicast, @void, {@generic={0x8884, "00000000aa67edb4f5fb1f3877aa0f0005fda0796c02b0e649530b089b1cd9ed80d4176060f7f6ca80b2cc04c2ddc871e194f7ada9eeb4cb3817ee0d7634242f08ad7a92c35422a96239a6288558239762fdca0290fc192f401f85251292eb3b7a609e1c6ac5e5ab6cad51529d135e94bc144e8dee82a5ec0dcf00906b4d840c9004a5a4a686835270f9ffcfc42027f4913ff6279feb9c5db716177ebe67b6dfb48366958c38a18b56e09a43186a560825ac78df8c3f76391f18dded17b8a593661667ecac09c5f182fb35d42b3b10993136a3746d04164519"}}}, 0x0) 37.611401221s ago: executing program 5 (id=2402): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140048001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000200000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f08000340000000074c0000000c0a01020000000000000000010000000900020073797a3200000000200003801c0000800400018008000340000000010c00044000000000000000000900010073797a300000000038000000020a01"], 0x110}}, 0x0) 37.129436697s ago: executing program 33 (id=2402): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140048001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000200000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f08000340000000074c0000000c0a01020000000000000000010000000900020073797a3200000000200003801c0000800400018008000340000000010c00044000000000000000000900010073797a300000000038000000020a01"], 0x110}}, 0x0) 35.661564824s ago: executing program 2 (id=2409): pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000480)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000001080)="5599e749c873ff12bae277e2d5027ac7b6e8af5edec249a07e720054d05658cc7c3d17e4ccebd593ef74c49b019f86fa066c575b64dc7a6b9e13c535b4f77a7a745e413de0e7b942cbc20fdfc28910c4c39b0924dfdd3ab53ef5012b7f468cd16db00b011daebe55a0649e207137473d9b4baa2e651fc99d366e780f3f2709ff8b8f682c0001ef29d0d0239498bfba4b21ebd57185c546de5767cc394bb38e2aa88245fd6f41f91cac995d2d1c145b5a4d03a13f8f6dc29c8e9a8e79a740e3746ff5e4b7749d27ecd8d24d43a25c8415f89d63ccc71e456c0c69c6d2fc9faf3dc9b89bbe39c2b39c4babe7baf6ba2e293d07d55e927687c6b99a0badf8dd96ba9c90ab0296824fbf2026bcd56c3faebd60ce7bfd96e264c345bc76f78be3fb69332f3a750ff1e338ebd97e131744ed866f691580bf7908157fe4fe5dc1f301ee9df4324a5bfc96e3fa48c24315a71eca2d636da924f3f94bacee29e7930f9176dcb6bc0032341f4f97bff618dbc1862ce7a1a794010a841f12f2d32c78bf67e786aeb002c3ea772043bd1645d87da8f44db008da4604a28106283d0c21d905f6558449d4ee8510a901c99140432ce551aec56ec5dd4dea78c643ec3f4ffd6f3426a49792c406b8d1e507c4e75afd5819bf584f1993ef6c0f88bc08bc21e6169cae147f95572ced2d1e6f971b41f74bcd816f16bb8b32cdde61870f6c9214bfc66bbe671a8521f4adb5c59d14b5b30242542f85aada33542ef0e788bc0cb9f97c1e5c865b64494858c11d7f9ccfe7bc6058756b92798d6c4c1c37b726ae1b6dcdea8006b30c3a656a849620cdcfa8e3cf51fad226f6a14945ea770e60aa65cd736314ac361d2406b42e23d0ffe90dd7485e8c159ac27cd59ec29814c76e338d0269ff867480d69e7494d68dd4cbffba6e54de0915de3e56153308f2cb3d53f81d528eeee8c100466e431607ff96329dc9915fa828b2293a4f9e03f41086cffe5302b9c68c739ca38bdd64645d76963a0a5e26d89eb18ea4ef405e17030f63fde3a92884501b82183ddfab50a17bdb3237878386045a9d0a4495eba8e2ced021f34fc76d85fd854e7978bfb52b80ee6f0cca0dfef78847bd8347433f44559927553639e6f948011f2d013e2a2b1890cff11a82284d79aab555c187ef7c3b7f248618846ce21b2d29b7f703f2ade1dd45aad4bfdf992994011f058f4318ab65638060fcfc69a84561696ba64d7b9f58222d41df12431881e74c70a41b5be2e5770b779902248ba5b5c07740ab2c0b5cb9fc6c7f7f45ee89ec1e5992344ec7cded5863862864117421515df64c08735b1d2580c03812dcbb4bf25c6dfd9b0f28a87a7f4d5fdb5dd179d20f941bcfd20dfce6f5aa4ec897f8bcb57db091dc1dde7dc1b830d296e729aee7ac57a3ef81b7584a93b102ca54bd031f651db7727a81d287bcd057758a6b470b0d262ceb0fb322cfb9be8c4ad3e8fe15bd65fe0429f02295b062a0c2fd4119a38a0b2b9a42adb2e7ad855379e9b510a8e90afa4b112e2d7d069917807967d7d4c459a33173864ca5f52eb0c0d6220b8a3f077084c2a1a4b0693cda65bb1e41b6e4a2a4f9cc91a6b8afe5a7d69cfd745150f462593599d5418ac73a768c61d9a969f041eb439f45cf80e22b7cb1f8f2d1f82e675a47782aa37d73328b8053f370b4796003f7ab9d3f5235ac1f065bba0bc86c57f66e40ce813a2df65536e26f7a162d6ce7a8e770060694e82257326f3b6b235b89025f0f65e57b1fce9f356d508c0a845cdbd74dd1a0c246b0d43e3ee2f09f22e04379d4aad9829ac4cb9b2b47356d1c4ea5184a64e664f9099fc5bae50e0237b3bb0e072489804b00e77773db7a21c2759b64faa265835f5251a2305a01a10f3bfd3f905b1032d66efc02f2f0533aab76274366b5008d9e711e84ac6cc06d3c7201957a9c6d62b3ad45259c844af433f17331ad6ebd673362ad79a289fa24e7f992f4e7dcf195dfefd8bc2a76907a1f7bea048aefc3b315b42042b79b31586c7c6a67255dc3b5867fa9daafead5eadc48388c23fe635d0d5c1f8172f8fff8920c685b2bfd3c4e9e556567c425b215e8f74f916e10604c700fd71e2ee01e32894ecc1ff2e79f09b974c80cf3e77b164f67e5bc5c7ce564c00d588b54c6e3c0594c29c92fb058c9275725f68f9cd93ca8953b609f546a11957680168d88b433082c764d93cab2454056db1897c97a2ad109c0b7f4fccfd748e2f9a32cf18b0bfee0531826b3d33819477bff8addb1a49190f25689240c13fd2a2b0021580d0bad26f7f9ca2285580329dd658fba93ec594c262364345af9ad8795433a59e9c76725da755748f95ce195c65ed15e2a31a3c71c2d9426be29a644dc9562440fc8a4e96413818bc631a917819189db338e1cf8177cf5d489e003b70d1a8b73755da2b565eff1456f9ee9dc3d8c3b3dc2c87b6138579ba4f15e9d0f13dbdc065bc0d7d6b3f3fbc3d72f0396ad96328f9df09e3eaef05dfce404cdfc509254c4462ec0f7facbb5f37338d521e434c4032628fc38468ca894c3637d34960df9d75c114742f10c7f4de53b0f88b91c46ae3d1bc2ac270132dfa44e8d55cd4a5966ef19be5cf2b6f6c6ed8806d686d991005a14448cb715753ba5b6a6406bbf25f7f69d8bc27cd0838a3412292ae3fa1ee9e755c303ee9cf53e7cb101f05d54456aa506e41d8c6e8868b7f12a6df326d534983ceb8f102311ae00f504b5", 0x794}], 0x1, 0x0, 0x0, 0x20000850}], 0x1, 0x4000080) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000540)=[@text32={0x20, 0x0}], 0x1, 0x72, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 34.553154222s ago: executing program 2 (id=2414): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x2401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x60, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x50, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0xe, 0x1, 'IDLETIMER\x00'}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TARGET_INFO={0x34, 0x3, "64000000746573745f6c6162656c000000100000050000000000000000000000000100"/48}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xcc}}, 0x0) 34.343197014s ago: executing program 2 (id=2415): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000}) r1 = openat$kvm(0x0, &(0x7f0000000300), 0x9c3400, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000004c0)='./cgroup/pids.max\x00', 0x88101) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup\x00', 0x100) move_mount(r2, 0x0, r3, 0x0, 0x46) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4004000) socket(0x10, 0x2, 0x0) r4 = socket(0x1d, 0x2, 0x6) open(0x0, 0x103802, 0xed) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r5, 0x0, 0x0) r6 = io_uring_setup(0x899, 0x0) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x6a, 0x3, 0x0, 0x4c) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(0xffffffffffffffff, 0x8008ae9d, 0xfffffffffffffffe) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r8 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f0000000340)={0x7c, 0x3000, 0x0, r8}) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f0000000380)={0x5, 0x3000, 0x1, r8, 0x1}) io_setup(0x3, &(0x7f0000000080)=0x0) io_submit(r9, 0x1, &(0x7f0000000280)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}]) 34.015785545s ago: executing program 2 (id=2416): r0 = socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) unshare(0x4e050e00) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="340050e9e70000200025a729bd7000fddbdf250a0000cdff000001020001000800060000000000080018"], 0x34}, 0x1, 0x0, 0x0, 0x200080d1}, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f00000000c0)=0x20) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = userfaultfd(0x81001) r4 = getpid() process_vm_readv(r4, &(0x7f0000000340)=[{&(0x7f0000000380)=""/54, 0x7ffff000}, {&(0x7f0000000580)=""/152, 0x98}], 0x2, &(0x7f0000000800)=[{&(0x7f0000000840)=""/95, 0x7ffff000}], 0x286, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000008c0)={0xaa, 0x164}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000900)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, 0x0) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f0000000980)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1}) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000100)=0xffffffff) write$dsp(r1, &(0x7f0000000140)="755a5398d512d39077459e67ee110daaf0413bc745ef85b89f2141d513969bd8", 0xffaa) ioctl$XFS_IOC_FSGROWFSLOG(r2, 0x4008586f, &(0x7f0000000000)={0x5, 0x7}) semget$private(0x0, 0x4, 0xc5) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000740)) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)=@newsa={0xf0, 0x10, 0x1, 0x70bd28, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x2}, 0x1, 0x15b2, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@local, 0x4d4, 0x33}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x23, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2d, 0x1, 0x80, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0x8005}, 0x0) symlinkat(&(0x7f0000002080)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00') 32.597888782s ago: executing program 2 (id=2423): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xffffffffffffffff}, {0xffff, 0xffff}, {0xfff3, 0xfff2}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1f1802, 0x0) io_setup(0x200, &(0x7f0000000000)=0x0) io_submit(r3, 0x1, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0xa1, 0x1, 0x4, r2, &(0x7f0000000040)="1d", 0x1, 0x801, 0x0, 0x3}]) socket(0x400000000010, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xffffffffffffffff}, {0xffff, 0xffff}, {0xfff3, 0xfff2}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1f1802, 0x0) (async) io_setup(0x200, &(0x7f0000000000)) (async) io_submit(r3, 0x1, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0xa1, 0x1, 0x4, r2, &(0x7f0000000040)="1d", 0x1, 0x801, 0x0, 0x3}]) (async) 31.747651176s ago: executing program 34 (id=2423): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xffffffffffffffff}, {0xffff, 0xffff}, {0xfff3, 0xfff2}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1f1802, 0x0) io_setup(0x200, &(0x7f0000000000)=0x0) io_submit(r3, 0x1, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0xa1, 0x1, 0x4, r2, &(0x7f0000000040)="1d", 0x1, 0x801, 0x0, 0x3}]) socket(0x400000000010, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xffffffffffffffff}, {0xffff, 0xffff}, {0xfff3, 0xfff2}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1f1802, 0x0) (async) io_setup(0x200, &(0x7f0000000000)) (async) io_submit(r3, 0x1, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0xa1, 0x1, 0x4, r2, &(0x7f0000000040)="1d", 0x1, 0x801, 0x0, 0x3}]) (async) 9.372469448s ago: executing program 0 (id=2563): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x9, @loopback, 0x3e}, 0x1c) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x2, 0x4000, 0x20, [0x0]}}]}, 0x158}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000900)={{{@in=@private=0xa010101, @in=@remote, 0xee24, 0x0, 0x10, 0x3, 0x2}, {0xff, 0x200000004, 0x40000000007, 0xfffffffc, 0x100000000, 0x4, 0x57, 0x9}, {0x2, 0x0, 0x0, 0x7}, 0x5, 0x0, 0x1, 0x0, 0x4, 0x3}, {{@in=@empty, 0x4d5, 0x6c}, 0xa, @in6=@loopback, 0x34fe, 0x4, 0x8, 0x0, 0x8000, 0xef, 0x10000}}, 0xe8) socket$nl_route(0x10, 0x3, 0x0) write(r3, &(0x7f0000000b00)="ffffffffffff0011223344554305000f32000000ffff00112233445500112233445500ff9000", 0xfdef) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x900, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/mdstat\x00', 0x1800, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x0, 0x2000008, 0x2010, r4, 0x0) sendmmsg$inet6(r1, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000600)='A', 0x1}], 0x1}}, {{&(0x7f0000000640)={0xa, 0x4e23, 0x5, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c, &(0x7f0000000680)=[{&(0x7f00000006c0)="3d3ae39933472ecf3569f3c68e1b015e03c87b676c08", 0x16}, {0x0}], 0x2}}, {{&(0x7f0000000780)={0xa, 0x4e21, 0x6, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1}, 0x1c, &(0x7f00000007c0)=[{0x0}, {0x0}, {0x0}], 0x3}}], 0x3, 0x4000801) 8.404331625s ago: executing program 0 (id=2569): pipe2$watch_queue(&(0x7f00000000c0), 0x80) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x2a, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x4, 0x0, 0x3, 0x400257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x20000, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) 7.622142295s ago: executing program 6 (id=2576): socket(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000140)={0x0, 0x21, 0x2}, &(0x7f0000000180)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f00000001c0)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000200)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000001, 0x8031, 0xffffffffffffffff, 0xc24f4000) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0xfefffffe, 0x2) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000240)=0x6) timer_create(0x5, 0x0, &(0x7f0000000280)) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x2, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) r2 = mq_open(&(0x7f00000002c0)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0x2c, &(0x7f0000000340)={0x0, 0x1, 0x3}) mq_timedreceive(r2, &(0x7f0000000380)=""/116, 0x74, 0x0, 0x0) mq_timedsend(r2, 0x0, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_ASCONF_SUPPORTED(r3, 0x84, 0x80, &(0x7f0000000000)={0x0, 0x3}, &(0x7f0000000040)=0x8) r5 = syz_usb_connect(0x0, 0x48, &(0x7f0000000080)=ANY=[@ANYRES32=r3, @ANYRESOCT=r4], 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000002740)={0x84, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ptrace$ARCH_MAP_VDSO_32(0x1e, r1, 0x5, 0x2002) 7.415231558s ago: executing program 0 (id=2577): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000000)=0x4, 0x4) bind$xdp(r1, &(0x7f0000000040)={0x2c, 0x5, 0x2, 0xfffffffd, 0x0}, 0x10) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = semget(0x1, 0x4, 0x39c) semop(r3, &(0x7f0000000080)=[{0x1, 0x8001, 0x1000}, {0x1, 0x5b7a, 0x800}], 0x2) semop(r3, &(0x7f00000000c0)=[{0x1, 0xff80, 0x1400}], 0x1) semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000240)=[0x6, 0x7fff]) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r2, 0xae78, 0x0) 7.003723025s ago: executing program 0 (id=2583): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010060000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000200000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f08000340000000074c0000000c0a01020000000000000000010000000900020073797a3200000000200003801c0000800400018008000340000000010c00044000000000000000000900010073797a300000000038000000020a01"], 0x110}}, 0x0) 6.800134632s ago: executing program 0 (id=2584): socket$kcm(0x10, 0x2, 0x0) socket$packet(0x11, 0x6, 0x300) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0xfffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, 0x0, 0x0) r2 = socket(0x3, 0x1, 0x401) write(r2, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x8001) ioctl$SNDRV_PCM_IOCTL_DRAIN(r5, 0x4144, 0x0) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), r2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$pokeuser(0x6, r6, 0x4, 0x10002) ptrace$pokeuser(0x6, r6, 0x388, 0xffffffffffffff81) setxattr$system_posix_acl(&(0x7f0000000140)='.\x00', &(0x7f0000000200)='system.posix_acl_default\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB="02000000010000000000000002000600", @ANYRES32=0x0, @ANYBLOB="0400"/23], 0x2c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x1c0) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r2, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8010}, 0x4) ioctl$sock_inet_SIOCSARP(r3, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {0x306, @multicast}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="54000000020605000700000000000000000000800c00078008001200000000000500010006000000050005000200000005000400000000000900020073797a31001f000010000300686173683a69702c6d6163"], 0x54}, 0x1, 0x0, 0x0, 0x40845}, 0x8404) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/udp\x00') fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000000)='test_dummy_encryption', &(0x7f0000000440)='v2\x00ul\x00\x00\x00\x00\xc7\xa9v\x80!\x02\x93r\xb93\x85\x00loc\xad\x8b#\xe2\xb9\xbd\"\xeb.\xc7]\xa67\x06 \xc9\x02|\x85o7Z\xdc\n\xaa?4/\x00\x00\x00(\xe6\x9em_\x1a\xbfTi\x15\x81\xd47\x8e\x86\xa2u~\x8cv\xe4\\\x91\xa8G!mm\f\xcf\xfb\x00'/97, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) socket$inet6_mptcp(0xa, 0x1, 0x106) 6.547180951s ago: executing program 0 (id=2585): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x81d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) r3 = socket$kcm(0x11, 0x200000000000002, 0x300) sendmsg$sock(r3, &(0x7f0000000000)={&(0x7f0000000340)=@phonet={0x23, 0x0, 0x0, 0x24}, 0x80, 0x0, 0x0, &(0x7f00000003c0)=[@timestamping={{0x14, 0x1, 0x25, 0x3}}], 0x18}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) lremovexattr(0x0, &(0x7f00000002c0)=@random={'osx.', 'GPL\x00'}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5.098491923s ago: executing program 1 (id=2593): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x9, @loopback, 0x3e}, 0x1c) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x2, 0x4000, 0x20, [0x0]}}]}, 0x158}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000900)={{{@in=@private=0xa010101, @in=@remote, 0xee24, 0x0, 0x10, 0x3, 0x2}, {0xff, 0x200000004, 0x40000000007, 0xfffffffc, 0x100000000, 0x4, 0x57, 0x9}, {0x2, 0x0, 0x0, 0x7}, 0x5, 0x0, 0x1, 0x0, 0x4, 0x3}, {{@in=@empty, 0x4d5, 0x6c}, 0xa, @in6=@loopback, 0x34fe, 0x4, 0x8, 0x0, 0x8000, 0xef, 0x10000}}, 0xe8) socket$nl_route(0x10, 0x3, 0x0) write(r3, &(0x7f0000000b00)="ffffffffffff0011223344554305000f32000000ffff00112233445500112233445500ff9000", 0xfdef) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x1500, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/mdstat\x00', 0x1800, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x0, 0x2000008, 0x2010, r4, 0x0) sendmmsg$inet6(r1, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000600)='A', 0x1}], 0x1}}, {{&(0x7f0000000640)={0xa, 0x4e23, 0x5, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c, &(0x7f0000000680)=[{&(0x7f00000006c0)="3d3ae39933472ecf3569f3c68e1b015e03c87b676c08", 0x16}, {0x0}], 0x2}}, {{&(0x7f0000000780)={0xa, 0x4e21, 0x6, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1}, 0x1c, &(0x7f00000007c0)=[{0x0}, {0x0}, {0x0}], 0x3}}], 0x3, 0x4000801) 4.865618925s ago: executing program 3 (id=2595): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = landlock_create_ruleset(&(0x7f0000000000)={0x15020, 0x3, 0x1}, 0x18, 0x0) landlock_restrict_self(r1, 0xb) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000240)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0x5) r3 = socket$unix(0x1, 0x1, 0x0) connect$unix(r3, &(0x7f0000000340)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r4 = socket$kcm(0x2, 0xa, 0x2) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000140)=0x100000001, 0x4) connect$inet6(r8, &(0x7f00000001c0)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x30}}, 0x3}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f00000002c0), 0x3) getsockopt$bt_hci(r8, 0x11a, 0x2, 0x0, &(0x7f00000003c0)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="000086dd0203050009000a004000683739ed282811fffe"], 0xfdef) 4.535343778s ago: executing program 6 (id=2596): r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="9c000000100005000100000000000000000000000000000000000000000000000900030063616e3000000000700012000800010063616e00640002000c00050020020000200200002400010020a107000000000000000000000000000000002400090080841e00000000000000000000000000000000000000000000000000000000000c001000080008000a0000009ff892c69be7c87cd30e697192", 0xc) 4.351411555s ago: executing program 6 (id=2597): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = inotify_init() inotify_add_watch(r1, 0x0, 0x72000201) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000000c0)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) close(r3) read$ublk_bdev(r3, &(0x7f0000000040)=""/81, 0x51) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x7101}) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newqdisc={0x154, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}, @TCA_STAB={0x104, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x5, 0xf, 0x800000, 0x0, 0x8000, 0x81, 0x2}}, {0x8, 0x2, [0x2, 0xfff]}}, {{0x1c, 0x1, {0x2, 0x5, 0x0, 0x8, 0x1, 0x7, 0x7fffffff, 0x1}}, {0x6, 0x2, [0xed26]}}, {{0x1c, 0x1, {0x0, 0x10, 0x9, 0x4, 0x1, 0x1, 0x53, 0x9}}, {0x16, 0x2, [0x3, 0x4, 0x53, 0x0, 0x9, 0xf9, 0xff71, 0xd, 0x8]}}, {{0x1c, 0x1, {0x4, 0x8, 0x2, 0x1, 0x2, 0x200, 0x9, 0x6}}, {0x10, 0x2, [0xe000, 0x3, 0x0, 0x3, 0x3, 0x1]}}, {{0x1c, 0x1, {0xe, 0x6, 0x100, 0x80000000, 0xbe7ddf90efa1c99b, 0x3f8000, 0xd7b0, 0x1}}, {0x6, 0x2, [0x7]}}, {{0x1c, 0x1, {0xb, 0x0, 0xff, 0x10001, 0x1, 0x2, 0xb, 0x9}}, {0x16, 0x2, [0xb, 0x9, 0x4, 0x0, 0x4, 0x3, 0x7, 0x6, 0x881f]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x3}, @qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xfffeffff, 0x7, 0x4}}}}]}, 0x154}, 0x1, 0x0, 0x0, 0x81}, 0x0) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r6, 0x1ff) r7 = accept4(r6, 0x0, 0x0, 0x0) r8 = fcntl$dupfd(r7, 0x0, r7) write$FUSE_NOTIFY_POLL(r8, &(0x7f0000000240)={0x18, 0x1, 0x0, {0x6}}, 0x18) sendto$inet(r7, &(0x7f0000000400)="cc", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f0000000440)={0x0, 0x2}, 0x8) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000480)={0x1, &(0x7f00000004c0)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000340)) close_range(r9, 0xffffffffffffffff, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x6}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=@newtfilter={0x30, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xb, 0x4}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) 4.148778828s ago: executing program 1 (id=2598): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f00000003c0)=0x8, 0x4) r1 = socket$packet(0x11, 0x2, 0x300) socket$kcm(0xa, 0x922000000003, 0x11) r2 = socket$kcm(0x10, 0x2, 0x4) capset(0x0, &(0x7f0000000000)={0x200003, 0x200003, 0x801, 0x4, 0x7, 0xc}) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)}, 0x4) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={'syzkaller0\x00', 0x7101}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x1}, @TCA_CAKE_INGRESS={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240448a4}, 0x8010) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f00000004c0)=0x474c, 0x4) bind$inet(r6, &(0x7f0000000500)={0x2, 0x0, @local}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=""/19, 0x13}, 0x90}], 0x1, 0x40002122, 0x0) connect$inet(r6, &(0x7f00000005c0)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r6, &(0x7f0000000600), 0x800001d, 0x0) setsockopt$inet_int(r6, 0x0, 0x8, &(0x7f0000000640)=0x101, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x45833af92e4b38ff, 0x0) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r7, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000780)=ANY=[@ANYBLOB="e0000000130001000000000000000000cd005480fb82af61102bfa14d22155047a83ec7ec2a27d47304143ee9c9cc79081ea38d665867754d31765c290cbb88ccbf19369672ab3ed0a753288927170d7f6"], 0xe0}], 0x1}, 0x0) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000800)={0x6, 0x6}, 0x4) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000840), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000880)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r8, 0x3b85, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r8, 0x3b85, &(0x7f00000008c0)={0x28, 0x6, r9, 0x0, &(0x7f0000ae1000/0x4000)=nil, 0x4000, 0x7}) ioctl$IOMMU_IOAS_MAP(r8, 0x3b85, &(0x7f0000000900)={0x28, 0x3, r9, 0x0, &(0x7f0000000940)="d5", 0x1, 0x10000}) ioctl$IOMMU_IOAS_MAP(r8, 0x3b85, &(0x7f0000000980)={0x61, 0x2, r9, 0x0, &(0x7f00000009c0)='\x00', 0x1, 0x800000be5}) 4.099968741s ago: executing program 3 (id=2599): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r0], 0x110}}, 0x0) 4.03978604s ago: executing program 6 (id=2600): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1, 0x24, 0x5, 0x80000002, 0x8, 0xffffffffffffffff, 0xfffffffd}, 0x50) eventfd2(0xc, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) unshare(0x64000600) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x21, 0xfffffffffffffffe, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$evdev(&(0x7f00000007c0), 0x2, 0x862b01) ioctl$EVIOCSFF(r3, 0x40304580, &(0x7f0000000a80)={0x52, 0x8000, 0xfffd, {0x0, 0x1}, {0x52, 0x2}, @cond=[{0x1ff, 0x5388, 0x6f5, 0x800, 0xc8, 0x202}, {0xd06, 0x5, 0x1, 0x1198, 0x2, 0x101}]}) write$char_usb(r3, &(0x7f0000000ac0)="e2", 0x2250) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) flock(0xffffffffffffffff, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = add_key$keyring(&(0x7f0000000b00), &(0x7f0000000b40)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, 0x0, 0x4) keyctl$link(0x8, r4, 0xffffffffffffffff) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timerfd_create(0x7, 0x80000) r6 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$ARPT_SO_GET_INFO(r6, 0x0, 0x60, &(0x7f0000000b80)={'filter\x00', 0x0, [0x1, 0x2, 0xd]}, &(0x7f0000000c00)=0x44) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000440)) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r2, @ANYRES64=r0, @ANYRES8=r0], 0x28}, 0x1, 0x0, 0x0, 0x2000c890}, 0x4000800) syz_ublk_setup_io_uring(0x4825, &(0x7f00000002c0)={0x0, 0x166e, 0x400, 0x3, 0x158}, &(0x7f0000000200), &(0x7f0000000280), &(0x7f0000000000)) 4.039449435s ago: executing program 3 (id=2601): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x1, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000068a000000000f00041f00181801000020696c2500000000002020207ba1d8fd000000007ba1000000000000040100000400ffffb702000008001f00b703000002000000850000002effb00095"], &(0x7f00000002c0)='GPL\x00', 0x7, 0xffa, &(0x7f0000000ec0)=""/4090, 0x0, 0xa8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) 3.834749668s ago: executing program 7 (id=2604): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000001080)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f00000010c0)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000001340)='task\x00') lseek(r1, 0x4, 0x2) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000001380), 0x2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket(0x2b, 0x80801, 0x1) sendto$inet6(r3, 0x0, 0x0, 0x2200c055, &(0x7f00000013c0)={0xa, 0x4e1e, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x3}, 0x1c) timer_create(0x0, &(0x7f0000001400)={0x0, 0x21, 0x2}, &(0x7f0000001440)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000001480)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f00000014c0)={{}, {0x0, 0x989680}}, 0x0) ioctl$DRM_IOCTL_NEW_CTX(r0, 0x40086425, &(0x7f0000000080)={0x0, 0x1}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001500), 0x2982, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/stat\x00', 0x0, 0x0) fsopen(0x0, 0x1) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, 0x0, 0x8054) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_ifreq(r6, 0x89a2, 0x0) r7 = userfaultfd(0x1) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, 0x0) readv(r2, &(0x7f0000001580)=[{&(0x7f00000015c0)=""/133, 0x85}], 0x1) 3.826741563s ago: executing program 3 (id=2605): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x5) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x42060680) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x40500, 0x0) ioctl$PTP_EXTTS_REQUEST(r0, 0x40103d02, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000406010300000000000000000500000805000100070000eca777215e4970a1310000000005871a5b3c55a2036b3490585c8680d4b90f1c3ed86347cb095d855e535e8551c5e04cf293080401c8c49835ef06562f55db747575e3fe1c0f65c6a0ac39891ddac621f9bd3cbf328be4e17c86a5259ec1a6047bbf319f921e8fda1750034a2203b596e2fc59496e0e879997f964597aacc05792ab67cf827cb08efa5c5bd437de531d72f775265d29cfb0a33b436fd1ac72246a98f4305d1babfaf3a8fce40f1be2bda116b1d34e47473f39aa995a813a710dae914618c4d6fe5ba44aca3e0570dd32977ed521baedf6801196e24f18640f84add06d5a3d091db19c0afcfc4fe365e11e5c9b82d02b079c934b9324386f08f8f13b68e630f47ac96b480f"], 0x28}, 0x1, 0x0, 0x0, 0x408c0}, 0x4000000) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0x4000000a00}) socket(0x11, 0x6, 0xc) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)=0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r4, &(0x7f0000002140)={0x2020}, 0x2020) ioctl$HDIO_GETGEO(r4, 0x301, &(0x7f0000001140)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00'}) timer_settime(r3, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000000)) r6 = openat$vmci(0xffffff9c, &(0x7f0000001180), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f0000000040)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f00000000c0)={@hyper}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r6, 0x7b2, &(0x7f00000010c0)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x200000, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xde23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x100000, 0xffdfffff, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x167, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0xb420, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa], 0x1, 0x400, 0x1}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r6, 0x7af, &(0x7f0000001100)={@hyper, 0x8001}) socket$nl_route(0x10, 0x3, 0x0) 3.707118037s ago: executing program 1 (id=2606): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000400), r0) sendmsg$GTP_CMD_ECHOREQ(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_MS_ADDR6={0x14, 0xc, @private0={0xfc, 0x0, '\x00', 0x1}}, @GTPA_PEER_ADDR6={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x812) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r6, 0x11, 0x66, &(0x7f0000000500), 0x4) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000010000000000000208000400", @ANYRES32=r3], 0x60}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="600000001800093f"], 0x60}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x1703}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x1200}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x24, r1, 0x1, 0x170bd28, 0x0, {}, [@WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004840}, 0x8001) 3.440344719s ago: executing program 7 (id=2607): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f00000000c0)=0x40000006, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) recvmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/19, 0x13}}], 0x1, 0x40000002, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000000200)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="8c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e000000004000028006000100fe0f000004000480280003800c00420040000000060000000c003900ff04000000000000d8fd010006000000090000000600050088a8000008000a00", @ANYRES32=r1, @ANYBLOB="08000500", @ANYRES64=r1], 0x8c}, 0x1, 0xba01, 0x0, 0x400c085}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x200048d4}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 3.388447803s ago: executing program 1 (id=2608): add_key$user(0x0, 0x0, &(0x7f0000000040)="f5a33db6", 0x4, 0xfffffffffffffffe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000001c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000380), 0x318, 0x0) recvmmsg(r0, &(0x7f00000003c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f00000004c0), 0x8) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0xf, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000680)=r4, 0x4) sendmsg$kcm(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)}, 0x0) r5 = dup(0xffffffffffffffff) inotify_rm_watch(r5, 0x0) ioctl$sock_TIOCINQ(r5, 0x541b, &(0x7f0000000740)) r6 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000780)={0x28, 0x0, 0x0, @my=0x0}, 0x10, 0x800) bind$vsock_stream(r6, 0x0, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) r8 = syz_mount_image$fuse(&(0x7f0000000800), &(0x7f0000000840)='./file0\x00', 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) read$FUSE(r7, &(0x7f0000001680)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r7, &(0x7f00000036c0)={0x50, 0x0, r9, {0x7, 0x27, 0x0, 0x14a4014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x50) write$FUSE_INTERRUPT(r7, &(0x7f0000003740)={0x10, 0xffffffffffffffda}, 0x10) syz_fuse_handle_req(r7, 0x0, 0x0, &(0x7f0000003780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000003840)={0x90, 0xfffffffffffffff5, 0x4, {0x80000000000001, 0x100000000002, 0x5, 0x1ff, 0x800, 0x8, {0x5, 0x3, 0x10001, 0x3ffffffffffffff, 0x7ba, 0x2, 0xf2a1, 0x0, 0x4, 0x2000, 0x3, 0x0, 0x0, 0xffffffff, 0x5}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) open_by_handle_at(r8, &(0x7f0000003900)=ANY=[@ANYBLOB="1c000000810000000000000006"], 0xfeffffff) r10 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r10, &(0x7f0000003940)={0x28, 0x0, 0x2710, @local}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000003980)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001600)=ANY=[@ANYBLOB="850000002f000000d7000000100000009500000000000000423d19f1e4e058f160906b507e5120a0425f48f9550dcf76fc596696e6f89a4a2b1d29eadfdabd5217ba2d02d98d17b488d5437e04555f3dc719afc000"], &(0x7f0000000240)='GPL\x00', 0x1, 0x473, &(0x7f0000000280)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff60}, 0x48) 2.904400552s ago: executing program 7 (id=2609): r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000380), 0x80, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000400), 0xa000, 0x0) mount_setattr(r0, &(0x7f00000003c0)='./file0\x00', 0x8800, &(0x7f0000000440)={0x80, 0x74, 0x1e0000, {r1}}, 0x20) syz_emit_ethernet(0x96, &(0x7f0000000180)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @local, @void, {@generic={0x6000, "b7920fe40870d91df6a15a48f9836e802b3bc2cf80c2db630750dd3f5cae8443050332181351c972f3f67ca8f95d774b49f71a179b0745db087571d3335897f0e33154f1de629725e96aad951f3a7c8786022294c8de64f052bac2276b3150987540dc3cc1a5226df618b0d9af81a98c2df8f587f45ed6c73c783ef7ea308b1d85de486bd7dcdad6"}}}, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='\x00', 0x89901) mount_setattr(r2, &(0x7f00000004c0)='.\x00', 0x8000, &(0x7f0000000500)={0xb, 0x0, 0x80000}, 0x20) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2c, &(0x7f0000000040)={@broadcast, @random="e24d2313ab04", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x13, 0x1e, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xa, 0x0, @opaque='\f\v'}}}}}, 0x0) recvmmsg(r3, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)=""/236, 0xec}], 0x1}, 0xfffffff8}], 0x1, 0x100, 0x0) r4 = syz_open_dev$usbfs(0x0, 0x76, 0x101301) fgetxattr(r4, &(0x7f0000000540)=@random={'os2.', '/dev/bus/usb/00#/00#\x00'}, &(0x7f0000000580)=""/212, 0xd4) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000680), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000006c0)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r5, r5, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000700)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r6 = gettid() timer_create(0x1, &(0x7f0000000740)={0x0, 0x21, 0x4, @tid=r6}, &(0x7f0000000780)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f00000007c0)={0x0, 0x0, 0x10001, 0x5, r6}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000800), 0x0, 0x0) ioctl(r7, 0x3b8e, &(0x7f0000000840)="10") (fail_nth: 1) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000880), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000215c1100001e0a01030000000000000000070000000900020073797a31000000000900010073797a3000000000301103803c000080080003400000000230000b802c0001800a00010071756f74610000001c0002800c00044000000000000000000c0001400000000000000000100000800800034000000001"], 0x11e0}}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f0000000a40)={0xc, 0x0, 0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000a80)={0x18, 0x1, 0x1, 0x0, r9, 0x8}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000ac0), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) 1.783107861s ago: executing program 7 (id=2610): r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000380), 0x80, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000400), 0xa000, 0x0) mount_setattr(r0, &(0x7f00000003c0)='./file0\x00', 0x8800, &(0x7f0000000440)={0x80, 0x74, 0x1e0000, {r1}}, 0x20) syz_emit_ethernet(0x96, &(0x7f0000000180)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @local, @void, {@generic={0x6000, "b7920fe40870d91df6a15a48f9836e802b3bc2cf80c2db630750dd3f5cae8443050332181351c972f3f67ca8f95d774b49f71a179b0745db087571d3335897f0e33154f1de629725e96aad951f3a7c8786022294c8de64f052bac2276b3150987540dc3cc1a5226df618b0d9af81a98c2df8f587f45ed6c73c783ef7ea308b1d85de486bd7dcdad6"}}}, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='\x00', 0x89901) mount_setattr(r2, &(0x7f00000004c0)='.\x00', 0x8000, &(0x7f0000000500)={0xb, 0x0, 0x80000}, 0x20) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2c, &(0x7f0000000040)={@broadcast, @random="e24d2313ab04", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x13, 0x1e, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xa, 0x0, @opaque='\f\v'}}}}}, 0x0) recvmmsg(r3, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)=""/236, 0xec}], 0x1}, 0xfffffff8}], 0x1, 0x100, 0x0) r4 = syz_open_dev$usbfs(0x0, 0x76, 0x101301) fgetxattr(r4, &(0x7f0000000540)=@random={'os2.', '/dev/bus/usb/00#/00#\x00'}, &(0x7f0000000580)=""/212, 0xd4) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000680), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000006c0)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r5, r5, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000700)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r6 = gettid() timer_create(0x1, &(0x7f0000000740)={0x0, 0x21, 0x4, @tid=r6}, &(0x7f0000000780)) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000020303000000000000000000022000000800010001"], 0x1c}}, 0x40000) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000b00)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000e00), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000e40)={'syzkaller1\x00', 0xc201}) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000e80)={'syzkaller1\x00', @link_local}) write$tun(r9, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x0, 0x3, 0x6, 0x3, 0x2b, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x2c, 0x63, 0x0, 0x40, 0x11, 0x0, @private=0xa010104, @broadcast}, {0x4e23, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x9, 0x5}}}}, 0x3a) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f00000007c0)={0x0, 0x0, 0x10001, 0x5, r6}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000800), 0x0, 0x0) 1.438670997s ago: executing program 1 (id=2611): socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x5, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a201020301090224"], 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) 1.392860693s ago: executing program 6 (id=2612): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000001400b5952dbd7000ffdbdf250a0800ff", @ANYRES32=r1, @ANYBLOB="140002000000000000000000000000000000000114000100000000000000000000000015000000000800090002"], 0x48}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) 483.28433ms ago: executing program 6 (id=2613): r0 = syz_io_uring_setup(0xf00, &(0x7f0000000680)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000700)=0x0, &(0x7f0000000740)=0x0, &(0x7f0000000b40)=0x0) (async) r4 = epoll_create(0x1) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000b80)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x9, 0x0, r4, r4, &(0x7f0000000c00)={0x4000001a}}) (async) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x2000) (async) r5 = socket(0x11, 0x800, 0x5b2f) r6 = openat$audio(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000000480)=0x3) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f00000005c0)) read$dsp(r6, &(0x7f0000000600)=""/79, 0x4f) (async) landlock_restrict_self(0xffffffffffffffff, 0xc) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) r8 = syz_usb_connect(0x4, 0x66f, &(0x7f00000028c0)={{0x12, 0x1, 0x180, 0xe4, 0xbc, 0x45, 0x8, 0x84b, 0xa001, 0x21b4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x65d, 0x1, 0x9, 0x4, 0x0, 0x6, "", [{{0x9, 0x4, 0x71, 0x1, 0xb, 0xd8, 0xd8, 0xa6, 0x9, [@generic={0x3d, 0x23, "d1e9b96cca305fa57a7e36df4e8e5beda02a5baa65d902bc64c7aa28339f362dd685e7c7a7a4ec6885f602325447589e07f9e0ca19a9a749097cff"}], [{{0x9, 0x5, 0x0, 0x10, 0x10, 0x9, 0x27, 0x4, [@generic={0xce, 0x1, "95bab13fb9e6336e4690d3a472793fd44a43cf3058b6fcbf0dbf600df5b1905e85b8df58058b153c26606401e7c9b60b726502eb44c596efb263dad35a8e984d63827d2536c5f8d9ddb5c65c806b4d5843266ffad497922b9c925105cb8a6123d2f5e4508123e9570022d153f732974e9c8604f6e59010778d4c30ef774a8562680ae5de4d2a13ad921c183426f35059e51a69dd87de3194a277a33ae1af1dbc3052a3eb3d6598f0cde8f59b4364a8fec983e244dac3f34ed5bc682513da11d587c8af13da13a7fec810d9cb"}]}}, {{0x9, 0x5, 0x5, 0x8, 0x200, 0x7f, 0x6, 0xf, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x4, 0x400}, @generic={0x18, 0x1, "26858094f9589c815d25d891f6a54616da2f01a4abed"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x200, 0x1b, 0x6, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x5, 0x4}]}}, {{0x9, 0x5, 0x0, 0x10, 0x400, 0x3, 0x8c, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x9, 0x8}]}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x6, 0x80, 0x6, [@generic={0xdc, 0xf, "0301ad2a5615ad8936ec738267a1e986234e95f9e2d9129ad56c8f0af671d9c0b6150a25b609e2a333d4e3d9e9412ce8a66579aff5f33d66896159475010e97f8903bf874de558ff1ac63274169d12db63084ebb2ff2c193d625139556cc80cbfdd8b64eb483025997fa140e72672f1b309c7fc48d7a74c3724529a62e5490421ecd06663e869fe211350e40503cb8566878aece36467a70ff31c8fc1d04957e606f9e2137b212d3f7051da1881476905e46c2a11a1d5f9c334bfee4c6894067e9178cc7e32b4290933c9a3715db223e14313dd9c8ae2ac2fcc3"}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0xf, 0x100}]}}, {{0x9, 0x5, 0xa, 0xc, 0x400, 0x2, 0x8, 0x4, [@generic={0xb7, 0x4, "16519e342f4cfb3d9aad7ac0b35618330b85b69fdec1263cae82feac222b98cd1010fa248e9491c1d4c7775a7c2323dc066295cc52e031a2ff792e423ceb534e2788cc436a92bf1bf3699befdd3bb1edec3890166b42ccd53bd5ed236f226dc78ab916ccf08a50e7ac96ba4eca41efd4e926d2b72c15535c555826d4b4b7703bffa8480205d1d634b5e0d12e1c4b513349360876341fb7c681d923ced3c0cecdfe824d9c3ccaa168fb9ef28dcd71efcbb784cc4336"}]}}, {{0x9, 0x5, 0x4, 0xc, 0x8, 0xf1, 0x10, 0x0, [@generic={0xed, 0x24, "f23c47d88143cb9c9c825e5e4a83ba541bf2c4a683da79b333262c70a137ef93deafde7185fd3207f42d4fc48b2f5fdc868c52a9693d8b17611a2cb3cf9669292f255e22e1fab2792b1dc571ec0ae669293d1af8a8d009e63a653dcc9487a59e8b5be8e5032b01c98ad6eb80054e2e85268f7c6a564fd4b32358171cf60866eb0290c6c2d53b813173ef7ddda141cae0e49548e224dc95dfcdd5d32e83bc8f6fa490f629953963d6c7aa697cdcbdae9f76e49d36fa3ebf3096e75ed0f1fae855e7cc2e27b43c97f23768f6b38eeb956f7a9b548ccba6b4d101203f2338620fad64f5fc8d206837495abdaa"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x400, 0xb, 0x3, 0xd, [@generic={0x41, 0x21, "25f6d1c539f0e1edd44e94315650a05bdd2f685404ca9d1bcd5186c9a3ed36d45968f0455b9c8afaeb206fdf58c7ca96f161af90bd9b7b64e00f44efb093a2"}]}}, {{0x9, 0x5, 0x1, 0x3, 0x8, 0x4e, 0x3, 0xfc, [@generic={0xf5, 0xf, "064cf214d061a80831fb806372d3ee81a8ed08e2705355b6a483279e59a9face5bf220103416b98c244076020f2d15f234d7b96d626794024a33e9ecc8b4d32ff8cf2f29a8db0c7b56ecf1dc6238ec5d820b029a28a779c35a96d732237e1b13edccae5d7a34cbee64d9b8de9c081b1785bd80c28c7126d0ce1d5e77a5e4d177473aee756f10062c3f671cea569c42fef59d863056eb3f270be30df1c59594edaa1bf12224dbfff284eb5810e5c59fc4bc3e7e2a9eeffc2cf4422e294f1f330c8997e051e0c682e7345d0d4a169677c31fe318667a394bb0ecf0d13f3f6c495ddc695723e0badbb0f09a95d8c79067dd5394c0"}]}}, {{0x9, 0x5, 0x8, 0x0, 0x3ff, 0x1, 0x8, 0x6, [@generic={0xec, 0x24, "6495edd8680e820db51b3d2b0cc04f220f2323ec1fcdb24cfd7c8bf480d51d3dd6a603c4738d6ab31c08d6e6fc1b111fab2efb1ca8e9be45d4adb7fe31c259061528e15aaadb128059cc8f3b32362e5bb2449e822a469868f8e55357941f3f9edb58d60db844be4e277f2df8ac648b5696bbf5e35f3ec1ef6ecf7a0ada1d0199dfebecc4dbdfde01888d9680be25346e8e27dc3a0f60cbda1fec4ad1859c525a18d769eb87f465f364729046788d409f69c2285f3ca2a62325dd409c44d3f19dfcb8aec4306afd395114e2cc4749682d71ec645d8fc16915a0e3e05cd8ca6e7a5c5166a33a2dc08baa8c"}]}}, {{0x9, 0x5, 0x0, 0x1, 0x3ff, 0xba, 0x0, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x6, 0xfa}]}}]}}]}}]}}, &(0x7f00000031c0)={0xa, &(0x7f0000002f40)={0xa, 0x6, 0x110, 0x9, 0xff, 0x9, 0x20, 0xb3}, 0x19, &(0x7f0000002f80)={0x5, 0xf, 0x19, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x1, 0x8, 0x1}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x1, 0x9, 0x4}, @ptm_cap={0x3}]}, 0x4, [{0x101, &(0x7f0000002fc0)=@string={0x101, 0x3, "e4fa4e2f46ce7c3d7262d066d2edbd2bbd4017492a8aa341ff73da0a47aa74eb6742b0ccbb403974eb198bc1c05d1608ea36d1e692ee583bff379d33facd8ee3c5cdc440d202fc80891603f950cc109092f67c9a194b08f75487d6334960ae02e4ee2c4c5553d59313d86ace79bf19b1136f409db22eaa35d18a78caec92555b44ea8e923ea650495086963d6b07fdf0a76eaec6580e21633de533d6fb72625809bc66fea6c5c81fb0902d809c759bdbf3d9a5733e3e5106a3b542fe94811942afc451249314fb9a745718d9bb0a062b4095714d0e8072d4f2aaaa49749f69b5ea4d13d16858791992f2cc8d453bbf55959921d938f4a192735af8785e27c3"}}, {0x4, &(0x7f0000003100)=@lang_id={0x4, 0x3, 0x807}}, {0x4, &(0x7f0000003140)=@lang_id={0x4, 0x3, 0x140a}}, {0x4, &(0x7f0000003180)=@lang_id={0x4, 0x3, 0x1580546700e9f064}}]}) syz_usb_ep_write$ath9k_ep1(r8, 0x82, 0x11b0, &(0x7f0000003240)={[{0x57, 0x4e00, "88b8e363d652236e7de2857d1cb847652ad68eff375a40313633105cd25546121ec34d140dc9b01d4fba1c72a1b48a157c694e8bd4ab929457ddd1d52665f17e11838ef9812979357a8e4fe6880674f1353e89871b8302"}, {0x1000, 0x4e00, "d8cc284b9ac7c0cd0a4edee16c14d1fe9e3d08e6f5ec22d00b77d21af5065627cb24056abf46ccdef485a318e190c914d6ddd5ca254fe31155ea7eec61ff81b82473f72a111c39266437f7daabebf7da96ad0e61ff39839b0f89df2231637b7fb079f0d37fe5e9f211b03ea1c5f2339881e7af868098d7c5304f3eb0cd71e8543ce54ac0f1bedca9c2031045eb63fa29c6efd47ead0a389920bdf5397a6b1acc99d7c526978984d65d22d17a721f00924549034fda48d49f2dd3e5fdf3392193c4671eace2764f16db39fab3ee188c550d5e791a03689c3d5d49a25c5c01da596859cc7b9df68f67615c607e885adc4a8751866a0a603fae58510b36f48b499b4c7c0c1145468b3a5fc82dc91af7dc38ed824113b3dd778d894b8852cc859f92befb5310d12cbd0963facf0e1a2da4892198b3e82f8c0b0cb1f68124a2f794c264a3ee665c1ccc7e2aa1f27640e9d6b4028521fa0fff49867cb80d8bed8355c65455c6bf756f7a204d3d3414f3bcdb456c42cf4c176a747b30b70187f24c88710489e59f2def479e1e3e70a1edb3a5be4faf48a2c9ae24db4f88cb2ff57c917ac53b8ab07287b0acd85f0efbdc2fad18611bf007d65bdba96a711d6befc937d94d4f502f8f70b921aead45baf09de46a0863d1d4973089207f34b31446e1e41a9b481ecfb09d89767651ea35cfb7fa52b7901d9f70b807480645cafc66bdde433d8d6c3ec362e8f791bb285d5a62092b21c998c559ab7061c95e00870a4b2d10494a55975ac5fc3ada9e595103ead55aaf319d089be6a92758eecf7ba1ae84825bf6be18daae9e8e9baa78ab9dd77222114a2bf4da4e510a08b2bc76786f8faf812ad1bcc1d0cd54d45a99799fbe81f3035c3cbcac983f86972058291a4ae3a66971ac8e92e4496801d4d0e218bb615f4ed9530aee11009c889d2ad2a16f6bca3247d959bf03d589134762761bed562727d49d8ae9f522bf35b781405e58af5e9252ee6fedbf4eec59a813e35d2262b9c1fcd6d1c76735e971ec5e132cd9f1204f5224c39274d94c2390799e77400aab096fc7cbd9e836aa336b8b65a0e98393297cb7b428f48e646ad8bf3d1c6750238d40dd4787980215cb76b91b977cf6cd9340767b3ca8c24c9bc312ef9f97a13a6ec3645800f7025a837dfab553dd433eb47bac3aff2a4e0b83b86d58d67df90cd4e260c979195cf6e0a6e16c37e673be9f1e5c713a6589b1d3357cd66d54a87c32c33e849a385d569f5dad65ff3f5040ef576d0de869a2a280672f7356bfd3043f1d5adc1b9ef0fa5f83f872daac7ec5023c40af27ba8f2b3d7a136bbc77246e4f5441e9580889514120d34ffa71b3ab7dee9413f9641670fd69cb75fc3a9e1ba1619e06da613b7ea45a300530e6946642a69c03c00e055328e28e4cc7d19841cf97f5ee71b75028d4efc06f1b09bad0e693203a5289940f0a426768954e02e4ae1a848d10039df9d68843af0654419d73dd6f6db740bab0c31030aab87be7fe3164140eabc6c942804ed858d184b13c838d9214f68a6d79ac6eb2ca6d4d2ffacfd11a1df3067355504eb5d316b4c1369a4021242c6111edb208043ccf4012958838e4b51cabc7520fd4bc86229a64f1c6875a9849967338f4f9afb04fd59aff718c5f08f49290fa9150e3d022db412ffbfe35348bba2c8ca5d72f954a4dcf90102d301afe79c597def9f18bda4b26a698201003b9255c5eabda9a720e7b65b708b9aa40ab39eaae905593e6bfdfe0088d4def31ea23ca3c53753d48c09145e23f95b18a15c1aa8ef053b42fbb329bca88a9f1b4f1464063703665db5c7230e2a5841d0a2f7548cac68c82c6c145ac94369d8a714d5ef0f7a1e96ca1d1680d029a49ae37d5ec2a2b9d21245c83aa9c36515527a6838412ecd2faed5099dc2fbaac4a596cfd2d34a0e438d453b4f0e1597786854211826bdd2d108bd23b66d84e777787a8bd2e77dc646c239cb8c60ea5d5ffb3205ddff7621621c45c1dc3d4d3b52ae05b8f4cf0f7b5efaf028d92144e7b1ec75f33429d14b3ffa9b94e1be715115cc7ae4de8b10c338643667cbe0b6eae6c9e6b80872a99cc5ad05edf82c75969d7a5aa3c177cfcbb59409ab25fbc540e75c693a94edb6b15bfc8e9a693e42025e72a0bcfdb1d29c04be718f43f56481f7f45d845a4ede80803bf70a7e0a1eb1eca9349bd7a98818443865f4c0f1daed03997176e46e5453492017f005f604df5d5a364d288dd9551d2ee9c8866cf50a8374d6f46db40530d2b6deb2e1bec6cce4643995dd3ade6dc9269085954ac164ecc84acf5923c3fe34ca069a1b6d58f73fb149646af7b416671bf91267c044c2ce7e53ee977de3aed9516dc179fc43f09e90d5fe6262178b1ee7a95e1ce005760473fd6e5fcc59c6667b91c50bd8de31f953bba65a698ee6268d2c06e0f5282553280f4105ed6631537c313a78e5394a69221bb1648da3a6e89e1f2f843748de0c470ee41af4f71f56a098f704c5f2ee16e7eba253a486dbbf990eac5e8c3df1e5a1bb6c5fb67c300efe03265c4cf67754f9a43520b3ccbe1f98f99bcce86390c2fcd4d6f1ad8435b1fb694dbb2c626677b79435058f4759bc779c15fe167ee9be5068e879dc5300a8f1aaf2dce480fe559c16231f06930a6c25b291ecae67416c0fb34e09d361e1d416dc57a8a37529b6bd6b4213e5d02cb661262ae4e4b0c2dfe6c61f437a61d2bd21391fa347e9f96db1eba2b13a37c5c11f29a87b4d61595318f90e4f913f3729e3e14711189aca2bab43d031a9daad43abb6d0c3116046aa5d84d3cd184c5feed3a0e27465ec9f9dddb3e22873b3acf38d37bd9b63328935ab37f9b0eaaf05c32e6ffb6cd1729b8c01fff3b31a70460a56d9622849ada4da9ceb1fdc34efb6c65b2de06adfdd43be609699e76089a4a44565cf071327dd314bb1bcb7da50925b2586e1c8327f011b1d90a64ec16939c9cb968f39806d59b2e0e22912cc30a3564b11f5443018cd5c6f1d569a5c6867bf2a70fee8416688f2a3207071ed9723465330209bfb5043fa90ab8af781fbb62a3a1bad59838078b328345fa06849195cde513c10f9b41e1d1623fead1ccf8ef1a6f9bf7ca8427d6e34b64956c66b0a7c9fd20b57320a55cd8caec6492e0ef85dca797681e28d7792766a9d03f5980f675a45c24e2c08a007f3c1efcb712ea36bd7f618a2b938ab1df1cc4b501c228d0e515eb1b9ef53c11a1b99aa5bd865bdfd6c7c8cdb6257771f89704fc01ce0d6c1ac1bd54af68ba6f8863335795b1b1643f2520ee582f5307bcda19c874da1dd20d58fdea4405d910f5d0d163a6b7139306a450b2911108b481a01abab35d0cfea62b29b453c6e84419e9335dd9997f03c54f7608172320e7f17cb7d1d168c7755c250cd3bdeb8cb7296e851243eaba6cc3ffefd190f9c2340df779d287bb7bda18387d6c9cbea0830476d39def7c20580f8e45f429fd3627e85fe9dcb002d78709ca9c6a40d96a8198467c55ff9d0d7202f31cea9ce83665570daa8a9bb0fd31f3a222229f70c34350db88e82d4225e609d752aa6feeee886de03055a3d53ebd4a4f7a9609cb2966d09947d8587d1e3ac2809c9ff1b48b6ea1329d93b9b0f9fa1deb39d95763c73225369a1f9aaba2482787ceee6bb4d36047d6a005dc5bb09e9e4d4c664c222931e2fafca103afa956a68931b31d6c9933c4746cdf0d96134579055b1ec9bbc9c8d380dc4c61b8beb26b3c4eae4f2d139112cbe6f7abd506e4b5a4552405ec5f06f15a1a2eda6bb20ccbb8157e063bbfa172443a02b84c106cc4321b72f8800a740d175c66e91b581794802c1673725ace912707ff61fab285092ee389f6b6d2fd18bec98fa3367dc92e19b82180a86895b49f4d9b2e71d172a505fddca0a127e06f0fbc22a95612a1d3ae77ba5aa7fbf6c695d68f6dbed7f2cc1c996246b1d0bfebadcb02219bc4582ce646441b31a20cb1352fb33e0925e837e33510c0971063398e962f73a836d5a1b55357012edcee99cf06da781aa218ec84acb0aff5b4529c66d35818c6916e1e00d878f9d7d3084da6b0fe642b7f8f6b91a4cfa95a7e3aec5e1a29666975ea0c41d31243412cc25fd87ddd1a6f25d8732891fe16099d9cf446237ca95d39460ad593ae5459f31be00b238f08f83ebf64c9a35983df4cb57244a7e0b9cbdf161115e4ac8400358b1428d110c3f61afe43be357fdc5bb674b7c584e199e0fd78d48037fbac169ec479d0909af76aacd9ef3bed760d0d60910339b29085e9dd957295d68ed563d535d8e9e244de24312bda501a1379fa2aff6c9932c60b8e17e6811110c35f7dd8b81ed58a7b04f922ce22c950871d85b23a522d8a2e504c7c28dc54ced2f8f7fc6771e41831e070da2a78c4d8f3c8c4722cca21b8331c9d01abf03f2e1b9f9d7e2233cdbb762d5684dcbd9897e243233ea4a2957e097c8365420f0831968434c81f6d8af1d4d95f6493d5461b2b750b7352f8faf71789bdb84c5f4117fcb3e96ae472954bffd759fbd894563ce0d07d8ad616ddad263fb24ee448967dc1c61d12102ade24b577cc10591c6d33ae684ec9080cf07532c881a8853b916c84acf0edc93f9ebc30b79fc4b31c2aa43ce70b1c8f1e94fe6a06a977779204b9f3b1cdaed3d63d3b6add9556a1c78d07cf0ee0d7e34c344fcc60373cc5ab06668e86d4c9bc27749993c0be132015649a0779327af177e7642db282c351e7dbead12f851a67daa0c9b9a022be222dd9306f7320d76c772d06c288f312add8ef7f329bc3ba38c1a1b026f2f490cec889a174cd6f5c6acffecfdd12f1afb0c204dcb213e62fefd9d248bd13a16b9d254519f22d949802ad03b9657c10350649299d1c5a52fa0c22fed470322bd6a4d00bf2c6f2673b064b46ed63c669c719d96ccf36b7a486d77dc7db1152be42ba76ec65271c4457fe6e45078a1fedb61d9bf07f77f0941029e18ace90a2ed591caecd90828e4a8de210631b658df0e6cf89afd8f896db27fd9a422307634468db41355e3dd2fd8220177e1ef536bdac68b7ac3a8bd0436ceb0c1d4413c27a367f83e18543ea3c488181ab553274be36e8a14c5f471d17f6f3c107825b985e5bb28cd551f7de90171ea08d304fa37db831b7046706d24855af555972e5e7b91eecfef303f82dc5c327d2f467bcb409db11dfd84c01f1a5287b3f597ad4d635c0d279128bfa37c620821d640199098fc948f1f31711e92afb09e6c6359ad6563aadca211c66e1cc7ec42edb32f10e34d7c6e4ff27916370896ed406bd1aba4a4585b2704e1359f648296cfcd05894b70051c3a883e95be564c5886019e1e983808c63b61cf58264e70923d9a1574d5a3ab95ec6c9436cf82f00775b62f2be89c97a25c68fa97620b23eda486862b9b229b171bef7255ae40eadff3c3495c14616c9d6ea5ba2da9a4c78dc81500d956b007210f0663234d70688203ddb0cd239715312458946533aa71587c07288040fd6eeb746c803c58d63ee5bdcf80ee4fa1f7fbfbfd476e6a92ba2e4a526d21d237fcaf3658189ccf782eb9b6c88287ac72af1757ae0c6346b96a063a3862c569a86a8ad64e3bb80522dfb22e61da1bcc8b2f72122628b32c0977237ed88bd8de804129d4954b7299c054066de0124e59e029f508573f401c0db596da3e4cf0c69fa07898f2262f989e521fcb5bae3f900552697dc9ab17ef4e711c842c696f11e8acab501d376477d710a07f849d48324ff0bc5508cbbaaa8ff7a4664bf285b86a3a2e7f5fc474dfdf8"}, {0x5, 0x4e00, "b659bb21fb"}, {0x9f, 0x4e00, "9ed7e5136ab2e37df206c653827864b2ba55624b37eac32e02ab11f3fbef87af3fa073f47dc1b916eb3ba369fdb808fb03eb3e20227b384257aac7d5cd6dea172316839b0147ae7b6c7ad12ecb9162d62cf94ba4ba529537c029b9e84d54a203ab78a86bc615780396f19ffce6b1afcb3ed5c2fede2b5e58a7e5fe1f8bb14c137dff5cc14b9770cd885335c11f74f969fc892834d38870eccca9d26f77acd5"}, {0x6, 0x4e00, "a042827dedc3"}, {0x35, 0x4e00, "ce9bb52ec1afe2789d87659a2a3b1ab2e778bb04cc3b741a15895a28190c0285fd4fc373c348471aafee83db79fecdd7fedd9ced2c"}, {0x54, 0x4e00, "ecd267b542c6419fe63ae957085beae30aede2f02c3417d381037f7973a10c55133508563e9627652cd60eee73224d304721c141f8ce776cde0be8afd70305c868d64ae4af1ff3e707a4025f4d36a9e57508e3df"}]}) (async) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800dd8d000000000000000002001000fe0400010000002008001ec0"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000180)=0x10) (async) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x1000, 0x200000d, 0x100010, r0, 0x0) (async) lsetxattr$security_evm(&(0x7f0000000d00)='./file0\x00', &(0x7f0000000d40), &(0x7f0000000f00)=@v2={0x3, 0x0, 0x2, 0xd0920ff, 0xe2, "5b38c1879c253e07cb72b910364e544dc6b3f312abdd43cc9d994172fd71365804c211c81c15388540e6181a6e032e619f035a4503214fae85ccaa81621abb3ff4b829d0000fdeff2a5492f27cf092f676c867872a0f79ffd85f44bef6157d58b3255d5863bbd130ca9ebd3914ce558b74e9d9fdd00aac55152fe9a39f0c8c25ba6a697c3a214472ec35ba60bb6a85f13f689e408a91514706a87ee75fcff50afa3a697ee1e4b0078e847765d28be36da996e5359801e023b8231be6b908efc848e50ce2d23f36e0e040afa4a1dace61cdbaca3c4c9261202afbdf517886834d416e"}, 0xeb, 0x3) uname(&(0x7f0000000340)=""/245) (async) sendmsg$SOCK_DESTROY(r5, &(0x7f0000000b00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000840)={0x280, 0x15, 0x8, 0x70bd29, 0x25dfdbfd, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x4b, 0x1, "4da0d4e593a81245c2ca7c7dea4d75687fbac9de6ff4241e24bf8369cdf71d4da1cb8da05d18a4706a15160b6073e2cc3dd54903f16f9ec705c09ea6b453f6a94c436c88544a01"}, @INET_DIAG_REQ_BYTECODE={0x40, 0x1, "287582869d4df17c5abec2fee5805b827762849b08085a892bc755bdabbad4bace2fe6a2b423b7961e8bede09cb128e726dd21069a03f2e8c24c7f7f"}, @INET_DIAG_REQ_BYTECODE={0xf1, 0x1, "404e3cdc9987603ed393241d4d39415746f5e64a3c15bda200762461d90b55100c8713b6dcdad744b5b8e012539b1c11e4d26a1ff8afed87bcb57ad0519c62a3a0144ba1e9723f54e38d3c31b5e0da14cbcd1ef306830cba1fcf8b1d1118d2db0c5fd071029439611676ceae91eadddea5e7ff95c3f9782d9b470a5a87591182b85a9d222ae5368c8c5f86f1431ba61b87e6f807abf507cc651d1e65aab756c38fa0f166dce8a3b02eb6e0358c413d080e6a8e051955b48a364a0b705b6e087b1503f19a920a84e9e37693461beb7830e278940e3577f612232a7de33e33dc86783ebf08b32d252d3b4d3e7009"}, @INET_DIAG_REQ_BYTECODE={0xeb, 0x1, "bdd5720c28cf25adddd8888bc4e5cb2500e9a5d6ad4112bbfce761ec18c2c3276038908dc30c8bb46f327df2a1ae5138b0b4f20e9542c1d9253217398bc92d35c1ba8cb62892e7b48f0081d76953c5cb1b64ccfb5d93ca2552f486c1833cc78bb138350c05c5f25b4317ceff65949d632db2e6c811d93d049f6fa6e92c828fb940531f942bde89b1907080e672f1098784a45dc3ab95a33287f96cc172afb7fd99ef0d1d66d99c95889edf74ff47fc8a561c4d524992a29aa1eddfc980df07c6cc3603c57f9faa7011f40a1384ca9a9cab01509b974433d4948fa7a34fc8b6d8d62e3a1dc9acae"}]}, 0x280}, 0x1, 0x0, 0x0, 0x20004051}, 0x80) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000c40), 0x2080, 0x0) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000000c80)='+++Z{\x00', &(0x7f0000000cc0)='/dev/audio\x00', 0x0) (async) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25029400000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) recvmmsg(r9, &(0x7f00000010c0)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000240)=""/210, 0xd2}, {&(0x7f0000000500)=""/130, 0x82}, {&(0x7f0000000e00)=""/197, 0xc5}, {&(0x7f00000001c0)=""/73, 0x49}, {&(0x7f0000000780)=""/164, 0xa4}, {&(0x7f00000018c0)=""/4082, 0xff2}, {&(0x7f00000012c0)=""/253, 0xfd}, {&(0x7f00000013c0)=""/175, 0xaf}], 0x8}, 0x2}, {{0x0, 0x0, 0x0}, 0x80000000}, {{0x0, 0x0, 0x0}, 0xf}], 0x3, 0x100, 0x0) 479.52552ms ago: executing program 3 (id=2614): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010800000000000000000700fffc0900010073797a300000000040000000030a01010000000000000000010000000900030073797a300000000014000480080002400000000008000140000000000900010073797a3000000000a0000000060a0104000000000000000001000000780004802c0001800e000100696d6d656469617465000000180002800c0002800500010034000000080001400000000d380001800c000100636f756e74657200280002800c00014000000000000000080c00024000000000000080000c0002400000000000000efb100001800a000100726564697200000008000b40000000000900010073797a30000000"], 0x128}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 399.836711ms ago: executing program 7 (id=2615): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000007000000080000000c00003f00000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00_'], 0x50) 315.793539ms ago: executing program 3 (id=2616): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x2280}], 0x1, 0x0, 0x0, 0x0) write$P9_RSTATu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1f0200000200000005dd000000040000000000000000200000000000000000008103000000000700000000000000000000001b00046e6f64ff150900000000000000c60005"], 0x21e) 275.514915ms ago: executing program 7 (id=2617): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000540)=ANY=[@ANYBLOB="50000000080211000001c5ddf59e00000807000000000000640001000006020202020202010882848b960c12182416f5f01ad734fb052bbe85de4da2e65c363f720a32aeba01b7241401b8b2561992d0cf279c56f8e969362838dcfb9bd084522ea96156c8bce5ae4f4277eb83d5f38e8cce8eaa3573a33ff0b311"], 0x36) (async) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000540)=ANY=[@ANYBLOB="50000000080211000001c5ddf59e00000807000000000000640001000006020202020202010882848b960c12182416f5f01ad734fb052bbe85de4da2e65c363f720a32aeba01b7241401b8b2561992d0cf279c56f8e969362838dcfb9bd084522ea96156c8bce5ae4f4277eb83d5f38e8cce8eaa3573a33ff0b311"], 0x36) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) (async) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x2000000, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000780)=@data_frame={@msdu=@type01={{0x0, 0x2, 0x6, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x4}, @device_a, @from_mac=@device_b, @device_a, {0x4, 0x1}, "", @void, @value=@ver_80211n={0x0, 0xb, 0x3, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}}, @random="eb705c890d3cce4daf2925bbe7f601405f7d76f939f9827b8e03ccf1d9775d67407ae88300a32acfc6b4617185f8bf247caf69abaf81503f22b4472034a6a2563cbf7619d32b5cc1d4a0126dedbbd38c7775644fc8fcf00b61aa4a1dce871643b778740123373473808d3fa36ae5ee21ecd090c9e57d03781f89d455e0d2b6802fff49a543b04d805c044d5cb878f9c32fa07cf2605a580a25afe3f02bd71d62052fdb3c1af91e06154d00d935a2f01a87e46fda88cf75644597a5a1880c2053330629d0c641fc72da403a5f9f168a11aa978773086be3f07b2d442f7c04593d6edd0e473304cf5b1bf135f82f1cc502049653200312d7ba6f6c3887bf28603a058c1b6407095d4b773c94b2b32c0d19a7e93f19d15b6bd0cec5d30b33b796c7cf4d609cce86e7475fe439996e93487c1701137db5fa1f3e85f6f6d2b2a9bc87abf7d02bed607d2fe895aff56b3e0d0f15373789c026217e3506cbce4e71688effe6ae329adc81ddb9e64feacdffa2d5480429124bd31dbfb2e9a2cda16febc832d8e4e11bee3d8cdc4ac14753bf4a8fde74a899813f6406287550969f2bc5f06acf0dd84bcc89d5f1b188cefddd7a86b18e0345dc5ee8ff9c1c7cf70691ea9ad19317c7469e2340b2e50a172e449c48d0ea0fbb68905c992adf757981bfd1af2d9605981c90e44d27c06954b1a9a0c44a55d1d03b97485ef60ad6b0d77458740ed2f23a783f65685ea13fb72fa7c99cbfd229ea32732c487fcc8a43e1519f7c9516a5253a91b3c371af82b219d89185bc3ce32e7e13872a38ab3beea0c7bb9faac13a19a140efe0f3e8ba86704cebea380dde9c5e19c876f0dbde70b6567df88071c145c68f73d0a85bc1b2c54fb1c70c75e0e72c1c5710e185d729612a67e24f30882ab676a3e474135a27c5609468779c8393636b2e5f40246bf6eef515874e548d7cc5de0139a63be33d5273b73d65ce1ed6d43bd8ea7f3ccf5756132132fe2690277d10d1698cdbbfe6ddf4b2d66b615cfc45491643ca873aebeae4c5cb471a8f536cb511b99e773b2df27a830050a98866f2759a0afd0bb1942bcf0ca5f32692ecca599d5dabf7e30c53c88edf597dad7a0aeea3ab000343c8c34ffafda2e8a3ef2c2fe50789"}, 0x345) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) (async) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r4, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r4, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r4, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000700)={'syzkaller0\x00', 0xca02}) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000740)={0x0, 'syzkaller0\x00', {0x1}, 0xb5}) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000b00)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) preadv(r5, &(0x7f0000000b40)=[{&(0x7f0000000b80)=""/30, 0x1e}], 0x1000000000000105, 0x402, 0x7c) syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) (async) r8 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)=[0x0], &(0x7f00000003c0), 0x0, 0x3e, 0x1}) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)=[0x0], &(0x7f00000003c0), 0x0, 0x3e, 0x1}) syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000500)) (async) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000500)) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$VIDIOC_QBUF(r9, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x1, 0x0, {}, {0x0, 0xb846941ed94b4582, 0x80, 0xc4, 0x0, 0xa, "a900"}, 0x2000000, 0x2, {}, 0x20800}) (async) ioctl$VIDIOC_QBUF(r9, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x1, 0x0, {}, {0x0, 0xb846941ed94b4582, 0x80, 0xc4, 0x0, 0xa, "a900"}, 0x2000000, 0x2, {}, 0x20800}) 0s ago: executing program 1 (id=2618): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="120100000000004032151d0100000000000109022400010000000109040008020300000009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x18, {[@local=@item_012={0x0, 0x2, 0x5}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x1, 0x1, 0x2, "ff"}, @local=@item_012={0x1, 0x2, 0x0, "04"}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @local=@item_012={0x1, 0x2, 0x0, "01"}, @main=@item_4={0x3, 0x0, 0x9, "20720e04"}, @global=@item_012={0x1, 0x1, 0x0, '\b'}, @global=@item_012={0x1, 0x1, 0x9, "01"}, @local=@item_012={0x1, 0x2, 0x0, "13"}, @main=@item_012={0x1, 0x0, 0x9, "02"}]}}, 0x0}, 0x0) (async) r1 = syz_usb_connect$rtl8150(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r1, &(0x7f0000000240)={0x14, &(0x7f0000000140)={0x0, 0x4, 0x7d, {0x7d, 0x4, "d0c54dc28f56984701079b9ed93e4f8366653ea3db014f0c0bacb41d3979519e7b1e70a811b416ef02f7e4a6c4019fc703b0bb5d9a6c8cf8d036ab00a08c428bf28e8c2d733915f41b4b705c02cb442f374ae2f4916f767ffb3ef769481cc3598442f46badad741b3449c8e1882437478480f0749b16c9fb44bcc5"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c0a}}}, &(0x7f0000000400)={0x2c, &(0x7f0000000280)={0x20, 0x6, 0x6c, "089a8e8cc213bdd4bca13f552b2391c60ff21e14c95b00a505c7e9c15f3d2cd89c47471c71de33d3f39fb7a79cbf59bb739d976421a55002599ca94c03b26d0e420575133c074d9111eda1b7ea276140443dad363667096af394b39a4b623b30eb5af0a23b244e646783abdc"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x98}, &(0x7f0000000380)={0xc0, 0x5, 0x5, "d87369ee2c"}, &(0x7f00000003c0)={0x40, 0x5, 0x2, "fde9"}}) kernel console output (not intermixed with test programs): my_hcd [ 367.139714][ T24] usb 6-1: device descriptor read/8, error -71 [ 367.158679][T13438] 8021q: adding VLAN 0 to HW filter on device bond1 [ 367.159378][T13438] bridge1: left promiscuous mode [ 367.194961][T13438] 8021q: adding VLAN 0 to HW filter on device bond2 [ 367.195439][T13438] gretap0: entered promiscuous mode [ 367.225158][T13438] 8021q: adding VLAN 0 to HW filter on device bond3 [ 367.267790][T13438] 8021q: adding VLAN 0 to HW filter on device bond5 [ 367.298065][ T8927] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 367.383983][ T24] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 367.405274][ T24] usb 6-1: device descriptor read/8, error -71 [ 367.514277][ T24] usb usb6-port1: unable to enumerate USB device [ 367.822697][T13471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.834754][T13471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.898997][T13474] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2215'. [ 368.345739][ T5672] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 368.499028][ T5672] usb 2-1: Using ep0 maxpacket: 32 [ 368.504044][ T5672] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 368.523698][ T5672] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 368.523821][ T5672] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 368.523840][ T5672] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 368.523882][ T5672] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 368.523901][ T5672] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 368.523921][ T5672] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 368.523940][ T5672] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 368.523959][ T5672] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 368.523997][ T5672] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.637571][ T5672] usb 2-1: config 0 descriptor?? [ 368.908553][ T5672] usblp 2-1:0.0: usblp1: USB Bidirectional printer dev 70 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 369.113342][T13492] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2217'. [ 369.603179][T13499] bond1: entered allmulticast mode [ 370.169478][T13509] bond6: entered allmulticast mode [ 371.218621][T13530] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 371.286542][T13533] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2229'. [ 371.554234][T13537] xt_CT: You must specify a L4 protocol and not use inversions on it [ 371.683953][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 372.100669][T13556] xt_nfacct: accounting object `syz0' does not exist [ 372.184361][ T5686] usb 6-1: new low-speed USB device number 24 using dummy_hcd [ 372.346179][ T5686] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 372.347141][ T5686] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 372.347170][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 372.347189][ T5686] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 372.347202][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 372.347215][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 372.348545][ T5686] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 372.348618][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 372.348633][ T5686] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 372.348646][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 372.348659][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 372.349825][ T5686] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 372.349851][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 372.349865][ T5686] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 372.349878][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 372.349891][ T5686] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 372.357539][ T5686] usb 6-1: string descriptor 0 read error: -22 [ 372.357664][ T5686] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.381993][ T5686] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux2 [ 372.624522][T13561] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2241'. [ 372.888724][ T5690] usb 6-1: USB disconnect, device number 24 [ 373.256734][T13577] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2247'. [ 373.970266][ T5734] usb 2-1: USB disconnect, device number 70 [ 373.999960][T13590] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2253'. [ 374.015806][ T5734] usblp1: removed [ 374.085297][T13595] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2256'. [ 374.320331][T13603] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 374.373451][ T8922] IPVS: starting estimator thread 0... [ 374.473941][T13605] IPVS: using max 35 ests per chain, 84000 per kthread [ 374.548932][ T30] audit: type=1326 audit(1792328592.898:1929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.548980][ T30] audit: type=1326 audit(1792328592.898:1930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.550022][ T30] audit: type=1326 audit(1792328592.898:1931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.550063][ T30] audit: type=1326 audit(1792328592.898:1932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.550098][ T30] audit: type=1326 audit(1792328592.898:1933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.550285][ T30] audit: type=1326 audit(1792328592.898:1934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.550572][ T30] audit: type=1326 audit(1792328592.898:1935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.550824][ T30] audit: type=1326 audit(1792328592.898:1936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.551031][ T30] audit: type=1326 audit(1792328592.898:1937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.551899][ T30] audit: type=1326 audit(1792328592.898:1938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13612 comm="syz.1.2261" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 374.774114][ T5690] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 374.873075][T13619] FAULT_INJECTION: forcing a failure. [ 374.873075][T13619] name failslab, interval 1, probability 0, space 0, times 0 [ 374.873110][T13619] CPU: 1 UID: 0 PID: 13619 Comm: syz.3.2263 Tainted: G L syzkaller #0 PREEMPT(full) [ 374.873134][T13619] Tainted: [L]=SOFTLOCKUP [ 374.873141][T13619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 374.873175][T13619] Call Trace: [ 374.873183][T13619] [ 374.873191][T13619] dump_stack_lvl+0xe8/0x150 [ 374.873222][T13619] should_fail_ex+0x410/0x560 [ 374.873253][T13619] should_failslab+0xa8/0x100 [ 374.873280][T13619] __kmalloc_cache_noprof+0xa3/0x600 [ 374.873302][T13619] ? nf_tables_newtable+0x43e/0x1990 [ 374.873322][T13619] ? nf_tables_newtable+0x43e/0x1990 [ 374.873348][T13619] nf_tables_newtable+0x43e/0x1990 [ 374.873387][T13619] nfnetlink_rcv+0x1288/0x28c0 [ 374.873438][T13619] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 374.873473][T13619] ? ref_tracker_free+0x689/0x830 [ 374.873521][T13619] ? skb_clone+0x246/0x3a0 [ 374.873545][T13619] ? __netlink_deliver_tap+0x811/0x860 [ 374.873575][T13619] ? netlink_deliver_tap+0x2e/0x1b0 [ 374.873596][T13619] ? netlink_deliver_tap+0x2e/0x1b0 [ 374.873624][T13619] netlink_unicast+0x8ef/0xa80 [ 374.873663][T13619] netlink_sendmsg+0x813/0xb40 [ 374.873693][T13619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 374.873722][T13619] ? apparmor_socket_sendmsg+0x98/0x360 [ 374.873746][T13619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 374.873765][T13619] sock_sendmsg_nosec+0x13a/0x180 [ 374.873791][T13619] ____sys_sendmsg+0x54e/0x850 [ 374.873814][T13619] ? __pfx_____sys_sendmsg+0x10/0x10 [ 374.873841][T13619] ? import_iovec+0x73/0xa0 [ 374.873859][T13619] ___sys_sendmsg+0x2a5/0x360 [ 374.873877][T13619] ? __lock_acquire+0x747/0x2de0 [ 374.873899][T13619] ? __pfx____sys_sendmsg+0x10/0x10 [ 374.873951][T13619] ? __fget_files+0x2a/0x420 [ 374.873968][T13619] ? __fget_files+0x3a2/0x420 [ 374.873994][T13619] __x64_sys_sendmsg+0x1b1/0x290 [ 374.874018][T13619] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 374.874057][T13619] do_syscall_64+0x166/0x520 [ 374.874078][T13619] ? trace_irq_disable+0x3b/0x140 [ 374.874097][T13619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.874115][T13619] ? clear_bhb_loop+0x70/0xc0 [ 374.874137][T13619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.874155][T13619] RIP: 0033:0x7f6653f9e559 [ 374.874179][T13619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 374.874194][T13619] RSP: 002b:00007f6654ea5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 374.874214][T13619] RAX: ffffffffffffffda RBX: 00007f6654225fa0 RCX: 00007f6653f9e559 [ 374.874228][T13619] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 374.874239][T13619] RBP: 00007f6654ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 374.874249][T13619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 374.874260][T13619] R13: 00007f6654226038 R14: 00007f6654225fa0 R15: 00007f665434fa48 [ 374.874290][T13619] [ 374.925236][ T5690] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 374.929597][ T5690] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.929620][ T5690] usb 3-1: Product: syz [ 374.929634][ T5690] usb 3-1: Manufacturer: syz [ 374.929647][ T5690] usb 3-1: SerialNumber: syz [ 374.954051][ T5686] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 375.113958][ T5686] usb 2-1: Using ep0 maxpacket: 16 [ 375.114913][ T5686] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 375.116564][ T5686] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 375.116594][ T5686] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 375.119375][ T5686] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.119408][ T5686] usb 2-1: Product: syz [ 375.119441][ T5686] usb 2-1: Manufacturer: syz [ 375.119454][ T5686] usb 2-1: SerialNumber: syz [ 375.123257][ T5686] usb 2-1: config 0 descriptor?? [ 375.139379][ T5686] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 375.139411][ T5686] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 375.325079][T13626] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2266'. [ 375.371701][ T5690] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 375.371766][ T5690] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 375.653810][ T5734] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 375.740596][ T5686] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 375.741355][ T5686] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 375.784324][T13635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 375.784933][T13635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 375.813262][ T5734] usb 6-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 375.826258][ T5734] usb 6-1: config 1 has an invalid interface number: 3 but max is 0 [ 375.826285][ T5734] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 375.826303][ T5734] usb 6-1: config 1 has no interface number 0 [ 375.859961][ T5734] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.859987][ T5734] usb 6-1: Product: syz [ 375.860001][ T5734] usb 6-1: Manufacturer: syz [ 375.860014][ T5734] usb 6-1: SerialNumber: syz [ 375.897260][ T5734] usb 6-1: cannot find UAC_HEADER [ 375.951900][ T5734] snd-usb-audio 6-1:1.3: probe with driver snd-usb-audio failed with error -22 [ 375.982867][ T6784] udevd[6784]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 376.088577][T13638] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2270'. [ 376.376235][ T5686] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 376.380265][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 376.381447][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 376.462198][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 376.464575][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 376.469728][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 376.705690][ T5690] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 376.708097][ T5690] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 376.756082][ T5690] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 376.833040][ T5690] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 376.894857][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 376.894873][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 376.894881][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 376.894888][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 376.894896][ T5686] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 376.910781][ T5690] usb 3-1: USB disconnect, device number 65 [ 376.918425][ T5686] usb 2-1: USB disconnect, device number 71 [ 377.377346][ T5734] usb 6-1: USB disconnect, device number 25 [ 377.817489][T13670] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2278'. [ 378.476111][T13683] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 378.476722][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.476774][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.528113][T13684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2279'. [ 378.531505][T13684] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2279'. [ 378.627202][ T5686] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 378.777258][ T5686] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 378.785694][ T5686] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.785718][ T5686] usb 4-1: Product: syz [ 378.785731][ T5686] usb 4-1: Manufacturer: syz [ 378.785744][ T5686] usb 4-1: SerialNumber: syz [ 378.943894][ T29] usb 2-1: new low-speed USB device number 72 using dummy_hcd [ 379.095232][ T29] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 379.098968][ T29] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 379.099013][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 379.099028][ T29] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 379.099058][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 379.099071][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 379.100096][ T29] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 379.100138][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 379.100162][ T29] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 379.100194][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 379.100207][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 379.101220][ T29] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 379.101261][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 379.101284][ T29] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 379.101297][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 379.101326][ T29] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 379.161000][ T29] usb 2-1: string descriptor 0 read error: -22 [ 379.161150][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.213258][ T29] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 379.239664][ T5686] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 379.239723][ T5686] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 379.398956][ T29] usb 2-1: USB disconnect, device number 72 [ 379.945417][ T5734] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 379.983807][ T5672] usb 6-1: new low-speed USB device number 26 using dummy_hcd [ 380.042088][T13706] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2290'. [ 380.095058][ T5734] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 380.096026][ T5734] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 380.096048][ T5734] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 380.097281][ T5734] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 380.097303][ T5734] usb 3-1: SerialNumber: syz [ 380.153754][ T5672] usb 6-1: New USB device found, idVendor=1223, idProduct=3f07, bcdDevice= 0.00 [ 380.156712][ T5672] usb 6-1: config 0 has an invalid interface descriptor of length 8, skipping [ 380.156732][ T5672] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 380.156749][ T5672] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 380.156783][ T5672] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.160083][ T5672] usb 6-1: config 0 descriptor?? [ 380.348494][T13696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.351248][T13696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.394542][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 380.395391][ T29] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 380.423655][ T4932] Bluetooth: hci0: hardware error 0x01 [ 380.545995][ T29] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 380.547279][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 380.547304][ T29] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 380.547325][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 380.547345][ T29] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 380.547404][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.558072][ T29] usb 2-1: config 0 descriptor?? [ 380.663030][ T5686] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 380.663110][ T5686] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 380.696093][ T5686] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 380.717989][ T5686] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 380.762891][ T5686] usb 4-1: USB disconnect, device number 66 [ 380.807469][ T29] hdpvr 2-1:0.0: firmware version 0x81 dated _$Ywїzr/ľj)7ݛt-- [ 380.807508][ T29] hdpvr 2-1:0.0: untested firmware, the driver might not work. [ 380.919409][T13723] xt_CT: You must specify a L4 protocol and not use inversions on it [ 380.978218][ T5734] usb 3-1: 0:2 : does not exist [ 381.005693][ T29] hdpvr 2-1:0.0: device init failed [ 381.005796][ T29] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12 [ 381.019037][ T29] usb 2-1: USB disconnect, device number 73 [ 381.096936][ T5734] usb 3-1: USB disconnect, device number 66 [ 381.160521][ T5625] udevd[5625]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 381.457494][T13741] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2302'. [ 381.522088][T13745] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2303'. [ 381.562411][T13738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.565456][T13738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.894026][ T5734] usb 4-1: new full-speed USB device number 67 using dummy_hcd [ 382.045691][ T5734] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 382.046640][ T5734] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 382.046677][ T5734] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 382.046702][ T5734] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 382.046723][ T5734] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 382.046751][ T5734] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 382.048733][ T5734] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 382.048754][ T5734] usb 4-1: Product: syz [ 382.048768][ T5734] usb 4-1: Manufacturer: syz [ 382.048813][ T5734] usb 4-1: SerialNumber: syz [ 382.051198][ T5734] usb 4-1: config 0 descriptor?? [ 382.221363][T13757] xt_ecn: cannot match TCP bits for non-tcp packets [ 382.257507][ T5734] radio-si470x 4-1:0.0: DeviceID=0xd6ba ChipID=0x0264 [ 382.458713][ T5734] radio-si470x 4-1:0.0: software version 214, hardware version 186 [ 382.477485][ T4932] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 382.660836][ T5734] radio-si470x 4-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 382.660888][ T5734] radio-si470x 4-1:0.0: submitting int urb failed (-90) [ 382.661306][ T5734] radio-si470x 4-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 382.661674][ T5734] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22 [ 382.705387][ T5734] usb 4-1: USB disconnect, device number 67 [ 382.749396][T13769] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2313'. [ 382.766849][ T5672] usb 6-1: string descriptor 0 read error: -71 [ 382.785021][ T5672] usb 6-1: USB disconnect, device number 26 [ 382.857759][T13773] FAULT_INJECTION: forcing a failure. [ 382.857759][T13773] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.857793][T13773] CPU: 0 UID: 0 PID: 13773 Comm: syz.5.2314 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.857818][T13773] Tainted: [L]=SOFTLOCKUP [ 382.857824][T13773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 382.857835][T13773] Call Trace: [ 382.857842][T13773] [ 382.857850][T13773] dump_stack_lvl+0xe8/0x150 [ 382.857881][T13773] should_fail_ex+0x410/0x560 [ 382.857911][T13773] _copy_from_iter+0x1d3/0x1660 [ 382.857947][T13773] ? __pfx__copy_from_iter+0x10/0x10 [ 382.857974][T13773] ? __kmalloc_node_track_caller_noprof+0x2eb/0x720 [ 382.857996][T13773] ? netlink_sendmsg+0x5d4/0xb40 [ 382.858018][T13773] ? netlink_sendmsg+0x5d4/0xb40 [ 382.858047][T13773] ? netlink_sendmsg+0x650/0xb40 [ 382.858069][T13773] ? skb_put+0x112/0x210 [ 382.858090][T13773] netlink_sendmsg+0x6c0/0xb40 [ 382.858120][T13773] ? __pfx_netlink_sendmsg+0x10/0x10 [ 382.858152][T13773] ? apparmor_socket_sendmsg+0x18b/0x360 [ 382.858179][T13773] ? __pfx_netlink_sendmsg+0x10/0x10 [ 382.858201][T13773] sock_sendmsg_nosec+0x13a/0x180 [ 382.858228][T13773] ____sys_sendmsg+0x54e/0x850 [ 382.858253][T13773] ? __pfx_____sys_sendmsg+0x10/0x10 [ 382.858282][T13773] ? import_iovec+0x73/0xa0 [ 382.858302][T13773] ___sys_sendmsg+0x2a5/0x360 [ 382.858320][T13773] ? __lock_acquire+0x747/0x2de0 [ 382.858343][T13773] ? __pfx____sys_sendmsg+0x10/0x10 [ 382.858390][T13773] ? __fget_files+0x2a/0x420 [ 382.858407][T13773] ? __fget_files+0x3a2/0x420 [ 382.858431][T13773] __x64_sys_sendmsg+0x1b1/0x290 [ 382.858454][T13773] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 382.858494][T13773] do_syscall_64+0x166/0x520 [ 382.858516][T13773] ? trace_irq_disable+0x3b/0x140 [ 382.858536][T13773] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.858553][T13773] ? clear_bhb_loop+0x70/0xc0 [ 382.858576][T13773] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.858594][T13773] RIP: 0033:0x7f831359e559 [ 382.858618][T13773] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 382.858634][T13773] RSP: 002b:00007f831438e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 382.858654][T13773] RAX: ffffffffffffffda RBX: 00007f8313825fa0 RCX: 00007f831359e559 [ 382.858667][T13773] RDX: 0000000020040054 RSI: 0000200000000940 RDI: 0000000000000004 [ 382.858679][T13773] RBP: 00007f831438e090 R08: 0000000000000000 R09: 0000000000000000 [ 382.858691][T13773] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 382.858703][T13773] R13: 00007f8313826038 R14: 00007f8313825fa0 R15: 00007f831394fa48 [ 382.858732][T13773] [ 382.860573][T13775] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2316'. [ 382.918104][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 382.918127][ T30] audit: type=1326 audit(1792328601.268:1945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13776 comm="syz.1.2317" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd4f6b9e559 code=0x0 [ 383.332055][T13791] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2323'. [ 383.455511][T13798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 383.457856][T13798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 383.458752][T13796] FAULT_INJECTION: forcing a failure. [ 383.458752][T13796] name failslab, interval 1, probability 0, space 0, times 0 [ 383.458781][T13796] CPU: 1 UID: 0 PID: 13796 Comm: syz.3.2326 Tainted: G L syzkaller #0 PREEMPT(full) [ 383.458804][T13796] Tainted: [L]=SOFTLOCKUP [ 383.458810][T13796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 383.458821][T13796] Call Trace: [ 383.458829][T13796] [ 383.458836][T13796] dump_stack_lvl+0xe8/0x150 [ 383.458865][T13796] should_fail_ex+0x410/0x560 [ 383.458883][T13796] should_failslab+0xa8/0x100 [ 383.458897][T13796] ? dst_alloc+0x105/0x170 [ 383.458911][T13796] kmem_cache_alloc_noprof+0xa1/0x600 [ 383.458924][T13796] ? dst_alloc+0x105/0x170 [ 383.458939][T13796] dst_alloc+0x105/0x170 [ 383.458954][T13796] xfrm_resolve_and_create_bundle+0x137e/0x33c0 [ 383.458985][T13796] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 383.459002][T13796] ? xfrm_policy_lookup_bytype+0x147/0x1840 [ 383.459023][T13796] ? xfrm_policy_lookup_bytype+0x147/0x1840 [ 383.459040][T13796] ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10 [ 383.459054][T13796] ? xfrm_expand_policies+0x489/0x740 [ 383.459071][T13796] xfrm_lookup_with_ifid+0x576/0x1db0 [ 383.459091][T13796] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 383.459106][T13796] ? txopt_get+0x343/0x3f0 [ 383.459119][T13796] ? __pfx_txopt_get+0x10/0x10 [ 383.459133][T13796] xfrm_lookup_route+0x3c/0x1c0 [ 383.459149][T13796] rawv6_sendmsg+0xdd0/0x18c0 [ 383.459170][T13796] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 383.459184][T13796] ? __lock_acquire+0x747/0x2de0 [ 383.459203][T13796] ? __lock_acquire+0x747/0x2de0 [ 383.459217][T13796] ? aa_sock_msg_perm+0xf5/0x210 [ 383.459231][T13796] ? sock_rps_record_flow+0x19/0x350 [ 383.459247][T13796] ? inet_sendmsg+0x298/0x320 [ 383.459260][T13796] ? apparmor_socket_sendmsg+0x98/0x360 [ 383.459274][T13796] ? __pfx_inet_sendmsg+0x10/0x10 [ 383.459287][T13796] sock_sendmsg_nosec+0x10e/0x180 [ 383.459302][T13796] ____sys_sendmsg+0x54e/0x850 [ 383.459316][T13796] ? __pfx_____sys_sendmsg+0x10/0x10 [ 383.459332][T13796] ? import_iovec+0x73/0xa0 [ 383.459344][T13796] ___sys_sendmsg+0x2a5/0x360 [ 383.459355][T13796] ? __lock_acquire+0x747/0x2de0 [ 383.459367][T13796] ? __pfx____sys_sendmsg+0x10/0x10 [ 383.459381][T13796] ? kstrtouint+0x6e/0xe0 [ 383.459407][T13796] ? __fget_files+0x2a/0x420 [ 383.459417][T13796] ? __fget_files+0x3a2/0x420 [ 383.459431][T13796] __sys_sendmmsg+0x273/0x4d0 [ 383.459445][T13796] ? __pfx___sys_sendmmsg+0x10/0x10 [ 383.459461][T13796] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 383.459480][T13796] ? ksys_write+0x242/0x270 [ 383.459492][T13796] ? __pfx_ksys_write+0x10/0x10 [ 383.459506][T13796] __x64_sys_sendmmsg+0xa0/0xc0 [ 383.459518][T13796] do_syscall_64+0x166/0x520 [ 383.459529][T13796] ? trace_irq_disable+0x3b/0x140 [ 383.459540][T13796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.459551][T13796] ? clear_bhb_loop+0x70/0xc0 [ 383.459569][T13796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.459579][T13796] RIP: 0033:0x7f6653f9e559 [ 383.459589][T13796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 383.459599][T13796] RSP: 002b:00007f6654ea5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 383.459611][T13796] RAX: ffffffffffffffda RBX: 00007f6654225fa0 RCX: 00007f6653f9e559 [ 383.459618][T13796] RDX: 00000000000002e9 RSI: 0000200000000480 RDI: 0000000000000003 [ 383.459625][T13796] RBP: 00007f6654ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 383.459632][T13796] R10: 000000000000ffe0 R11: 0000000000000246 R12: 0000000000000001 [ 383.459638][T13796] R13: 00007f6654226038 R14: 00007f6654225fa0 R15: 00007f665434fa48 [ 383.459654][T13796] [ 383.512595][T13800] netlink: 296 bytes leftover after parsing attributes in process `syz.5.2327'. [ 383.545201][ T5686] usb 3-1: new low-speed USB device number 67 using dummy_hcd [ 383.694708][ T5686] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 383.695911][ T5686] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 383.695963][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 383.695988][ T5686] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 383.696011][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 383.696033][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 383.697118][ T5686] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 383.697157][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 383.697180][ T5686] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 383.697203][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 383.697227][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 383.698274][ T5686] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 383.698314][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 383.698337][ T5686] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 383.698359][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 383.698382][ T5686] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 383.702751][ T5686] usb 3-1: string descriptor 0 read error: -22 [ 383.702871][ T5686] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.735429][ T5686] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 383.942243][ T5686] usb 3-1: USB disconnect, device number 67 [ 384.211216][T13816] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2335'. [ 384.281389][T13816] netlink: 'syz.0.2335': attribute type 10 has an invalid length. [ 384.281414][T13816] netlink: 55 bytes leftover after parsing attributes in process `syz.0.2335'. [ 384.305384][T13816] veth1_vlan (unregistering): left allmulticast mode [ 384.684179][ T5690] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 384.713673][T13842] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2345'. [ 384.713694][T13842] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2345'. [ 384.747151][T13844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 384.747586][T13844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.841554][ T5690] usb 2-1: Using ep0 maxpacket: 8 [ 384.842277][ T5690] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 384.843217][ T5690] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 384.850483][ T5690] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.850505][ T5690] usb 2-1: Product: syz [ 384.850518][ T5690] usb 2-1: Manufacturer: syz [ 384.850530][ T5690] usb 2-1: SerialNumber: syz [ 384.854761][ T5690] usb 2-1: config 0 descriptor?? [ 384.862988][ T5690] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 384.940747][T13857] netlink: 'syz.5.2348': attribute type 1 has an invalid length. [ 384.966880][T13857] 8021q: adding VLAN 0 to HW filter on device bond2 [ 384.973976][ T5686] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 385.004083][T13857] veth3: entered allmulticast mode [ 385.009856][T13857] bond2: (slave veth3): Enslaving as an active interface with a down link [ 385.027746][T13857] bond2: entered promiscuous mode [ 385.027761][T13857] bond2: entered allmulticast mode [ 385.123861][ T5686] usb 3-1: Using ep0 maxpacket: 8 [ 385.124638][ T5686] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 385.126169][ T5686] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 385.126216][ T5686] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 385.126241][ T5686] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 385.126300][ T5686] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 385.126325][ T5686] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 385.126346][ T5686] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 385.126385][ T5686] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.333482][ T5686] usb 3-1: usb_control_msg returned -71 [ 385.333560][ T5686] usbtmc 3-1:16.0: can't read capabilities [ 385.353084][T13866] FAULT_INJECTION: forcing a failure. [ 385.353084][T13866] name failslab, interval 1, probability 0, space 0, times 0 [ 385.353118][T13866] CPU: 0 UID: 0 PID: 13866 Comm: syz.3.2352 Tainted: G L syzkaller #0 PREEMPT(full) [ 385.353141][T13866] Tainted: [L]=SOFTLOCKUP [ 385.353147][T13866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 385.353156][T13866] Call Trace: [ 385.353164][T13866] [ 385.353171][T13866] dump_stack_lvl+0xe8/0x150 [ 385.353202][T13866] should_fail_ex+0x410/0x560 [ 385.353232][T13866] should_failslab+0xa8/0x100 [ 385.353259][T13866] __kvmalloc_node_noprof+0x176/0x820 [ 385.353283][T13866] ? __pfx_nft_select_set_ops+0x10/0x10 [ 385.353310][T13866] ? nf_tables_newset+0x134a/0x2570 [ 385.353329][T13866] ? nf_tables_newset+0x134a/0x2570 [ 385.353350][T13866] ? nft_set_lookup+0x121/0x150 [ 385.353382][T13866] nf_tables_newset+0x134a/0x2570 [ 385.353416][T13866] ? __pfx_nf_tables_newset+0x10/0x10 [ 385.353442][T13866] ? lock_acquire+0x115/0x350 [ 385.353473][T13866] ? __nla_parse+0x40/0x60 [ 385.353494][T13866] nfnetlink_rcv+0x1288/0x28c0 [ 385.353545][T13866] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 385.353580][T13866] ? ref_tracker_free+0x689/0x830 [ 385.353598][ T5686] usb 3-1: USB disconnect, device number 68 [ 385.353630][T13866] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 385.353652][T13866] ? rcu_preempt_deferred_qs_irqrestore+0x7b7/0xb90 [ 385.353691][T13866] netlink_unicast+0x8ef/0xa80 [ 385.353728][T13866] netlink_sendmsg+0x813/0xb40 [ 385.353758][T13866] ? __pfx_netlink_sendmsg+0x10/0x10 [ 385.353786][T13866] ? apparmor_socket_sendmsg+0x98/0x360 [ 385.353812][T13866] ? __pfx_netlink_sendmsg+0x10/0x10 [ 385.353833][T13866] sock_sendmsg_nosec+0x13a/0x180 [ 385.353859][T13866] ____sys_sendmsg+0x54e/0x850 [ 385.353884][T13866] ? __pfx_____sys_sendmsg+0x10/0x10 [ 385.353912][T13866] ? import_iovec+0x73/0xa0 [ 385.353934][T13866] ___sys_sendmsg+0x2a5/0x360 [ 385.353953][T13866] ? __lock_acquire+0x747/0x2de0 [ 385.353978][T13866] ? __pfx____sys_sendmsg+0x10/0x10 [ 385.354040][T13866] ? __fget_files+0x2a/0x420 [ 385.354058][T13866] ? __fget_files+0x3a2/0x420 [ 385.354089][T13866] __x64_sys_sendmsg+0x1b1/0x290 [ 385.354112][T13866] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 385.354152][T13866] do_syscall_64+0x166/0x520 [ 385.354173][T13866] ? trace_irq_disable+0x3b/0x140 [ 385.354192][T13866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.354209][T13866] ? clear_bhb_loop+0x70/0xc0 [ 385.354231][T13866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.354248][T13866] RIP: 0033:0x7f6653f9e559 [ 385.354266][T13866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 385.354281][T13866] RSP: 002b:00007f6654ea5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 385.354301][T13866] RAX: ffffffffffffffda RBX: 00007f6654225fa0 RCX: 00007f6653f9e559 [ 385.354314][T13866] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 385.354325][T13866] RBP: 00007f6654ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 385.354336][T13866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 385.354346][T13866] R13: 00007f6654226038 R14: 00007f6654225fa0 R15: 00007f665434fa48 [ 385.354375][T13866] [ 385.975584][T13884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 385.993655][T13884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 386.234116][ T5686] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 386.354298][ T29] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 386.385302][ T5686] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 386.393178][ T5686] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.393204][ T5686] usb 6-1: Product: syz [ 386.393217][ T5686] usb 6-1: Manufacturer: syz [ 386.393229][ T5686] usb 6-1: SerialNumber: syz [ 386.504623][ T29] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 386.505643][ T29] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 386.505665][ T29] usb 3-1: config 0 has no interfaces? [ 386.508292][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.508315][ T29] usb 3-1: Product: syz [ 386.508350][ T29] usb 3-1: Manufacturer: syz [ 386.508358][ T29] usb 3-1: SerialNumber: syz [ 386.512093][ T29] usb 3-1: config 0 descriptor?? [ 386.720506][T13893] netlink: 'syz.2.2360': attribute type 1 has an invalid length. [ 386.720523][T13893] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2360'. [ 386.721571][ T29] usb 3-1: USB disconnect, device number 69 [ 386.810184][T13903] batman_adv: batadv0: Interface deactivated: macvlan3 [ 386.810221][T13903] batman_adv: batadv0: Removing interface: macvlan3 [ 386.831330][ T5686] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 386.831368][ T5686] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 386.912038][ T5690] gspca_zc3xx: reg_r err -32 [ 387.494874][ T5690] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 387.494960][ T5690] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -32 [ 387.745861][T13930] bond6: entered allmulticast mode [ 387.970091][ T5672] usb 2-1: USB disconnect, device number 74 [ 388.074074][ T5734] usb 3-1: new low-speed USB device number 70 using dummy_hcd [ 388.199059][ T5686] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 388.199115][ T5686] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 388.199769][ T5686] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 388.254708][ T5734] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 388.256071][ T5734] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 388.256117][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 388.256140][ T5734] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 388.256162][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 388.256184][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 388.257377][ T5734] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 388.257418][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 388.257442][ T5734] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 388.257464][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 388.257485][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 388.258815][ T5734] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 388.258859][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 388.258883][ T5734] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 388.258906][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 388.258928][ T5734] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 388.259361][ T5686] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 388.263347][ T5734] usb 3-1: string descriptor 0 read error: -22 [ 388.263473][ T5734] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.302785][T13949] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2375'. [ 388.320065][ T5686] usb 6-1: USB disconnect, device number 27 [ 388.401230][T13955] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2375'. [ 388.498401][ T5734] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 388.629873][T13965] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2383'. [ 388.864070][ T5734] usb 3-1: USB disconnect, device number 70 [ 389.211401][T13972] syzkaller0: entered promiscuous mode [ 389.211424][T13972] syzkaller0: entered allmulticast mode [ 389.220279][T13972] tipc: Enabled bearer , priority 0 [ 389.233392][T13971] tipc: Resetting bearer [ 389.314816][T13971] tipc: Disabling bearer [ 389.370277][T13978] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 389.390903][ T30] audit: type=1326 audit(1792328607.738:1946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13977 comm="syz.3.2390" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6653f9e559 code=0x0 [ 389.853962][ T29] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 389.919078][T13974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 389.923626][T13974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 389.964046][ T5686] usb 4-1: new full-speed USB device number 68 using dummy_hcd [ 390.010394][T13999] usbtmc 1-1:16.0: send_request_dev_dep_msg_in returned -90 [ 390.010963][T13999] usbtmc 1-1:16.0: send_request_dev_dep_msg_in returned -90 [ 390.032646][ T29] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 390.042255][ T5690] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 390.052753][ T29] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 390.052774][ T29] usb 2-1: config 0 has no interfaces? [ 390.075372][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.075398][ T29] usb 2-1: Product: syz [ 390.075411][ T29] usb 2-1: Manufacturer: syz [ 390.075424][ T29] usb 2-1: SerialNumber: syz [ 390.108198][ T29] usb 2-1: config 0 descriptor?? [ 390.146395][ T5686] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 390.149228][ T5686] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 390.149259][ T5686] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 10 [ 390.149280][ T5686] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 390.149301][ T5686] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 65535, setting to 64 [ 390.210600][ T5686] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.210618][ T5686] usb 4-1: Product: syz [ 390.210625][ T5686] usb 4-1: Manufacturer: syz [ 390.210633][ T5686] usb 4-1: SerialNumber: syz [ 390.221303][ T5690] usb 3-1: Using ep0 maxpacket: 8 [ 390.245459][ T5686] usb 4-1: config 0 descriptor?? [ 390.266911][T14009] openvswitch: netlink: IP tunnel dst address not specified [ 390.337788][ T5690] usb 3-1: unable to get BOS descriptor or descriptor too short [ 390.337838][ T5690] usb 3-1: New USB device found, idVendor=2b73, idProduct=0013, bcdDevice= 1.40 [ 390.341581][ T5690] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 390.341639][ T5690] usb 3-1: can't read configurations, error -71 [ 390.378124][T13993] netlink: 'syz.1.2393': attribute type 1 has an invalid length. [ 390.378145][T13993] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2393'. [ 390.379280][ T5671] usb 2-1: USB disconnect, device number 75 [ 390.616672][T13315] IPVS: starting estimator thread 0... [ 390.621032][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.621395][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.621786][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.623004][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.623411][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.636961][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.637365][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.650100][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.681826][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.682184][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.682653][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.683421][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.704595][T14013] IPVS: using max 31 ests per chain, 74400 per kthread [ 390.708536][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.722126][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.722520][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.722876][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.723209][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.723594][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.755231][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.761650][ T5686] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 390.761711][ T5686] input input47: Timeout waiting for response from device. [ 390.785552][ T5686] usb 4-1: USB disconnect, device number 68 [ 391.276284][T13315] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.383925][ T5686] usb 2-1: new low-speed USB device number 76 using dummy_hcd [ 391.457960][T13315] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.554989][ T5686] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 391.575485][ T5686] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 391.575536][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 391.575559][ T5686] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 391.575581][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 391.575603][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 391.578218][ T5686] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 391.578262][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 391.578287][ T5686] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 391.578309][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 391.578331][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 391.581081][ T5686] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 391.581122][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 391.581144][ T5686] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 391.581165][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 391.581187][ T5686] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 391.612259][T14021] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2404'. [ 391.738404][ T5686] usb 2-1: string descriptor 0 read error: -22 [ 391.738526][ T5686] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.752290][T14019] ======================================================= [ 391.752290][T14019] WARNING: The mand mount option has been deprecated and [ 391.752290][T14019] and is ignored by this kernel. Remove the mand [ 391.752290][T14019] option from the mount to silence this warning. [ 391.752290][T14019] ======================================================= [ 391.831048][ T5686] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 391.943214][T13315] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.008569][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 392.010994][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 392.033091][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 392.041178][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 392.042043][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 392.086423][T14028] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2406'. [ 392.162996][T13315] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.029370][T13315] gretap0: left allmulticast mode [ 393.029395][T13315] gretap0: left promiscuous mode [ 393.032532][T13315] bridge0: port 3(gretap0) entered disabled state [ 393.058099][T13315] bridge_slave_1: left allmulticast mode [ 393.058125][T13315] bridge_slave_1: left promiscuous mode [ 393.058336][T13315] bridge0: port 2(bridge_slave_1) entered disabled state [ 393.110019][T13315] bridge_slave_0: left allmulticast mode [ 393.110046][T13315] bridge_slave_0: left promiscuous mode [ 393.110229][T13315] bridge0: port 1(bridge_slave_0) entered disabled state [ 393.275563][ T5672] usb 2-1: USB disconnect, device number 76 [ 393.535857][T13315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 393.542390][T13315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 393.545877][T13315] bond0 (unregistering): Released all slaves [ 393.556836][T13315] bond1 (unregistering): Released all slaves [ 393.578066][T13315] bond2 (unregistering): (slave veth3): Releasing active interface [ 393.579750][T13315] bond2 (unregistering): Released all slaves [ 393.606540][T14032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.607063][T14032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 394.073770][ T30] audit: type=1326 audit(1792328612.408:1947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14061 comm="syz.3.2413" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6653f9e559 code=0x0 [ 394.154915][ T4932] Bluetooth: hci4: command tx timeout [ 394.177783][T14059] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2407'. [ 394.585297][T14029] bridge0: port 1(bridge_slave_0) entered blocking state [ 394.585449][T14029] bridge0: port 1(bridge_slave_0) entered disabled state [ 394.585602][T14029] bridge_slave_0: entered allmulticast mode [ 394.593026][T14029] bridge_slave_0: entered promiscuous mode [ 394.602820][T14029] bridge0: port 2(bridge_slave_1) entered blocking state [ 394.602920][T14029] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.603048][T14029] bridge_slave_1: entered allmulticast mode [ 394.614079][T14029] bridge_slave_1: entered promiscuous mode [ 394.762822][T14029] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 394.778690][T14029] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 394.803398][T13315] hsr_slave_0: left promiscuous mode [ 394.810850][T13315] hsr_slave_1: left promiscuous mode [ 394.812282][T13315] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 394.812336][T13315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 394.834502][T13315] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 394.834524][T13315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 394.864658][T13315] veth1_macvtap: left promiscuous mode [ 394.864683][T13315] veth0_macvtap: left promiscuous mode [ 394.864739][T13315] veth1_vlan: left promiscuous mode [ 394.864777][T13315] veth0_vlan: left promiscuous mode [ 395.273826][ T5734] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 395.381116][T14087] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2419'. [ 395.424608][ T5734] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 395.427651][ T5734] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.427676][ T5734] usb 4-1: Product: syz [ 395.427689][ T5734] usb 4-1: Manufacturer: syz [ 395.427702][ T5734] usb 4-1: SerialNumber: syz [ 395.523467][T13315] team0 (unregistering): Port device team_slave_1 removed [ 395.529055][T14091] FAULT_INJECTION: forcing a failure. [ 395.529055][T14091] name failslab, interval 1, probability 0, space 0, times 0 [ 395.529086][T14091] CPU: 0 UID: 0 PID: 14091 Comm: syz.0.2421 Tainted: G L syzkaller #0 PREEMPT(full) [ 395.529111][T14091] Tainted: [L]=SOFTLOCKUP [ 395.529119][T14091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 395.529130][T14091] Call Trace: [ 395.529136][T14091] [ 395.529144][T14091] dump_stack_lvl+0xe8/0x150 [ 395.529174][T14091] should_fail_ex+0x410/0x560 [ 395.529204][T14091] should_failslab+0xa8/0x100 [ 395.529230][T14091] __kmalloc_cache_noprof+0xa3/0x600 [ 395.529252][T14091] ? __nft_trans_set_add+0x5e/0x710 [ 395.529274][T14091] ? __nft_trans_set_add+0x5e/0x710 [ 395.529303][T14091] __nft_trans_set_add+0x5e/0x710 [ 395.529331][T14091] nf_tables_newset+0x1d87/0x2570 [ 395.529363][T14091] ? __pfx_nf_tables_newset+0x10/0x10 [ 395.529389][T14091] ? lock_acquire+0x115/0x350 [ 395.529421][T14091] ? __nla_parse+0x40/0x60 [ 395.529443][T14091] nfnetlink_rcv+0x1288/0x28c0 [ 395.529495][T14091] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 395.529530][T14091] ? ref_tracker_free+0x689/0x830 [ 395.529579][T14091] ? skb_clone+0x246/0x3a0 [ 395.529602][T14091] ? __netlink_deliver_tap+0x811/0x860 [ 395.529638][T14091] ? netlink_deliver_tap+0x2e/0x1b0 [ 395.529661][T14091] ? netlink_deliver_tap+0x2e/0x1b0 [ 395.529688][T14091] netlink_unicast+0x8ef/0xa80 [ 395.529724][T14091] netlink_sendmsg+0x813/0xb40 [ 395.529755][T14091] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.529786][T14091] ? apparmor_socket_sendmsg+0x98/0x360 [ 395.529812][T14091] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.529834][T14091] sock_sendmsg_nosec+0x13a/0x180 [ 395.529861][T14091] ____sys_sendmsg+0x54e/0x850 [ 395.529886][T14091] ? __pfx_____sys_sendmsg+0x10/0x10 [ 395.529914][T14091] ? import_iovec+0x73/0xa0 [ 395.529934][T14091] ___sys_sendmsg+0x2a5/0x360 [ 395.529953][T14091] ? __lock_acquire+0x747/0x2de0 [ 395.529977][T14091] ? __pfx____sys_sendmsg+0x10/0x10 [ 395.530029][T14091] ? __fget_files+0x2a/0x420 [ 395.530045][T14091] ? __fget_files+0x3a2/0x420 [ 395.530071][T14091] __x64_sys_sendmsg+0x1b1/0x290 [ 395.530094][T14091] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 395.530133][T14091] do_syscall_64+0x166/0x520 [ 395.530154][T14091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.530173][T14091] ? clear_bhb_loop+0x70/0xc0 [ 395.530195][T14091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.530213][T14091] RIP: 0033:0x7f7bbd99e559 [ 395.530229][T14091] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 395.530244][T14091] RSP: 002b:00007f7bbe8e1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 395.530264][T14091] RAX: ffffffffffffffda RBX: 00007f7bbdc25fa0 RCX: 00007f7bbd99e559 [ 395.530277][T14091] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 395.530289][T14091] RBP: 00007f7bbe8e1090 R08: 0000000000000000 R09: 0000000000000000 [ 395.530300][T14091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 395.530311][T14091] R13: 00007f7bbdc26038 R14: 00007f7bbdc25fa0 R15: 00007f7bbdd4fa48 [ 395.530339][T14091] [ 395.646758][T13315] team0 (unregistering): Port device team_slave_0 removed [ 395.846851][ T5734] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 395.846909][ T5734] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 395.962737][ T5278] 8021q: adding VLAN 0 to HW filter on device eth5 [ 395.974751][T14029] team0: Port device team_slave_0 added [ 395.977905][T14029] team0: Port device team_slave_1 added [ 396.018729][T14029] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 396.018746][T14029] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 396.018767][T14029] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 396.020652][T14029] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 396.020664][T14029] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 396.020684][T14029] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 396.243247][ T4932] Bluetooth: hci4: command tx timeout [ 396.320377][T14102] IPVS: set_ctl: invalid protocol: 135 172.20.20.50:20000 [ 396.332710][T14102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 396.333516][T14102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 396.390430][T14029] hsr_slave_0: entered promiscuous mode [ 396.404669][T14029] hsr_slave_1: entered promiscuous mode [ 397.059337][T13315] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.173308][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 397.191658][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 397.204823][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 397.210431][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 397.211281][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 397.425278][ T5278] 8021q: adding VLAN 0 to HW filter on device eth6 [ 397.500520][T13315] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.674388][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 397.732946][T14134] netlink: 'syz.1.2431': attribute type 11 has an invalid length. [ 397.741305][T13315] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.796113][ T5734] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 397.796168][ T5734] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 397.796843][ T5734] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 397.808393][ T5734] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 397.834419][ T5734] usb 4-1: USB disconnect, device number 69 [ 397.909134][T14142] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2432'. [ 397.952396][T14029] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 397.967555][T14029] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 397.968062][T14029] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 397.981697][T14029] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 398.062378][T14029] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 398.095373][T14029] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 398.173680][T13315] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.202916][T14029] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 398.220006][T14029] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 398.315271][ T4932] Bluetooth: hci4: command tx timeout [ 398.827072][T14165] IPVS: set_ctl: invalid protocol: 135 172.20.20.50:20000 [ 399.008484][T13315] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 399.064187][ T5734] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 399.204189][T13315] batman_adv: batadv0: Removing interface: ip6gretap1 [ 399.225719][ T5734] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 399.226680][ T5734] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 399.226703][ T5734] usb 4-1: config 1 has no interface number 0 [ 399.229145][ T5734] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.229169][ T5734] usb 4-1: Product: syz [ 399.229183][ T5734] usb 4-1: Manufacturer: syz [ 399.229196][ T5734] usb 4-1: SerialNumber: syz [ 399.279346][ T4932] Bluetooth: hci3: command tx timeout [ 399.298782][ T5734] usb 4-1: 3:0 : does not exist [ 399.298804][ T5734] usb 4-1: 3:0 : does not exist [ 399.395441][T13315] bond0 (unregistering): (slave macvlan1): Releasing backup interface [ 399.398052][T13315] veth1_vlan: left allmulticast mode [ 399.399823][T13315] bond0 (unregistering): Released all slaves [ 399.432957][T13315] bond1 (unregistering): Released all slaves [ 399.455638][T13315] bond2 (unregistering): Released all slaves [ 399.463652][T13315] bond3 (unregistering): Released all slaves [ 399.483458][T13315] bond4 (unregistering): Released all slaves [ 399.499198][ T5686] usb 4-1: USB disconnect, device number 70 [ 399.535349][T13315] bond5 (unregistering): Released all slaves [ 399.570392][T13315] bond6 (unregistering): Released all slaves [ 399.592932][T13315] bond7 (unregistering): Released all slaves [ 399.654706][ T5278] 8021q: adding VLAN 0 to HW filter on device eth7 [ 399.694250][T14125] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.694358][T14125] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.694519][T14125] bridge_slave_0: entered allmulticast mode [ 399.696376][T14125] bridge_slave_0: entered promiscuous mode [ 399.699557][T14125] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.699757][T14125] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.699874][T14125] bridge_slave_1: entered allmulticast mode [ 399.704559][T14125] bridge_slave_1: entered promiscuous mode [ 399.829041][T14125] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 399.850909][T14125] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 399.978632][T14190] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2439'. [ 400.011876][T14184] bond4: option arp_validate: invalid value (9764865) [ 400.020447][T14184] bond4 (unregistering): Released all slaves [ 400.090217][T14125] team0: Port device team_slave_0 added [ 400.156719][T13315] ovs-dp0: left promiscuous mode [ 400.264080][T14125] team0: Port device team_slave_1 added [ 400.320260][T14125] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 400.320278][T14125] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 400.320533][T14125] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 400.389618][T14029] 8021q: adding VLAN 0 to HW filter on device bond0 [ 400.392434][T14125] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 400.392449][T14125] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 400.392473][T14125] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 400.395152][ T4932] Bluetooth: hci4: command tx timeout [ 400.438575][T13315] tipc: Left network mode [ 400.700180][T14125] hsr_slave_0: entered promiscuous mode [ 400.715906][T14125] hsr_slave_1: entered promiscuous mode [ 400.721642][T14125] debugfs: 'hsr0' already exists in 'hsr' [ 400.721663][T14125] Cannot create hsr debugfs directory [ 400.728849][T14029] 8021q: adding VLAN 0 to HW filter on device team0 [ 400.938641][ T5278] 8021q: adding VLAN 0 to HW filter on device eth8 [ 401.020306][ T8533] bridge0: port 1(bridge_slave_0) entered blocking state [ 401.020366][ T8533] bridge0: port 1(bridge_slave_0) entered forwarding state [ 401.106428][ T8932] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.106528][ T8932] bridge0: port 2(bridge_slave_1) entered forwarding state [ 401.248711][T13315] hsr_slave_0: left promiscuous mode [ 401.250615][T13315] hsr_slave_1: left promiscuous mode [ 401.299948][T13315] veth1_vlan: left promiscuous mode [ 401.300093][T13315] veth0_vlan: left promiscuous mode [ 401.353927][ T4932] Bluetooth: hci3: command tx timeout [ 401.639300][T14228] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2445'. [ 401.639454][T14231] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2448'. [ 401.706213][T14236] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2445'. [ 402.527171][T14242] netlink: 'syz.1.2449': attribute type 10 has an invalid length. [ 402.695496][T14245] IPVS: set_ctl: invalid protocol: 135 172.20.20.50:20000 [ 402.792113][T13315] IPVS: stop unused estimator thread 0... [ 402.945083][ T5671] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 403.018040][T14029] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 403.106032][ T5671] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 403.106958][ T5671] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 403.106973][ T5671] usb 4-1: config 1 has no interface number 0 [ 403.109473][ T5671] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.109495][ T5671] usb 4-1: Product: syz [ 403.109509][ T5671] usb 4-1: Manufacturer: syz [ 403.109522][ T5671] usb 4-1: SerialNumber: syz [ 403.179105][ T5671] usb 4-1: 3:0 : does not exist [ 403.179120][ T5671] usb 4-1: 3:0 : does not exist [ 403.414686][ T5734] usb 4-1: USB disconnect, device number 71 [ 403.435213][ T4932] Bluetooth: hci3: command tx timeout [ 403.574480][T14029] veth0_vlan: entered promiscuous mode [ 403.604630][T14125] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 403.632230][T14125] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 403.632818][T14029] veth1_vlan: entered promiscuous mode [ 403.642471][T14125] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 403.662413][T14125] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 403.672752][T14125] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 403.690689][T14125] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 403.713071][T14125] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 403.722844][T14125] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 403.837479][T14269] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2454'. [ 403.879126][ T5278] 8021q: adding VLAN 0 to HW filter on device eth9 [ 403.923409][T14029] veth0_macvtap: entered promiscuous mode [ 403.945160][T14029] veth1_macvtap: entered promiscuous mode [ 404.021253][T14029] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 404.063549][T14029] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 404.122154][T14282] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2457'. [ 404.351110][ T8533] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.351879][ T8533] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.383074][T14125] 8021q: adding VLAN 0 to HW filter on device bond0 [ 404.388477][T13315] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.388598][T13315] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.590241][ T8927] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 404.590255][ T8927] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 404.602063][T14125] 8021q: adding VLAN 0 to HW filter on device team0 [ 404.641690][ T8533] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.641788][ T8533] bridge0: port 1(bridge_slave_0) entered forwarding state [ 404.820924][ T8533] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.820986][ T8533] bridge0: port 2(bridge_slave_1) entered forwarding state [ 404.871287][ T8533] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 404.871302][ T8533] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.052202][T14310] binder: 14309:14310 ioctl 80045430 7f6654ea4f8c returned -22 [ 405.514076][ T4932] Bluetooth: hci3: command tx timeout [ 405.523444][ T5278] 8021q: adding VLAN 0 to HW filter on device eth10 [ 405.604744][ T30] audit: type=1804 audit(1792328623.948:1948): pid=14322 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.2464" name="/newroot/499/file1" dev="tmpfs" ino=2588 res=1 errno=0 [ 405.837413][T13904] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 405.922637][T14125] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 405.986433][T13904] usb 7-1: Using ep0 maxpacket: 8 [ 405.988501][T13904] usb 7-1: New USB device found, idVendor=07ab, idProduct=fc01, bcdDevice=73.6f [ 405.989359][T13904] usb 7-1: config 2 has an invalid interface number: 65 but max is 0 [ 405.989379][T13904] usb 7-1: config 2 has no interface number 0 [ 405.989403][T13904] usb 7-1: config 2 interface 65 has no altsetting 0 [ 406.000930][T13904] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.000954][T13904] usb 7-1: Product: syz [ 406.000968][T13904] usb 7-1: Manufacturer: syz [ 406.000981][T13904] usb 7-1: SerialNumber: syz [ 406.221749][T14332] IPVS: set_ctl: invalid protocol: 135 172.20.20.50:20000 [ 406.253405][T13904] ums-freecom 7-1:2.65: USB Mass Storage device detected [ 406.312800][T14125] veth0_vlan: entered promiscuous mode [ 406.368197][T14125] veth1_vlan: entered promiscuous mode [ 406.504192][ T5686] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 406.517385][T13904] usb 7-1: USB disconnect, device number 2 [ 406.622759][T14125] veth0_macvtap: entered promiscuous mode [ 406.651783][T14125] veth1_macvtap: entered promiscuous mode [ 406.666085][ T5686] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 406.681778][ T5686] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 406.681803][ T5686] usb 4-1: config 1 has no interface number 0 [ 406.692189][ T5686] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.692216][ T5686] usb 4-1: Product: syz [ 406.692230][ T5686] usb 4-1: Manufacturer: syz [ 406.692252][ T5686] usb 4-1: SerialNumber: syz [ 406.750744][ T5686] usb 4-1: 3:0 : does not exist [ 406.750768][ T5686] usb 4-1: 3:0 : does not exist [ 406.774507][T14125] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 406.820836][T14125] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 406.863938][ T8533] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.864475][ T8533] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.864509][ T8533] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.864539][ T8533] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 407.044431][T14332] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 407.108430][T14348] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2465'. [ 407.133489][T14348] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2465'. [ 407.139972][ T5686] usb 4-1: USB disconnect, device number 72 [ 407.319106][ T8927] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 407.319128][ T8927] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 407.333311][ T5278] 8021q: adding VLAN 0 to HW filter on device eth11 [ 407.376410][ T5625] udevd[5625]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 407.478381][ T8533] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 407.478403][ T8533] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 407.851717][T14352] xt_nfacct: accounting object `syz0' does not exist [ 407.959542][T14373] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2425'. [ 408.112681][T14376] fuse: Unknown parameter 'rootcontext' [ 408.904243][ T9] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 408.959987][T14404] FAULT_INJECTION: forcing a failure. [ 408.959987][T14404] name failslab, interval 1, probability 0, space 0, times 0 [ 408.960020][T14404] CPU: 1 UID: 0 PID: 14404 Comm: syz.7.2478 Tainted: G L syzkaller #0 PREEMPT(full) [ 408.960045][T14404] Tainted: [L]=SOFTLOCKUP [ 408.960052][T14404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 408.960063][T14404] Call Trace: [ 408.960071][T14404] [ 408.960079][T14404] dump_stack_lvl+0xe8/0x150 [ 408.960119][T14404] should_fail_ex+0x410/0x560 [ 408.960151][T14404] should_failslab+0xa8/0x100 [ 408.960179][T14404] __kvmalloc_node_noprof+0x176/0x820 [ 408.960204][T14404] ? __kvmalloc_node_noprof+0x345/0x820 [ 408.960226][T14404] ? io_alloc_cache_init+0x42/0x140 [ 408.960247][T14404] ? io_alloc_cache_init+0x42/0x140 [ 408.960273][T14404] io_alloc_cache_init+0x42/0x140 [ 408.960296][T14404] io_ring_ctx_alloc+0x527/0xb80 [ 408.960321][T14404] io_uring_create+0x50/0x990 [ 408.960352][T14404] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 408.960377][T14404] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 408.960402][T14404] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 408.960439][T14404] ? __pfx_ksys_write+0x10/0x10 [ 408.960468][T14404] do_syscall_64+0x166/0x520 [ 408.960488][T14404] ? trace_irq_disable+0x3b/0x140 [ 408.960508][T14404] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.960526][T14404] ? clear_bhb_loop+0x70/0xc0 [ 408.960547][T14404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.960566][T14404] RIP: 0033:0x7fbac039e559 [ 408.960584][T14404] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 408.960598][T14404] RSP: 002b:00007fbac125fee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 408.960617][T14404] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007fbac039e559 [ 408.960631][T14404] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 408.960645][T14404] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 408.960657][T14404] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 408.960668][T14404] R13: 0000200000000890 R14: 00007fbac125ffd8 R15: 0000000000000000 [ 408.960696][T14404] [ 409.080756][ T9] usb 7-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 409.101963][ T5278] 8021q: adding VLAN 0 to HW filter on device eth12 [ 409.143538][ T9] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 409.143565][ T9] usb 7-1: config 0 has no interfaces? [ 409.216596][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.216613][ T9] usb 7-1: Product: syz [ 409.216621][ T9] usb 7-1: Manufacturer: syz [ 409.216628][ T9] usb 7-1: SerialNumber: syz [ 409.261831][ T9] usb 7-1: config 0 descriptor?? [ 409.466102][ T24] usb 2-1: new full-speed USB device number 77 using dummy_hcd [ 409.480265][T14395] sit0: entered promiscuous mode [ 409.492936][T14395] netlink: 'syz.6.2476': attribute type 1 has an invalid length. [ 409.492958][T14395] netlink: 1 bytes leftover after parsing attributes in process `syz.6.2476'. [ 409.500056][ T5686] usb 7-1: USB disconnect, device number 3 [ 409.557100][T14418] IPVS: set_ctl: invalid protocol: 135 172.20.20.50:20000 [ 409.559104][T14418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.561661][T14418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.586606][T13904] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 409.612171][T14418] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 409.745394][T13904] usb 8-1: Using ep0 maxpacket: 32 [ 409.746627][T13904] usb 8-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 409.750976][T13904] usb 8-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 409.751023][T13904] usb 8-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 409.751048][T13904] usb 8-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 409.751096][T13904] usb 8-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 409.753521][T13904] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.753544][T13904] usb 8-1: Product: syz [ 409.753565][T13904] usb 8-1: Manufacturer: syz [ 409.753600][T13904] usb 8-1: SerialNumber: syz [ 409.789797][ C1] imon 8-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 409.807647][T14423] usb usb7: usbfs: process 14423 (syz.1.2477) did not claim interface 0 before use [ 409.909086][T13904] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:155.0/input/input48 [ 409.997355][T13904] imon 8-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 409.997371][T13904] (id 0x00) [ 410.084209][T13904] rc_core: IR keymap rc-imon-pad not found [ 410.084253][T13904] Registered IR keymap rc-empty [ 410.084467][T13904] imon 8-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 410.084486][T13904] imon 8-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 410.195236][T13904] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:155.0/rc/rc0 [ 410.209199][T13904] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:155.0/rc/rc0/input49 [ 410.232305][T13904] imon 8-1:155.0: iMON device (15c2:ffdc, intf0) on usb<8:2> initialized [ 411.019550][T14458] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2491'. [ 411.444852][ T9] usb 4-1: new low-speed USB device number 73 using dummy_hcd [ 411.605610][ T9] usb 4-1: Invalid ep0 maxpacket: 16 [ 411.734289][ T9] usb 4-1: new low-speed USB device number 74 using dummy_hcd [ 411.836824][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 411.837636][ T24] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 411.842398][ T24] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 411.842431][ T24] usb 2-1: can't read configurations, error -71 [ 411.893787][ T9] usb 4-1: Invalid ep0 maxpacket: 16 [ 411.893997][ T9] usb usb4-port1: attempt power cycle [ 411.938287][T14470] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2496'. [ 412.244185][ T9] usb 4-1: new low-speed USB device number 75 using dummy_hcd [ 412.267861][ T9] usb 4-1: Invalid ep0 maxpacket: 16 [ 412.305922][ T5671] usb 8-1: USB disconnect, device number 2 [ 412.407603][ T9] usb 4-1: new low-speed USB device number 76 using dummy_hcd [ 412.436632][ T9] usb 4-1: Invalid ep0 maxpacket: 16 [ 412.436905][ T9] usb usb4-port1: unable to enumerate USB device [ 413.511812][T14504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.522378][T14504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.603285][T14510] xt_CT: You must specify a L4 protocol and not use inversions on it [ 413.743843][ T5671] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 413.904372][ T5671] usb 7-1: Using ep0 maxpacket: 32 [ 413.905171][ T5671] usb 7-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 413.906261][ T5671] usb 7-1: config 0 has an invalid interface number: 85 but max is 0 [ 413.906285][ T5671] usb 7-1: config 0 has no interface number 0 [ 413.906324][ T5671] usb 7-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 413.906350][ T5671] usb 7-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 413.906371][ T5671] usb 7-1: config 0 interface 85 has no altsetting 0 [ 413.911526][ T5671] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.911549][ T5671] usb 7-1: Product: syz [ 413.911563][ T5671] usb 7-1: Manufacturer: syz [ 413.911576][ T5671] usb 7-1: SerialNumber: syz [ 413.972940][ T5671] usb 7-1: config 0 descriptor?? [ 414.195257][T14526] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2511'. [ 414.201284][T14526] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2511'. [ 414.462905][T14504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 414.474964][T14504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 414.493815][ T9] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 414.500000][ T5671] appletouch 7-1:0.85: Failed to request geyser raw mode [ 414.500211][ T5671] appletouch 7-1:0.85: probe with driver appletouch failed with error -5 [ 414.556318][ T5671] usb 7-1: USB disconnect, device number 4 [ 414.653780][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 414.654593][ T9] usb 8-1: New USB device found, idVendor=0582, idProduct=e6ca, bcdDevice=d3.0b [ 414.655579][ T9] usb 8-1: config 3 has an invalid interface number: 45 but max is 0 [ 414.655603][ T9] usb 8-1: config 3 contains an unexpected descriptor of type 0x1, skipping [ 414.655621][ T9] usb 8-1: config 3 has no interface number 0 [ 414.655667][ T9] usb 8-1: config 3 interface 45 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 414.655692][ T9] usb 8-1: config 3 interface 45 has no altsetting 0 [ 414.657972][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.657995][ T9] usb 8-1: Product: syz [ 414.658009][ T9] usb 8-1: Manufacturer: syz [ 414.658022][ T9] usb 8-1: SerialNumber: syz [ 414.907076][T14542] FAULT_INJECTION: forcing a failure. [ 414.907076][T14542] name failslab, interval 1, probability 0, space 0, times 0 [ 414.907111][T14542] CPU: 1 UID: 0 PID: 14542 Comm: syz.3.2522 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.907146][T14542] Tainted: [L]=SOFTLOCKUP [ 414.907153][T14542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 414.907164][T14542] Call Trace: [ 414.907173][T14542] [ 414.907181][T14542] dump_stack_lvl+0xe8/0x150 [ 414.907213][T14542] should_fail_ex+0x410/0x560 [ 414.907245][T14542] should_failslab+0xa8/0x100 [ 414.907273][T14542] __kvmalloc_node_noprof+0x176/0x820 [ 414.907298][T14542] ? __kvmalloc_node_noprof+0x345/0x820 [ 414.907321][T14542] ? io_alloc_cache_init+0x42/0x140 [ 414.907343][T14542] ? io_alloc_cache_init+0x42/0x140 [ 414.907372][T14542] io_alloc_cache_init+0x42/0x140 [ 414.907398][T14542] io_ring_ctx_alloc+0x56a/0xb80 [ 414.907425][T14542] io_uring_create+0x50/0x990 [ 414.907457][T14542] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 414.907483][T14542] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 414.907509][T14542] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 414.907549][T14542] ? __pfx_ksys_write+0x10/0x10 [ 414.907581][T14542] do_syscall_64+0x166/0x520 [ 414.907602][T14542] ? trace_irq_disable+0x3b/0x140 [ 414.907622][T14542] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.907641][T14542] ? clear_bhb_loop+0x70/0xc0 [ 414.907665][T14542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.907682][T14542] RIP: 0033:0x7f6653f9e559 [ 414.907699][T14542] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 414.907715][T14542] RSP: 002b:00007f6654ea4ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 414.907736][T14542] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007f6653f9e559 [ 414.907750][T14542] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 414.907763][T14542] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 414.907776][T14542] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 414.907789][T14542] R13: 0000200000000890 R14: 00007f6654ea4fd8 R15: 0000000000000000 [ 414.907818][T14542] [ 415.308960][T14561] bond4: entered allmulticast mode [ 415.367067][T14566] FAULT_INJECTION: forcing a failure. [ 415.367067][T14566] name failslab, interval 1, probability 0, space 0, times 0 [ 415.367101][T14566] CPU: 1 UID: 0 PID: 14566 Comm: syz.1.2530 Tainted: G L syzkaller #0 PREEMPT(full) [ 415.367127][T14566] Tainted: [L]=SOFTLOCKUP [ 415.367134][T14566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 415.367145][T14566] Call Trace: [ 415.367154][T14566] [ 415.367163][T14566] dump_stack_lvl+0xe8/0x150 [ 415.367196][T14566] should_fail_ex+0x410/0x560 [ 415.367236][T14566] should_failslab+0xa8/0x100 [ 415.367262][T14566] ? radix_tree_node_alloc+0x82/0x3a0 [ 415.367284][T14566] kmem_cache_alloc_noprof+0xa1/0x600 [ 415.367308][T14566] ? radix_tree_node_alloc+0x82/0x3a0 [ 415.367336][T14566] radix_tree_node_alloc+0x82/0x3a0 [ 415.367364][T14566] idr_get_free+0x28f/0xa10 [ 415.367398][T14566] idr_alloc_u32+0x18a/0x330 [ 415.367425][T14566] ? __pfx_idr_alloc_u32+0x10/0x10 [ 415.367453][T14566] ? tcf_idr_check_alloc+0xc8/0x7f0 [ 415.367483][T14566] tcf_idr_check_alloc+0x623/0x7f0 [ 415.367508][T14566] ? tcf_idr_check_alloc+0xc8/0x7f0 [ 415.367536][T14566] ? __pfx_tcf_idr_check_alloc+0x10/0x10 [ 415.367566][T14566] ? __nla_parse+0x40/0x60 [ 415.367590][T14566] tcf_police_init+0x274/0x15d0 [ 415.367620][T14566] ? __pfx_stack_trace_save+0x10/0x10 [ 415.367642][T14566] ? __pfx_tcf_police_init+0x10/0x10 [ 415.367663][T14566] ? __lock_acquire+0x747/0x2de0 [ 415.367688][T14566] ? kasan_save_track+0x4f/0x80 [ 415.367711][T14566] ? kmem_cache_alloc_noprof+0x2b9/0x600 [ 415.367729][T14566] ? radix_tree_node_alloc+0x82/0x3a0 [ 415.367758][T14566] ? do_syscall_64+0x166/0x520 [ 415.367779][T14566] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.367814][T14566] tcf_action_init_1+0x2be/0x740 [ 415.367840][T14566] ? __pfx_tcf_action_init_1+0x10/0x10 [ 415.367859][T14566] ? _raw_read_unlock+0x28/0x50 [ 415.367878][T14566] ? tc_action_load_ops+0x247/0x540 [ 415.367914][T14566] ? radix_tree_node_alloc+0x82/0x3a0 [ 415.367934][T14566] ? kmem_cache_alloc_noprof+0x156/0x600 [ 415.367964][T14566] tcf_exts_validate_ex+0x2ea/0x540 [ 415.367993][T14566] ? __pfx_tcf_exts_validate_ex+0x10/0x10 [ 415.368034][T14566] ? __pfx_idr_alloc_u32+0x10/0x10 [ 415.368063][T14566] tcf_exts_validate+0x42/0x60 [ 415.368090][T14566] cls_bpf_change+0x500/0xd80 [ 415.368128][T14566] ? __pfx_cls_bpf_change+0x10/0x10 [ 415.368177][T14566] tc_new_tfilter+0x1324/0x1900 [ 415.368234][T14566] ? __pfx_tc_new_tfilter+0x10/0x10 [ 415.368275][T14566] ? lock_acquire+0x115/0x350 [ 415.368312][T14566] ? __pfx_tc_new_tfilter+0x10/0x10 [ 415.368335][T14566] rtnetlink_rcv_msg+0x802/0xc00 [ 415.368361][T14566] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 415.368380][T14566] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 415.368401][T14566] ? __lock_acquire+0x747/0x2de0 [ 415.368434][T14566] netlink_rcv_skb+0x226/0x4a0 [ 415.368460][T14566] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 415.368482][T14566] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 415.368520][T14566] ? netlink_deliver_tap+0x2e/0x1b0 [ 415.368543][T14566] ? netlink_deliver_tap+0x2e/0x1b0 [ 415.368572][T14566] netlink_unicast+0x8ef/0xa80 [ 415.368612][T14566] netlink_sendmsg+0x813/0xb40 [ 415.368646][T14566] ? __pfx_netlink_sendmsg+0x10/0x10 [ 415.368679][T14566] ? apparmor_socket_sendmsg+0x18b/0x360 [ 415.368708][T14566] ? __pfx_netlink_sendmsg+0x10/0x10 [ 415.368730][T14566] sock_sendmsg_nosec+0x13a/0x180 [ 415.368761][T14566] ____sys_sendmsg+0x54e/0x850 [ 415.368788][T14566] ? __pfx_____sys_sendmsg+0x10/0x10 [ 415.368820][T14566] ? import_iovec+0x73/0xa0 [ 415.368842][T14566] ___sys_sendmsg+0x2a5/0x360 [ 415.368863][T14566] ? __lock_acquire+0x747/0x2de0 [ 415.368888][T14566] ? __pfx____sys_sendmsg+0x10/0x10 [ 415.368947][T14566] ? __fget_files+0x2a/0x420 [ 415.368964][T14566] ? __fget_files+0x3a2/0x420 [ 415.368992][T14566] __x64_sys_sendmsg+0x1b1/0x290 [ 415.369017][T14566] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 415.369062][T14566] do_syscall_64+0x166/0x520 [ 415.369083][T14566] ? trace_irq_disable+0x3b/0x140 [ 415.369103][T14566] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.369122][T14566] ? clear_bhb_loop+0x70/0xc0 [ 415.369146][T14566] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.369164][T14566] RIP: 0033:0x7fd4f6b9e559 [ 415.369182][T14566] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 415.369198][T14566] RSP: 002b:00007fd4f7acd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 415.369219][T14566] RAX: ffffffffffffffda RBX: 00007fd4f6e25fa0 RCX: 00007fd4f6b9e559 [ 415.369240][T14566] RDX: 0000000020040054 RSI: 0000200000000940 RDI: 0000000000000004 [ 415.369252][T14566] RBP: 00007fd4f7acd090 R08: 0000000000000000 R09: 0000000000000000 [ 415.369264][T14566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 415.369276][T14566] R13: 00007fd4f6e26038 R14: 00007fd4f6e25fa0 R15: 00007fd4f6f4fa48 [ 415.369305][T14566] [ 415.949488][T14587] FAULT_INJECTION: forcing a failure. [ 415.949488][T14587] name failslab, interval 1, probability 0, space 0, times 0 [ 415.949522][T14587] CPU: 0 UID: 0 PID: 14587 Comm: syz.3.2536 Tainted: G L syzkaller #0 PREEMPT(full) [ 415.949548][T14587] Tainted: [L]=SOFTLOCKUP [ 415.949555][T14587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 415.949568][T14587] Call Trace: [ 415.949576][T14587] [ 415.949585][T14587] dump_stack_lvl+0xe8/0x150 [ 415.949617][T14587] should_fail_ex+0x410/0x560 [ 415.949648][T14587] should_failslab+0xa8/0x100 [ 415.949674][T14587] ? alloc_empty_file+0x5b/0x1d0 [ 415.949708][T14587] kmem_cache_alloc_noprof+0xa1/0x600 [ 415.949732][T14587] ? alloc_empty_file+0x5b/0x1d0 [ 415.949763][T14587] alloc_empty_file+0x5b/0x1d0 [ 415.949789][T14587] alloc_file_pseudo+0x115/0x1e0 [ 415.949817][T14587] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 415.949841][T14587] ? security_inode_alloc+0xd5/0x310 [ 415.949862][T14587] ? inode_init_always_gfp+0x994/0xd30 [ 415.949894][T14587] sock_alloc_file+0xb8/0x2e0 [ 415.949922][T14587] do_accept+0x3a0/0x750 [ 415.949954][T14587] ? __pfx_do_accept+0x10/0x10 [ 415.950002][T14587] __sys_accept4+0x139/0x230 [ 415.950047][T14587] ? __pfx___sys_accept4+0x10/0x10 [ 415.950074][T14587] ? __pfx_ksys_write+0x10/0x10 [ 415.950101][T14587] __x64_sys_accept4+0x9a/0xb0 [ 415.950130][T14587] do_syscall_64+0x166/0x520 [ 415.950150][T14587] ? trace_irq_disable+0x3b/0x140 [ 415.950170][T14587] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.950189][T14587] ? clear_bhb_loop+0x70/0xc0 [ 415.950213][T14587] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.950231][T14587] RIP: 0033:0x7f6653f9e559 [ 415.950249][T14587] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 415.950266][T14587] RSP: 002b:00007f6654ea5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 415.950286][T14587] RAX: ffffffffffffffda RBX: 00007f6654225fa0 RCX: 00007f6653f9e559 [ 415.950300][T14587] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 415.950312][T14587] RBP: 00007f6654ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 415.950325][T14587] R10: 0000000000080800 R11: 0000000000000246 R12: 0000000000000001 [ 415.950337][T14587] R13: 00007f6654226038 R14: 00007f6654225fa0 R15: 00007f665434fa48 [ 415.950367][T14587] [ 416.125212][ T24] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 416.211412][T14593] xt_nfacct: accounting object `syz0' does not exist [ 416.274073][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 416.278930][ T24] usb 2-1: New USB device found, idVendor=0499, idProduct=1034, bcdDevice= 0.40 [ 416.280875][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 113, changing to 7 [ 416.280905][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 416.280933][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 416.288808][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.288832][ T24] usb 2-1: Product: 㸥෸㢁죝蝤さ⍨銾䤻摚燂쮃甝塠玺ශﭛꀴ몼⼄ٸ槣䓞ꌹ偻覝죃花뀨當蝯ᆒ峏䑒띷䡍王덤ꨒ飉骖㱩✱ܨ直̩湶뎾䥁唟쬀ꌏ簾恖磮厵殶㉸舵⺛๑纚ꦋ鮊嚝䆆⍵ᾚ끿筌꥓蕫␺ﰱ渾꾆┻뫘ץ킔䜿̅둇䮥縔럻紳旋령샩ᏼ핁ヾ䨏紣㋞虳醼藸뇕朋 [ 416.288861][ T24] usb 2-1: Manufacturer: ᭛契毉赛牧쀰ⵗ⇙龬鲈콊ϗ᪖笌玬뛈読⼅ꆩ邍젯ⰽ䜍瀙쇥뒼咓į︝댖䱌백虰㻯쳸麪呿럃甉뽄먃鱧 [ 416.288881][ T24] usb 2-1: SerialNumber: Г [ 416.505879][T14605] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2542'. [ 416.563906][ T5349] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 416.591545][T14609] netlink: 272 bytes leftover after parsing attributes in process `syz.0.2543'. [ 416.661086][T14612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.661578][T14612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.702430][T14612] syzkaller1: entered promiscuous mode [ 416.702453][T14612] syzkaller1: entered allmulticast mode [ 416.718458][ T5349] usb 7-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=d1.6e [ 416.721673][ T5349] usb 7-1: config 54 has an invalid descriptor of length 0, skipping remainder of the config [ 416.725207][ T5349] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.725230][ T5349] usb 7-1: Product: syz [ 416.725243][ T5349] usb 7-1: Manufacturer: syz [ 416.725279][ T5349] usb 7-1: SerialNumber: syz [ 416.755025][ T5349] dvb-usb: found a 'Hanftek UMT-010 DVB-T USB2.0' in warm state. [ 416.755148][ T5349] dvb-usb: bulk message failed: -22 (3/0) [ 416.761897][ T24] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 416.797529][ T5349] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 416.803495][ T5349] dvbdev: DVB: registering new adapter (Hanftek UMT-010 DVB-T USB2.0) [ 416.803530][ T5349] usb 7-1: media controller created [ 416.862418][ T5349] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 416.941866][ T24] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 416.960335][T14581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.963623][T14581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.969710][T14600] dvb-usb: bulk message failed: -22 (2/0) [ 416.969770][T14600] dvb-usb: bulk message failed: -22 (4/0) [ 416.973039][T14618] dvb-usb: bulk message failed: -22 (2/0) [ 416.973103][T14618] dvb-usb: bulk message failed: -22 (4/0) [ 417.062156][ T5349] DVB: Unable to find symbol mt352_attach() [ 417.062172][ T5349] dvb-usb: no frontend was attached by 'Hanftek UMT-010 DVB-T USB2.0' [ 417.071217][ T5349] dvb-usb: bulk message failed: -22 (3/0) [ 417.074097][ T6762] udevd[6762]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 417.084073][ T5349] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 successfully initialized and connected. [ 417.091417][ T5349] usb 7-1: USB disconnect, device number 5 [ 417.148599][ T5349] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 successfully deinitialized and disconnected. [ 417.283338][ T9] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 417.362272][ T9] usb 8-1: USB disconnect, device number 3 [ 417.399799][T14628] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2547'. [ 417.482444][ T5800] udevd[5800]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:3.45/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 417.834961][ T9] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 417.843915][ T5349] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 417.926534][T14643] FAULT_INJECTION: forcing a failure. [ 417.926534][T14643] name failslab, interval 1, probability 0, space 0, times 0 [ 417.926558][T14643] CPU: 1 UID: 0 PID: 14643 Comm: syz.3.2553 Tainted: G L syzkaller #0 PREEMPT(full) [ 417.926573][T14643] Tainted: [L]=SOFTLOCKUP [ 417.926577][T14643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 417.926583][T14643] Call Trace: [ 417.926588][T14643] [ 417.926593][T14643] dump_stack_lvl+0xe8/0x150 [ 417.926613][T14643] should_fail_ex+0x410/0x560 [ 417.926631][T14643] should_failslab+0xa8/0x100 [ 417.926647][T14643] __kvmalloc_node_noprof+0x176/0x820 [ 417.926661][T14643] ? __kvmalloc_node_noprof+0x345/0x820 [ 417.926673][T14643] ? io_alloc_cache_init+0x42/0x140 [ 417.926685][T14643] ? io_alloc_cache_init+0x42/0x140 [ 417.926700][T14643] io_alloc_cache_init+0x42/0x140 [ 417.926713][T14643] io_ring_ctx_alloc+0x57d/0xb80 [ 417.926728][T14643] io_uring_create+0x50/0x990 [ 417.926745][T14643] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 417.926759][T14643] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 417.926774][T14643] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 417.926794][T14643] ? __pfx_ksys_write+0x10/0x10 [ 417.926811][T14643] do_syscall_64+0x166/0x520 [ 417.926822][T14643] ? trace_irq_disable+0x3b/0x140 [ 417.926834][T14643] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.926845][T14643] ? clear_bhb_loop+0x70/0xc0 [ 417.926857][T14643] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.926867][T14643] RIP: 0033:0x7f6653f9e559 [ 417.926883][T14643] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 417.926893][T14643] RSP: 002b:00007f6654ea4ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 417.926905][T14643] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007f6653f9e559 [ 417.926913][T14643] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 417.926920][T14643] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 417.926927][T14643] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 417.926934][T14643] R13: 0000200000000890 R14: 00007f6654ea4fd8 R15: 0000000000000000 [ 417.926950][T14643] [ 417.994918][ T5349] usb 7-1: New USB device found, idVendor=04d9, idProduct=a04a, bcdDevice= 0.00 [ 418.001395][ T5349] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 418.001421][ T5349] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 418.001438][ T5349] usb 7-1: config 0 has no interface number 0 [ 418.001474][ T5349] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 418.001498][ T5349] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 418.001519][ T5349] usb 7-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 418.001556][ T5349] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.012340][ T5349] usb 7-1: config 0 descriptor?? [ 418.039661][ T9] usb 8-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 418.067565][ T9] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 418.067592][ T9] usb 8-1: config 0 has no interfaces? [ 418.159330][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.159357][ T9] usb 8-1: Product: syz [ 418.159369][ T9] usb 8-1: Manufacturer: syz [ 418.159381][ T9] usb 8-1: SerialNumber: syz [ 418.293992][T14634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 418.294485][T14634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.294580][ T9] usb 8-1: config 0 descriptor?? [ 418.501116][T14632] sit0: entered promiscuous mode [ 418.504767][ T5349] usbhid 7-1:0.1: can't add hid device: -71 [ 418.504879][ T5349] usbhid 7-1:0.1: probe with driver usbhid failed with error -71 [ 418.514510][ T5349] usb 7-1: USB disconnect, device number 6 [ 418.531468][T14632] netlink: 'syz.7.2549': attribute type 1 has an invalid length. [ 418.531555][T14632] netlink: 1 bytes leftover after parsing attributes in process `syz.7.2549'. [ 418.538341][ T24] usb 8-1: USB disconnect, device number 4 [ 418.819575][T14649] xt_nfacct: accounting object `syz0' does not exist [ 418.878065][ T24] usb 2-1: USB disconnect, device number 79 [ 419.137337][T14659] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2559'. [ 419.163633][T14661] xt_nfacct: accounting object `syz0' does not exist [ 419.265940][ T5349] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 419.271649][T14669] bridge_slave_0: left allmulticast mode [ 419.271666][T14669] bridge_slave_0: left promiscuous mode [ 419.271788][T14669] bridge0: port 1(bridge_slave_0) entered disabled state [ 419.307546][T14669] bridge_slave_1: left allmulticast mode [ 419.307563][T14669] bridge_slave_1: left promiscuous mode [ 419.307683][T14669] bridge0: port 2(bridge_slave_1) entered disabled state [ 419.337777][T14669] bond0: (slave bond_slave_0): Releasing backup interface [ 419.369600][T14669] bond0: (slave bond_slave_1): Releasing backup interface [ 419.374162][ T24] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 419.415596][T14669] team0: Port device team_slave_0 removed [ 419.417386][ T5349] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 419.419579][ T5349] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 419.421623][ T5349] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.421646][ T5349] usb 4-1: Product: syz [ 419.421659][ T5349] usb 4-1: Manufacturer: syz [ 419.421671][ T5349] usb 4-1: SerialNumber: syz [ 419.432400][ T5349] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 419.487273][T14669] team0: Port device team_slave_1 removed [ 419.487863][T14669] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 419.487877][T14669] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 419.499744][T14669] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 419.505094][T14669] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.519146][T14669] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 419.526743][ T24] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 419.527899][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 419.527923][ T24] usb 2-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 419.527959][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 419.528000][ T24] usb 2-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 419.528023][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 419.530118][ T24] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 419.530140][ T24] usb 2-1: Product: syz [ 419.530153][ T24] usb 2-1: Manufacturer: syz [ 419.563311][ T24] cdc_wdm 2-1:1.0: skipping garbage [ 419.563331][ T24] cdc_wdm 2-1:1.0: skipping garbage [ 419.563430][ T24] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 419.761903][ T30] audit: type=1326 audit(1792328638.108:1949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.761937][ T30] audit: type=1326 audit(1792328638.108:1950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.762754][ T30] audit: type=1326 audit(1792328638.108:1951): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.762782][ T30] audit: type=1326 audit(1792328638.108:1952): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.764291][ T30] audit: type=1326 audit(1792328638.108:1953): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.764336][ T30] audit: type=1326 audit(1792328638.118:1954): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.764372][ T30] audit: type=1326 audit(1792328638.118:1955): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.764791][ T30] audit: type=1326 audit(1792328638.118:1956): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.764851][ T30] audit: type=1326 audit(1792328638.118:1957): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd4f6b9e559 code=0x7ffc0000 [ 419.766112][ T30] audit: type=1326 audit(1792328638.118:1958): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14651 comm="syz.1.2556" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd4f6b5ed8e code=0x7ffc0000 [ 419.818988][T14652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.819446][T14652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 420.030224][ T5349] gspca_mr97310a: reg read [21] error -71 [ 420.030329][ T5349] mr97310a 4-1:1.0: probe with driver mr97310a failed with error -71 [ 420.060184][ T5349] usb 4-1: USB disconnect, device number 77 [ 420.097684][ T24] usb 2-1: USB disconnect, device number 80 [ 420.871807][T14718] ip6t_hbh: Not strict - not implemented [ 421.197295][T14710] bond1: entered allmulticast mode [ 421.241984][T14720] bond0: (slave veth0_to_bond): Releasing active interface [ 421.256391][T14720] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 421.715901][T14755] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2583'. [ 421.922930][ T9] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 421.954199][ T5671] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 422.077582][ T9] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 422.078793][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 422.078815][ T9] usb 2-1: config 0 has no interfaces? [ 422.081471][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.081494][ T9] usb 2-1: Product: syz [ 422.081508][ T9] usb 2-1: Manufacturer: syz [ 422.081530][ T9] usb 2-1: SerialNumber: syz [ 422.084964][ T5671] usb 7-1: device descriptor read/64, error -71 [ 422.093445][ T9] usb 2-1: config 0 descriptor?? [ 422.255433][T14774] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2586'. [ 422.306048][T14747] netlink: 'syz.1.2582': attribute type 1 has an invalid length. [ 422.306079][T14747] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2582'. [ 422.307157][ T9] usb 2-1: USB disconnect, device number 81 [ 422.337050][ T5671] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 422.464858][ T5671] usb 7-1: device descriptor read/64, error -71 [ 422.575541][ T5671] usb usb7-port1: attempt power cycle [ 422.698535][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 422.716166][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 422.720774][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 422.723140][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 422.729976][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 422.924920][ T5671] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 422.944760][ T5671] usb 7-1: device descriptor read/8, error -71 [ 423.119045][T14797] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 423.204739][ T5671] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 423.224453][ T5671] usb 7-1: device descriptor read/8, error -71 [ 423.225781][T14795] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2587'. [ 423.251691][T14795] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2587'. [ 423.335591][ T5671] usb usb7-port1: unable to enumerate USB device [ 423.629845][ T5349] usb 1-1: USB disconnect, device number 4 [ 424.070862][ T8533] bond0 (unregistering): Released all slaves [ 424.079785][ T8533] bond1 (unregistering): Released all slaves [ 424.092777][ T8533] bond2 (unregistering): Released all slaves [ 424.123549][ T8533] bond3 (unregistering): Released all slaves [ 424.137512][ T8533] bond4 (unregistering): Released all slaves [ 424.159623][ T8533] bond5 (unregistering): Released all slaves [ 424.189313][ T8533] bond6 (unregistering): Released all slaves [ 424.226793][ T8927] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.227056][ T8922] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.227093][ T8922] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.301352][T13315] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.598363][T14791] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.598537][T14791] bridge0: port 1(bridge_slave_0) entered disabled state [ 424.598683][T14791] bridge_slave_0: entered allmulticast mode [ 424.602029][T14791] bridge_slave_0: entered promiscuous mode [ 424.621543][T14852] FAULT_INJECTION: forcing a failure. [ 424.621543][T14852] name failslab, interval 1, probability 0, space 0, times 0 [ 424.621586][T14852] CPU: 0 UID: 0 PID: 14852 Comm: syz.7.2602 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.621611][T14852] Tainted: [L]=SOFTLOCKUP [ 424.621618][T14852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 424.621633][T14852] Call Trace: [ 424.621644][T14852] [ 424.621652][T14852] dump_stack_lvl+0xe8/0x150 [ 424.621684][T14852] should_fail_ex+0x410/0x560 [ 424.621715][T14852] should_failslab+0xa8/0x100 [ 424.621742][T14852] __kvmalloc_node_noprof+0x176/0x820 [ 424.621766][T14852] ? __kvmalloc_node_noprof+0x345/0x820 [ 424.621788][T14852] ? io_alloc_cache_init+0x42/0x140 [ 424.621808][T14852] ? io_alloc_cache_init+0x42/0x140 [ 424.621836][T14852] io_alloc_cache_init+0x42/0x140 [ 424.621860][T14852] io_rsrc_cache_init+0x43/0x50 [ 424.621879][T14852] io_ring_ctx_alloc+0x588/0xb80 [ 424.621905][T14852] io_uring_create+0x50/0x990 [ 424.621936][T14852] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 424.621960][T14852] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 424.621983][T14852] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 424.622022][T14852] ? __pfx_ksys_write+0x10/0x10 [ 424.622058][T14852] do_syscall_64+0x166/0x520 [ 424.622079][T14852] ? trace_irq_disable+0x3b/0x140 [ 424.622099][T14852] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.622118][T14852] ? clear_bhb_loop+0x70/0xc0 [ 424.622140][T14852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.622158][T14852] RIP: 0033:0x7fbac039e559 [ 424.622175][T14852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 424.622193][T14852] RSP: 002b:00007fbac125fee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 424.622213][T14852] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007fbac039e559 [ 424.622227][T14852] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 424.622239][T14852] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 424.622251][T14852] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 424.622264][T14852] R13: 0000200000000890 R14: 00007fbac125ffd8 R15: 0000000000000000 [ 424.622292][T14852] [ 424.760403][T14791] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.760525][T14791] bridge0: port 2(bridge_slave_1) entered disabled state [ 424.760671][T14791] bridge_slave_1: entered allmulticast mode [ 424.773370][T14791] bridge_slave_1: entered promiscuous mode [ 424.876491][ T4932] Bluetooth: hci5: command tx timeout [ 424.997656][T14791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 425.005364][T14863] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2606'. [ 425.006163][T14863] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2606'. [ 425.019518][T14791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 425.076503][T14866] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2605'. [ 425.255180][T14791] team0: Port device team_slave_0 added [ 425.325620][T14791] team0: Port device team_slave_1 added [ 425.350371][T14873] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2607'. [ 425.350407][T14873] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2607'. [ 425.606949][ T8533] tipc: Disabling bearer [ 425.607450][ T8533] tipc: Left network mode [ 425.791268][T14791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 425.791285][T14791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 425.791385][T14791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 425.860503][T14889] FAULT_INJECTION: forcing a failure. [ 425.860503][T14889] name failslab, interval 1, probability 0, space 0, times 0 [ 425.860537][T14889] CPU: 1 UID: 0 PID: 14889 Comm: syz.7.2609 Tainted: G L syzkaller #0 PREEMPT(full) [ 425.860562][T14889] Tainted: [L]=SOFTLOCKUP [ 425.860572][T14889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 425.860583][T14889] Call Trace: [ 425.860591][T14889] [ 425.860599][T14889] dump_stack_lvl+0xe8/0x150 [ 425.860631][T14889] should_fail_ex+0x410/0x560 [ 425.860664][T14889] should_failslab+0xa8/0x100 [ 425.860690][T14889] __kmalloc_noprof+0xfe/0x720 [ 425.860701][T14889] ? rcu_is_watching+0x16/0xb0 [ 425.860715][T14889] ? tomoyo_realpath_from_path+0xef/0x640 [ 425.860726][T14889] ? tomoyo_realpath_from_path+0xef/0x640 [ 425.860740][T14889] tomoyo_realpath_from_path+0xef/0x640 [ 425.860755][T14889] ? tomoyo_path_number_perm+0x219/0x5f0 [ 425.860769][T14889] tomoyo_path_number_perm+0x246/0x5f0 [ 425.860784][T14889] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 425.860799][T14889] ? __lock_acquire+0x747/0x2de0 [ 425.860833][T14889] ? hook_file_ioctl+0x1f2/0x600 [ 425.860876][T14889] ? __fget_files+0x2a/0x420 [ 425.860898][T14889] ? __fget_files+0x2a/0x420 [ 425.860914][T14889] ? __fget_files+0x3a2/0x420 [ 425.860930][T14889] ? __fget_files+0x2a/0x420 [ 425.860948][T14889] security_file_ioctl+0xc3/0x2a0 [ 425.860964][T14889] __se_sys_ioctl+0x47/0x170 [ 425.860978][T14889] do_syscall_64+0x166/0x520 [ 425.860990][T14889] ? trace_irq_disable+0x3b/0x140 [ 425.861002][T14889] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.861012][T14889] ? clear_bhb_loop+0x70/0xc0 [ 425.861025][T14889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.861035][T14889] RIP: 0033:0x7fbac039e559 [ 425.861046][T14889] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.861056][T14889] RSP: 002b:00007fbac123f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 425.861068][T14889] RAX: ffffffffffffffda RBX: 00007fbac0626090 RCX: 00007fbac039e559 [ 425.861076][T14889] RDX: 0000200000000840 RSI: 0000000000003b8e RDI: 0000000000000008 [ 425.861083][T14889] RBP: 00007fbac123f090 R08: 0000000000000000 R09: 0000000000000000 [ 425.861091][T14889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 425.861100][T14889] R13: 00007fbac0626128 R14: 00007fbac0626090 R15: 00007fbac074fa48 [ 425.861119][T14889] [ 425.902836][T14889] ERROR: Out of memory at tomoyo_realpath_from_path. [ 426.160581][T14791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 426.160593][T14791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 426.160609][T14791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 426.618447][T14791] hsr_slave_0: entered promiscuous mode [ 426.620609][T14791] hsr_slave_1: entered promiscuous mode [ 426.621094][T14791] debugfs: 'hsr0' already exists in 'hsr' [ 426.621113][T14791] Cannot create hsr debugfs directory [ 426.963823][ T4932] Bluetooth: hci5: command tx timeout [ 426.966029][T14902] ip_tables: iptables: counters copy to user failed while replacing table [ 427.368019][ T8533] veth1_macvtap: left promiscuous mode [ 427.369318][ T8533] veth0_macvtap: left promiscuous mode [ 427.493911][ T9] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 427.648801][ T9] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 427.650043][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 427.650065][ T9] usb 2-1: config 0 has no interfaces? [ 427.652497][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.652512][ T9] usb 2-1: Product: syz [ 427.652520][ T9] usb 2-1: Manufacturer: syz [ 427.652528][ T9] usb 2-1: SerialNumber: syz [ 427.701271][ T9] usb 2-1: config 0 descriptor?? [ 428.000103][T14909] netlink: 'syz.1.2611': attribute type 1 has an invalid length. [ 428.000128][T14909] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2611'. [ 428.002518][T13904] usb 2-1: USB disconnect, device number 82 [ 428.504976][T14937] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 428.532400][ T8533] IPVS: stop unused estimator thread 0... [ 428.576499][T14937] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 428.635927][T14940] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 428.904289][ T5664] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 428.938020][T14791] ================================================================== [ 428.938035][T14791] BUG: KASAN: null-ptr-deref in netlink_has_listeners+0x3d/0x3f0 [ 428.938074][T14791] Read of size 8 at addr 0000000000000578 by task syz-executor/14791 [ 428.938090][T14791] [ 428.938103][T14791] CPU: 1 UID: 0 PID: 14791 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 428.938127][T14791] Tainted: [L]=SOFTLOCKUP [ 428.938134][T14791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 428.938145][T14791] Call Trace: [ 428.938152][T14791] [ 428.938161][T14791] dump_stack_lvl+0xe8/0x150 [ 428.938188][T14791] ? netlink_has_listeners+0x3d/0x3f0 [ 428.938208][T14791] kasan_report+0x117/0x150 [ 428.938233][T14791] ? netlink_has_listeners+0x3d/0x3f0 [ 428.938257][T14791] kasan_check_range+0x264/0x2c0 [ 428.938284][T14791] netlink_has_listeners+0x3d/0x3f0 [ 428.938306][T14791] devlink_port_notify+0x18c/0x520 [ 428.938332][T14791] ? work_grab_pending+0x3d1/0x930 [ 428.938358][T14791] ? __pfx_devlink_port_notify+0x10/0x10 [ 428.938386][T14791] ? lockdep_hardirqs_on+0x7b/0x110 [ 428.938407][T14791] ? enable_work+0x1fd/0x230 [ 428.938427][T14791] devl_port_unregister+0x13e/0x2a0 [ 428.938455][T14791] __nsim_dev_port_del+0x1ad/0x200 [ 428.938475][T14791] nsim_dev_reload_destroy+0x288/0x490 [ 428.938495][T14791] nsim_drv_remove+0x58/0x170 [ 428.938513][T14791] ? __pfx_nsim_bus_remove+0x10/0x10 [ 428.938536][T14791] device_release_driver_internal+0x48b/0x880 [ 428.938567][T14791] bus_remove_device+0x444/0x560 [ 428.938590][T14791] ? __pfx_bus_remove_device+0x10/0x10 [ 428.938613][T14791] ? kernfs_remove_by_name_ns+0x101/0x140 [ 428.938639][T14791] device_del+0x524/0x8f0 [ 428.938662][T14791] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 428.938686][T14791] ? __pfx_device_del+0x10/0x10 [ 428.938711][T14791] ? lock_acquire+0x115/0x350 [ 428.938732][T14791] device_unregister+0x21/0xf0 [ 428.938761][T14791] del_device_store+0x2b5/0x370 [ 428.938786][T14791] ? __pfx_del_device_store+0x10/0x10 [ 428.938810][T14791] ? sysfs_file_kobj+0x1e4/0x230 [ 428.938828][T14791] ? sysfs_kf_write+0x166/0x260 [ 428.938847][T14791] ? __pfx_sysfs_kf_write+0x10/0x10 [ 428.938864][T14791] kernfs_fop_write_iter+0x3a4/0x540 [ 428.938890][T14791] vfs_write+0x612/0xba0 [ 428.938913][T14791] ? __pfx_vfs_write+0x10/0x10 [ 428.938931][T14791] ? do_sys_openat2+0x14e/0x200 [ 428.938955][T14791] ? kmem_cache_free+0x182/0x650 [ 428.938984][T14791] ksys_write+0x150/0x270 [ 428.939003][T14791] ? __pfx_ksys_write+0x10/0x10 [ 428.939025][T14791] do_syscall_64+0x166/0x520 [ 428.939046][T14791] ? trace_irq_disable+0x3b/0x140 [ 428.939072][T14791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.939090][T14791] ? clear_bhb_loop+0x70/0xc0 [ 428.939109][T14791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.939127][T14791] RIP: 0033:0x7f2ea595ed8e [ 428.939143][T14791] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 428.939159][T14791] RSP: 002b:00007f2ea5d4f1f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 428.939179][T14791] RAX: ffffffffffffffda RBX: 0000555595308500 RCX: 00007f2ea595ed8e [ 428.939194][T14791] RDX: 0000000000000001 RSI: 00007f2ea5d4f280 RDI: 0000000000000005 [ 428.939206][T14791] RBP: 00007f2ea5a3637c R08: 0000000000000000 R09: 0000000000000000 [ 428.939218][T14791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 428.939230][T14791] R13: 00007f2ea5d4f280 R14: 00007f2ea5d4fac0 R15: 0000000000000003 [ 428.939251][T14791] [ 428.939258][T14791] ================================================================== [ 428.939309][T14791] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 429.299234][T14791] CPU: 1 UID: 0 PID: 14791 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 429.310335][T14791] Tainted: [L]=SOFTLOCKUP [ 429.314643][T14791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 429.324684][T14791] Call Trace: [ 429.327952][T14791] [ 429.330872][T14791] vpanic+0x56d/0xa60 [ 429.334854][T14791] ? __pfx_vpanic+0x10/0x10 [ 429.339353][T14791] panic+0xc5/0xd0 [ 429.343074][T14791] ? __pfx_panic+0x10/0x10 [ 429.347489][T14791] ? netlink_has_listeners+0x3d/0x3f0 [ 429.352860][T14791] ? netlink_has_listeners+0x3d/0x3f0 [ 429.358222][T14791] check_panic_on_warn+0x89/0xb0 [ 429.363148][T14791] ? netlink_has_listeners+0x3d/0x3f0 [ 429.368508][T14791] end_report+0x73/0x170 [ 429.372743][T14791] ? netlink_has_listeners+0x3d/0x3f0 [ 429.378107][T14791] kasan_report+0x128/0x150 [ 429.382606][T14791] ? netlink_has_listeners+0x3d/0x3f0 [ 429.387970][T14791] kasan_check_range+0x264/0x2c0 [ 429.392903][T14791] netlink_has_listeners+0x3d/0x3f0 [ 429.398093][T14791] devlink_port_notify+0x18c/0x520 [ 429.403207][T14791] ? work_grab_pending+0x3d1/0x930 [ 429.408311][T14791] ? __pfx_devlink_port_notify+0x10/0x10 [ 429.413941][T14791] ? lockdep_hardirqs_on+0x7b/0x110 [ 429.419132][T14791] ? enable_work+0x1fd/0x230 [ 429.423720][T14791] devl_port_unregister+0x13e/0x2a0 [ 429.428923][T14791] __nsim_dev_port_del+0x1ad/0x200 [ 429.434026][T14791] nsim_dev_reload_destroy+0x288/0x490 [ 429.439488][T14791] nsim_drv_remove+0x58/0x170 [ 429.444156][T14791] ? __pfx_nsim_bus_remove+0x10/0x10 [ 429.449437][T14791] device_release_driver_internal+0x48b/0x880 [ 429.455503][T14791] bus_remove_device+0x444/0x560 [ 429.460436][T14791] ? __pfx_bus_remove_device+0x10/0x10 [ 429.465888][T14791] ? kernfs_remove_by_name_ns+0x101/0x140 [ 429.471601][T14791] device_del+0x524/0x8f0 [ 429.475927][T14791] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 429.481724][T14791] ? __pfx_device_del+0x10/0x10 [ 429.486571][T14791] ? lock_acquire+0x115/0x350 [ 429.491240][T14791] device_unregister+0x21/0xf0 [ 429.495998][T14791] del_device_store+0x2b5/0x370 [ 429.500846][T14791] ? __pfx_del_device_store+0x10/0x10 [ 429.506213][T14791] ? sysfs_file_kobj+0x1e4/0x230 [ 429.511140][T14791] ? sysfs_kf_write+0x166/0x260 [ 429.515980][T14791] ? __pfx_sysfs_kf_write+0x10/0x10 [ 429.521166][T14791] kernfs_fop_write_iter+0x3a4/0x540 [ 429.526444][T14791] vfs_write+0x612/0xba0 [ 429.530677][T14791] ? __pfx_vfs_write+0x10/0x10 [ 429.535429][T14791] ? do_sys_openat2+0x14e/0x200 [ 429.540277][T14791] ? kmem_cache_free+0x182/0x650 [ 429.545210][T14791] ksys_write+0x150/0x270 [ 429.549535][T14791] ? __pfx_ksys_write+0x10/0x10 [ 429.554386][T14791] do_syscall_64+0x166/0x520 [ 429.558970][T14791] ? trace_irq_disable+0x3b/0x140 [ 429.563988][T14791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.570045][T14791] ? clear_bhb_loop+0x70/0xc0 [ 429.574713][T14791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.580593][T14791] RIP: 0033:0x7f2ea595ed8e [ 429.585061][T14791] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 429.604657][T14791] RSP: 002b:00007f2ea5d4f1f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 429.613067][T14791] RAX: ffffffffffffffda RBX: 0000555595308500 RCX: 00007f2ea595ed8e [ 429.621031][T14791] RDX: 0000000000000001 RSI: 00007f2ea5d4f280 RDI: 0000000000000005 [ 429.628998][T14791] RBP: 00007f2ea5a3637c R08: 0000000000000000 R09: 0000000000000000 [ 429.636955][T14791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 429.644915][T14791] R13: 00007f2ea5d4f280 R14: 00007f2ea5d4fac0 R15: 0000000000000003 [ 429.652881][T14791] [ 429.656161][T14791] Kernel Offset: disabled [ 429.660477][T14791] Rebooting in 86400 seconds..