last executing test programs: 1.040484931s ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) capset(&(0x7f0000000000)={0x20080522}, &(0x7f00000002c0)={0x0, 0x0, 0xffffefff, 0x81, 0xfffffdff, 0x5}) socket$inet(0x2, 0x3, 0x1) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$SNAPSHOT_FREE(r3, 0x3305) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), &(0x7f00000013c0)=0xc) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$unix(r4, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000300)='c\\', 0x2}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000100000e01000000", @ANYRES32=r5, @ANYRES32=r4], 0x18, 0x4000014}}], 0x1, 0x4) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000440)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900600000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000ba00000000b9c50d0000b800c80000b8010000000f01d90f300fc79d53bf0000c4e16dd3010f2202", 0x61}], 0x1, 0x4f, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000100)={0x1, 0x0, [{0x0, 0x1, 0x5, 0x6, 0x4, 0x7, 0x85}]}) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl(0xffffffffffffffff, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000007465") r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r7) sendmsg$IEEE802154_ADD_IFACE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="01002dbd7000fcdbdf252100000009001f00706879320000000005002000000000000a0001"], 0x34}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000000) ioctl$KVM_KVMCLOCK_CTRL(r2, 0xaead) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, 0x0) r10 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x1a443, 0x29) r11 = syz_open_dev$loop(&(0x7f0000000040), 0x80008000000, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000400)={0x2c, &(0x7f0000000340)=ANY=[@ANYRESHEX=r2], 0x0, 0x0, 0x0, 0x0}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x22002, 0x8) ioctl$LOOP_SET_FD(r11, 0x4c00, r10) ioctl$LOOP_SET_STATUS64(r11, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1e, 0x8, '\x00', '\x00', '\x00', [0xffffffffffff0003]}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 942.270246ms ago: executing program 2 (id=3): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x10) getpeername(r0, &(0x7f0000000080)=@ethernet={0x0, @broadcast}, &(0x7f0000000100)=0x80) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x22c, r1, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5cc}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_LINK={0xa4, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6382}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}]}, @TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x67ce}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9c7a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xafba}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}]}, @TIPC_NLA_NET={0x6c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x200}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x89c}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7fffffffffffffff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x10001}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3d4}]}, @TIPC_NLA_BEARER={0x34, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'eth', 0x3a, 'sit0\x00'}}]}, @TIPC_NLA_SOCK={0x20, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xd}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6ec31e24}]}]}, 0x22c}, 0x1, 0x0, 0x0, 0x20008084}, 0x4000000) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(0xffffffffffffffff, 0x40109441, &(0x7f0000000480)={0x5, 0x2, 0x4}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000004c0)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, &(0x7f0000000500)={0x7, 'veth1_to_hsr\x00', {0x1dfb}, 0x101}) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x54, r1, 0x10, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x81}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x40800}, 0x4000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_GET(r2, &(0x7f0000000840)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000800)={&(0x7f0000000700)={0xc8, r3, 0x100, 0x70bd27, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x4}, {0x6, 0x11, 0x122}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7bf9c4b7}, {0x6, 0x11, 0x2}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xaf}, {0x6, 0x11, 0x40}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x20008094}, 0x24040080) r4 = accept(r2, &(0x7f0000000880)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private2}}, &(0x7f0000000900)=0x80) sendmsg$inet(r4, &(0x7f0000000cc0)={&(0x7f0000000940)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000c40)=[{&(0x7f0000000980)="20357dd41b660d5d7053762ca3cce6b7ab5f2f4e15e8b7dd3d0036882e4961b7dfba555874952fea8ebfc375508ceb64b3815c0dca26f4309b94d72d8d8acd919ae8f78ebe424e5674c78486fe3921e1c9cac6f128dea740b1ed43e6998c8da40fbd263d7775e270964bca7a5823f8f5cad194f84524deae1b7cd33e54a3ff463372c82bc743a33e6b794a2797595c13e66fcc725305e4d06bbb7410649837baa6bbf4c8e5e0ed9fe4f7c577b7c2131933c46aec13ee71bf9898927964cac79e485117af4384e932ced009547b7f754c0bb213390445ab2b5bd7f49ab065ad8a854d9b849eae5f261c9d203101734f3672", 0xf1}, {&(0x7f0000000a80)="92956e1c5e005d4ee54982c9c80fa0c22e0b081794d6f4087219199d3e863c251f58cdebb2ef34fa52333ed76bf71bcdf81e12c0e25cc3b90887905d5be0ecad6152ca69df95d25250f15ad6a59db5ef3142138e937a806e5b14a6ffb5351edaacdf95f965760a7c14ce48b675a1c7cb5da11125c58b0303173ee02fa57bc6d0", 0x80}, {&(0x7f0000000b00)="e9034d3c03beecb72b80b049d8f0e396a22946fd9da19dd80157973c2d297670ff8638b75fec99dbef6c0cdc9c34d8180f2011bc919112c159f680575b97d25dab04a15aab551c9e5bd6677034ac2201a73603547ecaec2d769b44d740e0843683488a4705d2f06928f2e663ffe1a4ec44a67831145ee02305b6964706aec2c404acd054fdaa45cc4dfabde61988dcf859", 0x91}, {&(0x7f0000000bc0)="cf21d86cc26f9f02fa63bd031db7c8f90f0e1b3313b46c17e0e67d30885f15694579be9f3890f8f5616269ac0d9838fa9e627e67270c035bdbdf2104c0928f56d3de0f4ee7605841c56268", 0x4b}], 0x4, &(0x7f0000000c80)=[@ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x18}, 0x8000) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r5 = creat(&(0x7f0000000d00)='./file0\x00', 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d80), r4) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000dc0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MAC_ACL(r5, &(0x7f0000000e80)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)={0x28, r6, 0x200, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x6, 0x79}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x40040}, 0x40000004) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000f00)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r5, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x38, r6, 0x800, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0xa}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x7}, @NL80211_ATTR_PRIVACY={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4400c000) r9 = accept$nfc_llcp(r4, &(0x7f0000001000), &(0x7f0000001080)=0x60) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000010c0)={0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f0000001440)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001400)={&(0x7f0000001140)={0x294, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x48, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0xb8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8000}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3ff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5b689e7c}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x367}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x800}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3c70}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x10001}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x40}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xcb20}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xac4}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3ff}]}, @TIPC_NLA_NODE={0xc8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_NODE_ID={0x65, 0x3, "11ca395f3f07ac07e7d87042383d356807ebeb3ac747a0c538f2e1ee25c7dcd5ef7d63d028477769894ab18c56cdcc0e14251e6a4944187fe0cb4d3469d56a8c2715a39498edaa1bfb18c7b77ec1ade10a76d2a0dd11134034700666f9996685bc"}, @TIPC_NLA_NODE_KEY={0x42, 0x4, {'gcm(aes)\x00', 0x1a, "79cc1ea575fa92de2122813b113a578178d04e4ff559b3787176"}}, @TIPC_NLA_NODE_REKEYING={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_BEARER={0xa4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x3, @local, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e21, @loopback}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}]}]}, 0x294}, 0x1, 0x0, 0x0, 0x4080804}, 0x20000040) sendmsg$TIPC_NL_NET_SET(r2, &(0x7f0000001780)={&(0x7f0000001480)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001740)={&(0x7f00000014c0)={0x258, r1, 0x20, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0xb4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd0d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9cd7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e23, @loopback}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, '\x00', 0x15}, 0x3}}, {0x14, 0x2, @in={0x2, 0x4e22, @empty}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK={0xc0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9ff}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER={0xc4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800000}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x1, @empty, 0x7}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x3, @dev={0xfe, 0x80, '\x00', 0x2f}, 0xe8c}}}}]}]}, 0x258}, 0x1, 0x0, 0x0, 0x20000040}, 0x2000c000) ioctl$FIOCLEX(r10, 0x5451) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f00000018c0)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001880)={&(0x7f0000001800)={0x74, r1, 0x400, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x50, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfffffffffffff81f}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf3dc}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8001}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x44000015}, 0x8010) ioctl$sock_SIOCADDDLCI(r9, 0x8980, &(0x7f0000001900)={'ip6_vti0\x00', 0xfff8}) getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, &(0x7f0000001940), &(0x7f0000001980)=0x4) 871.953439ms ago: executing program 2 (id=5): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="02050003021c00000007000000000000"], 0x10}, 0x1, 0x7}, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x148640, 0x78e22799f4a46f8e) r1 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r2 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r1) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000080)={r2, 0x150}, 0x0, &(0x7f00000008c0)="eb2bcb44032c2a3a518de900279744e05b2853d82c107d0fd00990b531004a27f0395fdb7d3b545b60ff5be75bcb1d85878c1cbdb120730ded7b4d10b0612763631dd3db62ddf7f7999797e2aa4cded6713302261b487e569f8fac402918be4ee374a4257d4bf67e86ff4beee88b1e3e5bac3ad4dea44fc08db9f741b76996bf785368bc3b2081640008000000000000cd90d32ebcf5ea2c79482fb0e0cfb8bf19da10adffeafb4747c5853fdaca77fe20bbb66b8e86486c2ea7e519a50fb23e5202f7f02c633d4f56361cd848e6cec9abcbf97c60de6c9d205a4e26b68fd5d7c3d516dce08adf9b56f1b52064b280f676428a27963412330fc44e27ce9c2df2983484651bd673f03533ed19a3db8e5fc84e845c9e00983a4d68ea9d8b26929221090000001fb0b7328f894e8ed9043e9a0c7dfd80562b202c63ecacd551642dd8d19cea9750d091380000b7fa8def00", 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000005980), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan4\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r3, &(0x7f0000005a40)={0x0, 0x0, &(0x7f0000005a00)={&(0x7f0000000780)={0x24, r4, 0x182a2cea5a66fc3d, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3e}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000895}, 0x20040000) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r8 = syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000300)={{0x12, 0x1, 0x11, 0x0, 0x0, 0x0, 0x8, 0x2a39, 0x3fb0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x0, 0x40, 0x29, {0x8, 0xb, 0x1, 0x2, 0x1, 0x3, 0x20, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xff, 0x0, 0x9, 0x7f}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x9, 0x8, 0x2, {0x8, 0x25, 0x1, 0x1, 0xc, 0xa, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x1, 0x5, 0xfc, {0x8, 0x25, 0x1, 0x2, 0x3, 0xfd, 0x1}}}}}}}}]}}, 0x0) syz_usb_control_io(r8, &(0x7f00000004c0)={0x2c, &(0x7f0000000280)={0x20, 0xe, 0x2, {0x2, 0xb}}, &(0x7f0000000380)=ANY=[@ANYBLOB="00031d0000001d03e99c03371c379322017961493aea28c85eeeb653e6e7863da516a3"], 0x0, 0x0, 0x0}, 0x0) r9 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000640)=ANY=[@ANYBLOB="1201000000000040341d0a0000000000000109022400010000000009040000010300000009210000000122030009058103"], 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r10, 0x6, 0x4, 0x0, &(0x7f0000000240)) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="002204"], 0x0}, 0x0) r11 = dup(r7) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x200094, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r11}, 0x2c, {[{@uname={'uname', 0x3d, '\'*'}}], [], 0x6b}}) 728.194876ms ago: executing program 3 (id=9): madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) (async) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) 628.225991ms ago: executing program 3 (id=13): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x79, 0x109301) ioctl$USBDEVFS_CONTROL(r0, 0xc0105500, &(0x7f0000000140)={0x80, 0x6, 0x302, 0xb8e, 0x54, 0x951, 0x0}) 627.777721ms ago: executing program 3 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x19bc02, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0xfffffffe, @loopback, 0x4}, 0x1c) setsockopt$inet6_opts(r3, 0x29, 0x3b, 0x0, 0x10) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x304, 0x39}, "4526000000927650", '\x00', "c5f54bb1"}, 0x28) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000002380)="c744240000000080c744240200000000c7442406000000000f011424b9a90900000f320f32c744240005000000c744240200000100c7442406000000000f01142448b802000000000000000f23d80f21f835400000a00f23f866b806018ec067430f01c248b800180000000000000f23d80f21f835800000100f23f82e0f1c440a0966b89a008ee0", 0x88}], 0x1, 0x11, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r5, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="200000005f00019cb7584395a083df5acf09"], 0x20}], 0x1}, 0x24000080) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r2, 0x4068aea3, &(0x7f00000002c0)={0xbc, 0x0, 0x2}) ioctl$KVM_RUN(r4, 0xae80, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x2710, @hyper}, 0x10) ioctl$KVM_RUN(r4, 0xae80, 0x0) 627.352951ms ago: executing program 3 (id=15): r0 = fsopen(&(0x7f0000000140)='debugfs\x00', 0x1) (async) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mountinfo\x00') read$FUSE(r1, &(0x7f00000061c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) (async) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000000)) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) r3 = fsmount(r0, 0x1, 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) (async) write(0xffffffffffffffff, &(0x7f00000001c0)='a', 0x1) (async, rerun: 64) fchdir(r3) (async, rerun: 64) r4 = syz_open_procfs(r2, &(0x7f0000002040)='pagemap\x00') lseek(r4, 0xffffffffffff0000, 0x0) (async) read$FUSE(r4, 0x0, 0x0) (async) r5 = epoll_create1(0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = epoll_create1(0x0) r8 = fcntl$dupfd(r7, 0x0, r6) r9 = epoll_create1(0x0) (async) r10 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r7, &(0x7f0000000180)={0x2002}) (async) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r7, &(0x7f0000000000)={0x20000002}) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000040)={0x20000001}) close_range(r5, r9, 0x0) (async) close(r3) (async) open(&(0x7f0000000040)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger/file0\x00', 0x80, 0x4) 604.218422ms ago: executing program 1 (id=16): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfffd, 0xfffd, 0x24c, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa98, 0xa2b9, 0x100, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0x9f, 0xb69b, 0x9, 0xf9a2, 0x1, 0xff, 0x0, 0x2, 0x5a7, 0x2, 0x1000000, 0x489, 0x7ff, 0x7, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xffffffff, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x6, 0x808, 0x40, 0xa6, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x2004, 0x1c, 0x80000000, 0x6, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d6, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1f9, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x0, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0xffd, 0x2, 0xc], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0xffffffff, 0x8000048d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000006, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x2, 0xd, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0xa, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0xfc33, 0x55, 0x7ff, 0xfffffff8, 0x1005, 0x10000001, 0x7, 0x21, 0x4000006, 0x81, 0x7, 0x9d86, 0x8, 0x8, 0x4, 0x140f1, 0xd, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000804, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffffa, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001d40), 0x0, 0x0, 0x0, 0x4020}, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000a00)='/sys/kernel/profiling', 0x2a41, 0x4) ioperm(0x1, 0x3, 0x163f) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) write$cgroup_subtree(r0, &(0x7f0000000ac0)={[{0x2d, 'hugetlb'}]}, 0x9) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x800) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000480)={0x10001, 0x3, 0x41000, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3800000002090101000000001b00000001000001000100ac"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_SET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x50, r4, 0x623, 0x70bd2a, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x7}, {0x8}, {0x5, 0x14, 0x1}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 587.351252ms ago: executing program 1 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$MON_IOCX_MFETCH(r1, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x1ff}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0, 0x4b}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000040)={[0x4, 0x2, 0xe9b, 0x2, 0xd, 0x7f, 0x44233, 0x7, 0x81, 0x941, 0x8001, 0x1005, 0x4, 0x5, 0x40, 0xfffffdfffffffffd], 0xe000, 0x84340}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 520.123105ms ago: executing program 3 (id=18): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./binfmt\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./binfmt\x00', &(0x7f0000000100)='binfmt_misc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./binfmt/status\x00', 0x1, 0x0) pwritev(r0, &(0x7f0000001440)=[{&(0x7f0000000180)="b6ec", 0x2}], 0x1, 0x2004, 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) (async) r3 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r2, 0x1, 0x70bd35, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) (async) landlock_restrict_self(0xffffffffffffffff, 0xf) 518.990565ms ago: executing program 3 (id=19): ptrace$setregset(0x4205, 0x0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aed", 0xe}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x40086602, &(0x7f0000000080)={@desc={0xffff8000, 0x0, @desc2}}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r1, &(0x7f00000000c0)=[{{&(0x7f0000000300)={0x2, 0x4e23, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_retopts={{0x10}}], 0x10}}], 0x1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c000000180009020000000000000000020000000800002f283afc00"], 0x2c}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) r6 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000000)=0x1a42, 0x4) bind$packet(r6, &(0x7f0000000080)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @link_local}, 0x14) sendto$packet(r6, &(0x7f00000000c0)="fb43975e51722b365d37bac80000", 0xe, 0x0, 0x0, 0x0) recvmsg(r6, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x2000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000200)={0x0, 0x0}) fcntl$lock(r5, 0x27, &(0x7f0000000180)={0x2, 0x0, 0x1000005, 0xf, r8}) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r5, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) r10 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r10) r11 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc539, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x4, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_usb_control_io$hid(r11, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150091a60906a101090182008c0508950129309102c0"], 0x0}, 0x0) 474.849738ms ago: executing program 1 (id=20): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x880, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x3, 0x7, 0xe1, 0x81, 0x9, 0x4a, 0x40, 0x42, 0xfb, 0x8, 0xc, 0x0, 0xe9, 0x4, 0xf9, 0x38}}) (async) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x4, 0x100000000005, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000010000000, 0x6, 0x1c00000, 0x8, 0x0, 0xffffffffffffffd9, 0x0, 0x8000], 0x0, 0x3c4210}) (async) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000140)="670f01cac7442400c8bf0000c744240203000000c7442406000000000f011424440f20c03509000000440f22c0c0a57f64420c0c260f01c2b9800000c00f3235000400000f30c4e3817fbef0ffffff6d650f01cb66baa100b0fdee67650f38cbd2", 0x61}], 0x1, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000040)={0x7fff, 0x9, 0x2, 0x3, 0x40, "aac2b7bbe5df278179070e13e12f1c61d90f0f", 0x9, 0x7}) 350.485544ms ago: executing program 0 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_TPR_ACCESS_REPORTING(r5, 0xc028ae92, &(0x7f0000000000)={0xcea, 0xb}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000140)="66baf80cb8044fdc87efed660f388059e0b805000000b91e4200000f01c10f20c035000000200f22c0f20fa20f01cb36263e660f381efc660f7c150c000000b805000000b9210000000f01c1c4e17929d8", 0xfffffffffffffed0}], 0x1, 0x11, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r9, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r9, 0x0) preadv(r9, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 255.515748ms ago: executing program 1 (id=22): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, r1, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054) (async) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r2, &(0x7f0000006b40)={0x2020}, 0x2020) 244.859109ms ago: executing program 1 (id=23): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$TIOCSBRK(r0, 0x5427) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040), 0x88080, 0x0) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x2) ioctl$TIOCGLCKTRMIOS(r2, 0x5456, &(0x7f0000000080)={0x6, 0xc0000000, 0x3ff, 0x5, 0x18, "8b524695e70d7ed8f58f29966f6c29f87a60ae"}) r3 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f00000001c0)={r3, &(0x7f00000000c0)='/dev/ttynull\x00', 0x101400, &(0x7f0000000100)={@align=0x2, {0x5, 0x7, 0x6, 0x100}}, 0x6, &(0x7f0000000140), &(0x7f0000000180)=0x1}) ioctl$KDGKBENT(r4, 0x4b46, &(0x7f0000000200)={0x0, 0x3, 0x9}) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000240)={0x200, 0xf, 0x7}) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r3, 0x6628) faccessat(r4, &(0x7f0000000280)='./file0\x00', 0x4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r4, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x30, 0x0, 0x800, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x4, 0x43}}}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}]}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x80040) ioctl$VT_GETMODE(r4, 0x5601, &(0x7f0000000400)) ioctl$F2FS_IOC_GET_FEATURES(r4, 0x8004f50c, &(0x7f0000000440)) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), r1) sendmsg$ETHTOOL_MSG_DEBUG_GET(r4, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, r6, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20001001}, 0x4c840) read$FUSE(r4, &(0x7f00000005c0)={0x2020}, 0x2020) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002600)='/proc/sysvipc/shm\x00', 0x0, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002680), r1) sendmsg$NL80211_CMD_DEL_MPATH(r7, &(0x7f0000002780)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x1000c944}, 0xc, &(0x7f0000002740)={&(0x7f00000026c0)={0x5c, r8, 0x200, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x6d}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000000) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r9, &(0x7f00000028c0)={&(0x7f00000027c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000002880)={&(0x7f0000002800)={0x4c, 0x0, 0x300, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_COOKIE={0xc}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x4d}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x66}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x43}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008034}, 0x8014) sendmsg$NL80211_CMD_DEAUTHENTICATE(r4, &(0x7f0000002a40)={&(0x7f0000002900)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000002a00)={&(0x7f0000002940)={0xac, r8, 0x828, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x78, 0x2a, [@prep={0x83, 0x1f, {{}, 0xa, 0x3, @device_b, 0x6, @void, 0x1ff, 0x2, @broadcast, 0xc8e}}, @rann={0x7e, 0x15, {{0x1, 0x5}, 0x2f, 0x3, @device_a, 0x5, 0x5321, 0x2}}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x0, 0xffffffffffffffff, 0x3}}, @random={0x6e, 0x3, "60ce65"}, @dsss={0x3, 0x1, 0x2}, @link_id={0x65, 0x12, {@random="fa027245823f", @device_a, @broadcast}}, @rann={0x7e, 0x15, {{0x0, 0x9}, 0x2b, 0x5, @device_b, 0x0, 0x3ff, 0x2}}]}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1ff}]}, 0xac}, 0x1, 0x0, 0x0, 0x24000040}, 0x40010) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) sendmsg$NL80211_CMD_NEW_MPATH(r9, &(0x7f0000002b40)={&(0x7f0000002a80)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000002b00)={&(0x7f0000002ac0)={0x38, r8, 0x2, 0x70bd2d, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x3, 0x36}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x24040000) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000002bc0), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r9, &(0x7f0000002c80)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x208000}, 0xc, &(0x7f0000002c40)={&(0x7f0000002c00)={0x34, r10, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x20000040) writev(r0, &(0x7f00000031c0)=[{&(0x7f0000002cc0)="2ad1a4b144ddf3bce85776f695f7add02164d99172d5aac6be9422e7a428b6dde27cd99f08e9bc3f11f3881ed566a4685c03cc3dacedf745f6ce424a89973e098c188819d4ccc6aa067bca3f59c4f30fde830ffd1cab7584224b464cb5f906a04f94882275dd9ff8e09f56b812c76dcb969225e88072bcfe8dd81d44102969af5ff6ba42846b09e45b0582b9af2516a0933379ab2524a568182d3eb5a4cfd6c57a2c6c04b516a4e9b21432a7d7f8643cb017f8143074bb06639dfead5e8feef026b225a6bbd7617e128857821b9ab29db7adfff023860b1311fb7650d9b8d24cab07f20aa6f4c6964e", 0xe9}, {&(0x7f0000002dc0)="c97cb313207309c8b14ba8133bf21bd7318a7911542c3301b1db7f44cb648fdeb8b5e5e1c6ffb7ecbaf66fd2c3a0e251b851e0f6c18a54287856f81326a519dec162cfaadbef3b98d44f741d2872f87d7621310e00bc6eafc949f19852a19c14e38c", 0x62}, {&(0x7f0000002e40)="c59145bd8f9e827c9729ef5a1c85704c5ee2", 0x12}, {&(0x7f0000002e80)="01aa427875f6e8ab3de9344d8bd6fc3945dae8d2b4db222553d99b61d17b6b2685c32053210404d55ad3df442e9d8100520f5dde6a19a067fe51973a51ae89c6a839016eeac00545312a051ce261ddfd5ab741a2590fd829c59e4e08c17e940ca5730cadae3f64593e52ffdd1375591ac46369099256e32f053c87e2feedf058ab34e10cb1e1a2073ff46339a1171c5b2b75a7887ceb5516a534fa0ed09aa3f05f99a0743c37ceb4e43ca1e9887fc3763fc9d9c18bf300bdef6f4afe5d27be9da3728169421901f3016b47db93353ab3e5ae1829a1305f0d5e20d89d6ed86ea49064c6ba21425b1aa5ac10ec47ac68879d8b3e48dc2038d57563f4", 0xfb}, {&(0x7f0000002f80)="23b14c87daf28dbfe607eda6d425f05433f5c2c03e655f1a1f9e8920660eec93c0b97957cd71f18942c78db0dc679f7d69636c7c92639eab9b42dee7ec685e026a47aa588a271dc4dd9377ddd4a6376e5aff4acb8547baa0ba0ce580be8e3e583f7cf53b56985b6cd745f55c3174f142f0500b334c2af1bf69cd089e48b91f98e162ff2068ebc3417cf9cf9870008e231295c0c3621fc256b178cdb921cf3e572dc145de8ad92f54e3b952554cf322010f5ef7c2379e219ac7bda40beec790435624f451513144a78db25aa71c4aee81adcab0b56d", 0xd5}, {&(0x7f0000003080)="d1d43fac7239e53929004933c8cd8b6aac13207e93e2651f2316b8", 0x1b}, {&(0x7f00000030c0)="9153cdd52bfad944edf988e8cc68f0ce2795d61eb73c63aba231cc92830f27bc444511c6feae31294e68ab2c09e9655843217cef48640fa2a6c0e334d7a1c9c5ee67ab73d58e6c4a1668c75afcbe1e2e778138d564f0ac7dae1c9209c926f0b41778e16303c33cb70482695caa8d44fa3ea24bf8f61acd49643b928456de0d0a737e912b1e90be02f05d6976142b866e2ef695c3a1e8e37757a19833715cffd30463a87a4a66d2c1af18eabacec2324ce0c89be2a2d3d604311b5488788681e3e9077da958a15e0e71b60db4d20370e5de85f30510a4e9013dea5e1b885d5be388", 0xe1}], 0x7) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0x800) 230.616389ms ago: executing program 1 (id=24): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/ip6_flowlabel\x00') r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, 0x0) (async, rerun: 64) statx(r1, 0x0, 0x7000, 0x200, 0x0) (async, rerun: 64) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000080)={0x2, 0xf1, 0x2, 0x9a9, 0xb}) syz_usb_connect$uac1(0x5, 0x90, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003000000201e04483040000102030109027e0003010080020904000000010100000a2401020028000201020924030501030303000924060301010700800c240201"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) 172.047862ms ago: executing program 0 (id=25): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x109640, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000040)={0x6, 0xb, 0x1, 0x0, 0x1b, "1000807200"}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r4, 0x4080aebf, &(0x7f0000000640)=@vmx={0x103, 0x0, 0x2080, {0x41000, 0x60000, {}, 0x0, 0xb}, {"d07ee5110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000000000000000000000000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000057ae000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100008000", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007a7f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000"}}) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000000)=0x8001) openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x20040, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0xa70d6000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 79.724776ms ago: executing program 0 (id=26): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, 0x0) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) setresuid(0x0, 0xffffffffffffffff, 0xee01) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers_autoprobe\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='0', 0x1) rt_sigprocmask(0x1, &(0x7f0000000000)={[0x5]}, 0x0, 0x8) r1 = gettid() r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='mounts\x00') ftruncate(r2, 0x8000000000000003) setuid(0xee00) prctl$PR_SET_MM_MAP(0x3a, 0xe, 0x0, 0x0) timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4, @tid=r1}, &(0x7f0000044000)) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x800, 0x0, 0x3, 0x1, 0x80}, 0x20) setuid(0xee00) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000080)={@loopback={0xffffffffffffffa4}, 0x800, 0x0, 0x3, 0x0, 0x40, 0x8}, 0x20) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{}, {0x0, 0xe4c}}, 0x0) tkill(r1, 0x12) utime(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={0x1, 0xffffffffc86d5209}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket(0x10, 0x803, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) 64.245317ms ago: executing program 0 (id=27): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc2, 0x1ff) write$binfmt_register(r2, &(0x7f0000000040)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0xd66, 0x3a, 'ramfs\x00', 0x3a, '@}\\&-!*\f%@*{', 0x3a, './file1'}, 0x39) close(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x82000, 0x1c9) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xb, 0x12, r3, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) chmod(&(0x7f0000000080)='./debug/tracing/events/sched/sched_switch/enable\x00', 0x1) 0s ago: executing program 0 (id=28): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f00000003c0)={0xf8cc, 0x1ff, 0x4, 0x1, 0x8, "0272000000000500f100000000000000000004", 0x80000, 0x480}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x881, 0x0) ioctl$RTC_RD_TIME(r3, 0x80247009, &(0x7f0000000040)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x21e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x80, 0x15, 0x87}}}}}]}}]}}, 0x0) r6 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000540)={0x0, 0x3, 0x100000001, 0x9}) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c04a1010901a1007508950109308102c0c0"], 0x0}, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000c80)={0x0, 0x30, 0x1, ':'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$hiddev(&(0x7f0000000100), 0xa, 0x62080) ioctl$HIDIOCGUSAGE(r7, 0xc018480b, 0x0) r8 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r8, 0x0, 0x0) syz_usb_control_io(r8, 0x0, &(0x7f0000000280)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="402004000000a0"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io$uac1(r8, 0x0, &(0x7f0000000d80)={0x44, &(0x7f0000000600)=ANY=[@ANYBLOB="201005080000f1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000000e40)={0x44, &(0x7f00000009c0)=ANY=[@ANYBLOB="ff01cd"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r8, 0x0, 0x0) r9 = syz_usb_connect$printer(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$printer(r9, &(0x7f0000001100)={0x14, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r8, 0x0, &(0x7f0000001600)={0x44, &(0x7f0000001380)=ANY=[@ANYBLOB="400d0400000057cead44"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000240)=@attr_other={0x0, 0x0, 0xf1, &(0x7f0000000080)=0x7}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0x7, 0xfffffffffffffffd, 0x41, 0xc3d, 0x0, 0x100, 0x1000000003, 0xa1a, 0x7, 0x5, 0x79, 0x3, 0x3], 0x3332d000, 0x2}) bind$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x10000000}, 0xc) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.176' (ED25519) to the list of known hosts. [ 20.444493][ T36] audit: type=1400 audit(1789984708.410:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.446004][ T286] cgroup: Unknown subsys name 'net' [ 20.467230][ T36] audit: type=1400 audit(1789984708.410:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.494459][ T36] audit: type=1400 audit(1789984708.450:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.494618][ T286] cgroup: Unknown subsys name 'devices' [ 20.629105][ T286] cgroup: Unknown subsys name 'hugetlb' [ 20.634745][ T286] cgroup: Unknown subsys name 'rlimit' [ 20.747627][ T36] audit: type=1400 audit(1789984708.720:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.771405][ T36] audit: type=1400 audit(1789984708.720:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.781905][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.796292][ T36] audit: type=1400 audit(1789984708.720:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.827909][ T36] audit: type=1400 audit(1789984708.780:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.853621][ T36] audit: type=1400 audit(1789984708.780:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.886234][ T36] audit: type=1400 audit(1789984708.860:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.911803][ T36] audit: type=1400 audit(1789984708.860:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.912053][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.229324][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.236365][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.243465][ T293] bridge_slave_0: entered allmulticast mode [ 22.249815][ T293] bridge_slave_0: entered promiscuous mode [ 22.264848][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.271951][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.279079][ T294] bridge_slave_0: entered allmulticast mode [ 22.285285][ T294] bridge_slave_0: entered promiscuous mode [ 22.291617][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.298777][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.305869][ T293] bridge_slave_1: entered allmulticast mode [ 22.312225][ T293] bridge_slave_1: entered promiscuous mode [ 22.330358][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.337461][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.344545][ T294] bridge_slave_1: entered allmulticast mode [ 22.351149][ T294] bridge_slave_1: entered promiscuous mode [ 22.401288][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.408386][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.415428][ T295] bridge_slave_0: entered allmulticast mode [ 22.421802][ T295] bridge_slave_0: entered promiscuous mode [ 22.428286][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.435320][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.442499][ T295] bridge_slave_1: entered allmulticast mode [ 22.448693][ T295] bridge_slave_1: entered promiscuous mode [ 22.488827][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.495888][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.502963][ T296] bridge_slave_0: entered allmulticast mode [ 22.509168][ T296] bridge_slave_0: entered promiscuous mode [ 22.515535][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.522607][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.529741][ T296] bridge_slave_1: entered allmulticast mode [ 22.536034][ T296] bridge_slave_1: entered promiscuous mode [ 22.650071][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.657150][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.664454][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.671514][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.696667][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.703750][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.711054][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.718114][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.728858][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.735902][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.743206][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.750260][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.785222][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.792988][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.800944][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.808274][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.815414][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.822949][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.840441][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.847522][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.872969][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.880033][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.900501][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.907580][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.916594][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.923664][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.949078][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.956144][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.964215][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.971282][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.979448][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.986491][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.998733][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.005775][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.024848][ T293] veth0_vlan: entered promiscuous mode [ 23.059601][ T293] veth1_macvtap: entered promiscuous mode [ 23.073420][ T295] veth0_vlan: entered promiscuous mode [ 23.093911][ T294] veth0_vlan: entered promiscuous mode [ 23.101996][ T296] veth0_vlan: entered promiscuous mode [ 23.115412][ T295] veth1_macvtap: entered promiscuous mode [ 23.146067][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.147979][ T294] veth1_macvtap: entered promiscuous mode [ 23.170884][ T296] veth1_macvtap: entered promiscuous mode [ 23.200482][ T312] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.306461][ T318] fuse: Bad value for 'user_id' [ 23.323597][ T318] fuse: Bad value for 'user_id' [ 23.390350][ T329] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 23.408286][ T329] netlink: 96 bytes leftover after parsing attributes in process `syz.3.7'. [ 23.594424][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 23.602907][ T345] SELinux: failed to load policy [ 23.692409][ T365] netlink: 16 bytes leftover after parsing attributes in process `syz.3.19'. [ 23.751749][ T45] usb 3-1: Using ep0 maxpacket: 8 [ 23.759887][ T45] usb 3-1: New USB device found, idVendor=2a39, idProduct=3fb0, bcdDevice= 0.40 [ 23.776210][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.785381][ T45] usb 3-1: Product: syz [ 23.789729][ T45] usb 3-1: Manufacturer: syz [ 23.794339][ T45] usb 3-1: SerialNumber: syz [ 24.077267][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.202784][ T323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.211445][ T323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 24.228336][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.239374][ T9] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 24.248472][ T62] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.256119][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.319623][ T45] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 24.326547][ T45] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 24.351924][ T45] usb 3-1: USB disconnect, device number 2 [ 24.368752][ T45] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN PTI [ 24.381444][ T45] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] [ 24.389861][ T45] CPU: 1 UID: 0 PID: 45 Comm: kworker/1:1 Not tainted syzkaller #0 e67cc5743245539115c479145c763e2a95730d6f [ 24.401320][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.411370][ T45] Workqueue: usb_hub_wq hub_event [ 24.416444][ T45] RIP: 0010:klist_remove+0x15e/0x330 [ 24.421732][ T45] Code: be 00 00 00 00 00 fc ff df 43 80 3c 34 00 74 08 48 89 df e8 c4 68 44 fc 4c 8b 3b 49 83 e7 fe 49 8d 7f 20 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 a6 68 44 fc 49 8b 47 20 48 89 44 24 18 4c [ 24.441335][ T45] RSP: 0018:ffffc900002ef600 EFLAGS: 00010202 [ 24.447410][ T45] RAX: 0000000000000004 RBX: ffff88811315c248 RCX: dffffc0000000000 [ 24.447488][ T388] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.455399][ T45] RDX: ffffc9000b8e1000 RSI: 00000000000183ad RDI: 0000000000000020 [ 24.455421][ T45] RBP: ffffc900002ef6e8 R08: 0000000000000003 R09: 0000000000000004 [ 24.455436][ T45] R10: dffffc0000000000 R11: fffff5200005deb0 R12: 1ffff1102262b849 [ 24.455453][ T45] R13: 1ffff9200005dec4 R14: dffffc0000000000 R15: 0000000000000000 [ 24.455469][ T45] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 24.487264][ T62] usb 2-1: Using ep0 maxpacket: 32 [ 24.494768][ T45] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.494792][ T45] CR2: 000000110c355f39 CR3: 000000010c3b6000 CR4: 00000000003526b0 [ 24.505366][ T62] usb 2-1: unable to get BOS descriptor or descriptor too short [ 24.508833][ T45] Call Trace: [ 24.508844][ T45] [ 24.508852][ T45] ? devres_release_all+0x342/0x3c0 [ 24.516771][ T62] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 24.523439][ T45] ? __cfi_klist_remove+0x10/0x10 [ 24.523477][ T45] ? usb_unbind_interface+0x857/0xa40 [ 24.531496][ T62] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 24.534390][ T45] device_release_driver_internal+0x739/0x830 [ 24.540080][ T62] usb 2-1: New USB device found, idVendor=041e, idProduct=3048, bcdDevice= 0.40 [ 24.542535][ T45] device_release_driver+0x1d/0x30 [ 24.542566][ T45] bus_remove_device+0x34f/0x370 [ 24.553009][ T62] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.557643][ T45] device_del+0x583/0xcf0 [ 24.557670][ T45] ? __cfi_device_del+0x10/0x10 [ 24.563349][ T62] usb 2-1: Product: syz [ 24.571872][ T45] ? __kasan_check_write+0x18/0x20 [ 24.571902][ T45] usb_disable_device+0x3af/0x770 [ 24.578308][ T62] usb 2-1: Manufacturer: syz [ 24.587062][ T45] usb_disconnect+0x331/0x950 [ 24.587102][ T45] hub_event+0x1ad5/0x4360 [ 24.595891][ T62] usb 2-1: SerialNumber: syz [ 24.597139][ T45] ? __cfi_hub_event+0x10/0x10 [ 24.651558][ T45] ? pwq_dec_nr_in_flight+0x943/0xba0 [ 24.656936][ T45] ? _raw_spin_lock_irq+0x93/0x120 [ 24.662056][ T45] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 24.667595][ T45] ? kick_pool+0xb9/0x540 [ 24.671925][ T45] process_scheduled_works+0x7f4/0x1060 [ 24.677466][ T45] worker_thread+0xc99/0x13f0 [ 24.682148][ T45] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 24.687864][ T45] ? __kasan_check_read+0x15/0x20 [ 24.692882][ T45] kthread+0x2c4/0x360 [ 24.696951][ T45] ? __cfi_worker_thread+0x10/0x10 [ 24.702053][ T45] ? __cfi_kthread+0x10/0x10 [ 24.706649][ T45] ret_from_fork+0x64/0xa0 [ 24.707546][ T388] usb 1-1: Using ep0 maxpacket: 16 [ 24.711071][ T45] ? __cfi_kthread+0x10/0x10 [ 24.717453][ T388] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 24.720778][ T45] ret_from_fork_asm+0x1a/0x30 [ 24.732799][ T388] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 24.736658][ T45] [ 24.736669][ T45] Modules linked in: [ 24.737027][ T45] ---[ end trace 0000000000000000 ]--- [ 24.761282][ T372] udevd[372]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 24.779037][ T388] usb 1-1: config 0 interface 0 has no altsetting 0 [ 24.785185][ T45] RIP: 0010:klist_remove+0x15e/0x330 [ 24.787433][ T388] usb 1-1: New USB device found, idVendor=05ac, idProduct=021e, bcdDevice= 0.00 [ 24.791202][ T45] Code: be 00 00 00 00 00 fc ff df 43 80 3c 34 00 74 08 48 89 df e8 c4 68 44 fc 4c 8b 3b 49 83 e7 fe 49 8d 7f 20 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 a6 68 44 fc 49 8b 47 20 48 89 44 24 18 4c [ 24.807269][ T388] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.822100][ T45] RSP: 0018:ffffc900002ef600 EFLAGS: 00010202 [ 24.833957][ T45] RAX: 0000000000000004 RBX: ffff88811315c248 RCX: dffffc0000000000 [ 24.842047][ T45] RDX: ffffc9000b8e1000 RSI: 00000000000183ad RDI: 0000000000000020 [ 24.850913][ T45] RBP: ffffc900002ef6e8 R08: 0000000000000003 R09: 0000000000000004 [ 24.858945][ T45] R10: dffffc0000000000 R11: fffff5200005deb0 R12: 1ffff1102262b849 [ 24.866913][ T45] R13: 1ffff9200005dec4 R14: dffffc0000000000 R15: 0000000000000000 [ 24.874929][ T45] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 24.883915][ T45] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.890715][ T45] CR2: 000000110c330923 CR3: 0000000131c52000 CR4: 00000000003526b0 [ 24.898731][ T45] Kernel panic - not syncing: Fatal exception [ 24.904951][ T45] Kernel Offset: disabled [ 24.909280][ T45] Rebooting in 86400 seconds..