last executing test programs: 9m3.759590613s ago: executing program 32 (id=8): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xf}, {}, {0xfff2, 0xf}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8848}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r9, {0xf000, 0xffff}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r10 = syz_io_uring_setup(0x6556, &(0x7f0000000180)={0x0, 0x3a95, 0x8000, 0x2, 0x15c}, &(0x7f0000000340), &(0x7f00000003c0), &(0x7f0000000400)) mmap$IORING_OFF_SQ_RING(0x0, 0x10, 0x2000004, 0x40010, r10, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) 6m19.450788973s ago: executing program 33 (id=709): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xf8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@rand_addr=0x64010101, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x0, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x6, 0x4, 0x3, 0x0, 0x1}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x40000000, 0x0, 0x0}, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x6, 0x0, 0xfffffffffffffffc, 0x8000fb}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe4) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_GET_IRQCHIP(r5, 0xc208ae62, &(0x7f00000005c0)={0x2, 0x0, @pic={0x1, 0x2, 0xc, 0x4, 0x36, 0x0, 0x4, 0x88, 0x8, 0x10, 0x7, 0x3, 0x7, 0x7, 0xf8, 0x2}}) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r6 = openat$dlm_plock(0xffffff9c, &(0x7f0000000000), 0x442802, 0x0) getpeername$l2tp6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000000c0)=0x20) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xffd8) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/serio/devices/serio0/drvctl\x00', 0x1, 0x0) write(r7, &(0x7f0000000200)='atkbd', 0x5) r8 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io$sierra_net(r8, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) 4m40.154589001s ago: executing program 34 (id=834): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6008120000142b0000000000000000000000ffffac1414bbfe80f2ffffff000000000000000000aa3a000200"], 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) io_uring_setup(0x4126, &(0x7f00000007c0)={0x0, 0x0, 0x800, 0x0, 0x1000000}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x24000000) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c0010800800014000000000d97405010000000008000240000000000800", @ANYRES64=r2], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f00000020c0), 0x2000413, &(0x7f0000019080)=ANY=[]) syz_fuse_handle_req(r3, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x50, 0x0, 0xfff, {0x7, 0x29, 0xcf940281, 0xa00010, 0x1, 0x3a76, 0x10, 0x1801, 0x0, 0x0, 0x2, 0x2000009e}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r3, &(0x7f00000042c0)="0d9ec529eb18ec94a35378619cb10ff8c913f67139447b7ee0cca809e36c363ba1d3975a7446b70c6bdd99e2cff540eda7589ea89efeb498df568916036f0848ede5f089bf502b483c67c0432c34b98b1bc085a99e2981103397e0b0eed2ec64c1075798b56a42ea532091f5326c97622a47c53fbf42e71c3ed4b954c559424b49a13598c6c63ef65b62384b038b3e6e98ebecd178289831eaecd986a01c751e8cca7a57c009f2b5310fe9dd8a63b91c4b5b13d1c44d2b874b32ae3e961b9e96a511ffaa3ed20248dfb470460d305e44ffcd287b355380319fd31f7538c6d00de06ddb8f72b3a59c4699c94d7379e1e190c6dd7786e12096f9e963a038b6b4375535047135ecc07b16035ceeb27ed09d77f52b6eae27a03071e060b05bf347b9ba44a984e5db346d230ae9c5324ecfd4e7725bc5019a9f4d20237c820359d73b82f9c668ae71f6b85d5350140a16f988bb2b8010effb52636e0b728be1b1ed37c1b8868ec67edd52951dbf65b479aa25e92667a98c755d88995e6303a48a64317bd4b201fc6dea59381abfb5e0fb1035bbd32a97a6324b08f404fe3991879a0c6362032864031737941d9cc534697da61a43c8723ecd1062906b65c504d86383cdf9631f228372b13aee64f8ea8db00dffc37fa092ab5daeb7431dab37091c44f91c9202df60876a6e06ceee3e6a095406fe5cc1f83de1a4adf36fbef5a94a622132cc85e56fb53a9cff67bc69a24d8c259ccfe19b1925061f0cad95d6b4158c1394b8acfa9a8f52a566c6cb4e0b14dd30c85b309289a5f395e01d981735f6fce6ab30994643d70b2f322b7a233a339e621ea2eb00a0082a175c231b330a58062680546c28db8ff5b7e66c0e3df0a9b74ab72abfd241fcbe1e3d27a2d1eab44cf88180dcef4482c866324133f9e4780b891a7c5000b005cab0c131c225e944fd1aab5de9e8d17b8770b4472b6e4a13b6cce90ba152e5144acf74cd8a9821ce3eae72dc7ddc81b76482226098329c3a8ecb923822610aa0b086f44329522dd8f9ae355b4666d1a10911ef8e21377578b42fe6ee0b2a77917157488d6e0bb388951f80551dcaebf212b396d1f922aec595bd340390d310f6006c4b3efdd80838f39d25470db39d6205ba8f52bac634f8145a3c10ed007acc2f25c5dbfe911f18f44a0c57cee33725eb8c5f2d9112f91787c2c323b67b67d9d1f593f16430d77189d4678fd8d7c11c1f2d744ad59a03a8cffc52ee0293c90b00d61897c80184aa63fcf43c109b06af20c808035af0a0bf9cbe544681768f92a2ebe3b4458dd020fb0550822bc2f769631e00d63bd91e7100299bbc4ce53a35e993e24028dc5c81d46f5377d21f2f38a9688ed981044346b865161b68f3390a50c2e625052396cdb6637e9434904c63d8ca45aa2325626293cdd9cd0179b1d995be10281fa8d281db16320f520e42af268ff30dc2d8885aa3d9e7f294eadb4d827d195cd5d18632928f2153261345c231efd143288b881638b61dc5dab8114c1948d83b8ac4e278f131ec3eef4e87e43a36f4b41a699a741ef3a7cd4f0bc5dbd2dffb1d223a5c5b38b98e49092631a176d15c4f3c077d639726a3482bf2fdc73c2bdb09208aaf90bc64b5fee89d231bb1679de3e5d31662db2c5824ce9941f94500e5a11b8fe79da548efed8cc44e9bc1d5175dd77fc16f8219a83b83ccce2181bf411b0945312598817e08e5277530eccffff17d198613cc8c991349141ced56e79031ab6cb98f3f39e5f20bac76017083041a1ee99ca257d0e0cf95e59617139afb08cf0c6a607d3f2ac2b5d3f4394a4a063c9769bb884ec522d46138228c7e9b5c7ea5e3a6c70815b565ce15a13fd0a5deb28e710c15fe25c744b430b4f6482532fb96566381c56e12632cab5acb5e08d6f973003c96a7d81ff76966e0f93c83c462bfcef230939e48c4983bfed78f68b0f540d1fff2196cbd1f1c1a1c310ec10f5a2745407000bc6db1fcc8540282cc7e96cf5582c4eaf874a2fe6369534176429b7505eb0aade883260806be2d86a42e76b315a76e5f686ca669f49e1f9054a77b8eaff14a43e9a9801244e8e94ff50a17b60dee0122ea70819bae3375070466c7f202c4ea0fc0c9aaae50c43cb65febea224c2b554e937f67689b3e18ed543749a7ef0997a7a7530b918c4ef935137137e1ee7e6a8919fb76a8f008ddcc2d8b2e18f3eb90f7a13cf4f49170ccf50c75de82e92a5e2d1f311e59071ff202b6cae4d6243fc3787cb9fbd401938cc18dcf5620f8b8f74e9e3b13dcde85ef896f31f5a2458118addae77206ab1506882f91873b4828950a7b91ddae74888155a9c486c7c60492813ac0e33362dc4e21e00538e5b05b78271d82486a0d156d4a5a07085bb1cd74f5d63763f18648a489352b5d05107909fe54b5d332cde2900c82c150b11071e028eeb275cc9a9614f1eda4e4830b128870e732d473100c24152aff2aa1659daa65d7e9591ebfcae5dca4e84c9a0965a01668e59843ef4a093d9b01067a0ae9d09e3d810c2cb63600ee05b10fc8685e8cb150e2d6d75baecfb8762f7a7d131417eb0721e19e1d21f5adcc1e09489f06b81d91b48608107fc7b3853e214a3c786a9812113ccbcf09907506d0e9cd72c79793584b4fe06a18a627bd969f628a5936367961f1e7d117d03a8fabc85f5ecdd0ddcfae49aa293893a2e5ae376be11031abc0e05ff250b35926345b52f8d3dc02b7497f7513e759247353db9b8e493120e73981aef4c4d9747621537a089848754c14cda1cad18084274e98ea2bf7400ca846184e0e31a571f9bd770222b1038a4ce60dcf8fe9cca4d60048cc29c37c1345de992e9dc7128ef093c1ce80232a88a3da7ae8bc87120c5b1f405d5186141288998fed9e021cd0ad6b12b51c217849390be3ea00cbd6c755958140bfb9b2a2765ad1f51ac045fdc5c28ee5886b1436015b88bd90d19328f91394110b0d891678e63b63d6cc4d35279f6f616d7692c6fe177a79d80ae8f7e4ad5078d8d7096f3ee664dcdb2f634eba98f4788de1f5e34f32ef09e2f0aee4fdc5bec4bc4aeec5721ac3a2da1bf52da017c3312095403d50dcde39671242b610f13132773796557f71455376a7741ab242a9fc94464180bf224d5e8c79b462e3a816f6c08ab0f5503386d34ddfd808b4b8d5d333548d4b873923c6c297b2fa1abe433ec9264385c50dca40316c37ed85db382e7c853ba331c727043cb3345de9f89b1c804e98205eda3d6b6e042c9c41877d456dcb8f12663e6dc1ba809229536fbcc4c58d01a137eb80af8596dfc7b5fa7a044cd141238aa82e440526e55a28c4ed2f4b26157a0eebb4a77c5ab66fcce2602e1a70aea07e5e7e7e5321d58ad128a5ea6b574730037f24a7300e0ad6fc96bd18e03763bbbf21bd3c388aff1cc5ea13728ba2f8e1eb70148d2603e55bb01cce0763c2020b5627a0ccb35ae3a9b3df380e6d9800d9506219a90971a3b8bde1dae6a43fce2aaecbc026be8f4e9bd749e10c87ed7d78f92014342fa449eef28e7175548e5a8ec4fe7d31fc86737aee63ef40b54485380b6898161676f0d82f76113b12a529fbce4482dd278a90aa416077c677aea623ddb3761bc81527ab7e3d73a3b4c8c3e4352c7c083cee8953ebd972a83caed837587e8d7cf360f28ce6ca71de75c9174e8744ba1098513bb6c7fdc6a3c7c8e5870223d6cc0b18b5d6edea926d5376aeb85488d3712e8f67128f0d3fb2b42f82363a0d4c1c806ff283f6e4ddc10ce4a0803be66a247207d6606c7dd67cd293dada159016d7fd7e88c4df53d09bdd9fd9fa3c732da45fb92bdf6f442eda15edd97bf1928a7699008f0b482240a684ff5efef0cadbf1b4f16888650d59b2bdaeae0d1112a79c5522dd0933ccc16fed7cd0ccabe929f625de8947b3b1532dc04253cca988a1584df2b31492b19410d6f681d614eaa20029592c00c948a98973a9fba87f1397f8859ba543edeb5c0b0db92f65462a1103947d780b539433332d65bd1418bc00c9e815f73e0cc0aca5fcc9f95f707c455013a55a0c4a29093b05b94edc5b5284ec7ccf3ec091002b4229036c174e2927127f40769ece890612bbeb960d9392f442765a2ca8990c52ad7d4441e975a7cf079d139945f2b2a8a34f0e85d76cbc96efbb52cf8b5ae681234e14b6648244d41cfee2d9b189cd831cc2f31ae7e5f11aaaff1629f8c2cf73494ac38e58da7010dd986f8b6134ee0dabfdcb30617d15720cffbec7651f22253aea21696d2ece4fe026543ea2f3473e4c12e65dbb3cbf764ffa0b3a396382b9b7f0c24eaaf3495554b2319b66f3cabf01a8d6cfd1382d94ab71cd11eae2a42e4dc841d4a9732c395688d3377c8ccff7e3f88a3129855a5f41a7de6b6a9ac40a87c288f4821295edfc4f5b8fe5a1fc0162e9820205c809935cc6047e8a835c651be02fb41c21de30ac770d7a7f2108c6a3f1cf2649cac444f028a6ebf4db422cbbdb7fd0cb39109a3130ffae17810bb58f5c557c99670224c2678fa07f1064911e6c665c0d1c26cd2f40f7089789208a48eb339bb8885910e035b4b8c69b1c3ad79270ac6e70b963493a6628b90501822878cdfac866268d914d8af2814612b0198f9e4c6b48e739e414d61f34e2f69ff7cdc4fc7ffe45a64c5faf191ef6c4e31cecebe09a2f6a63d60926ebaa7e925ccea5c93e403c7ec0ee55423ce4893471440006d4c09c141e489dda5577f73b57ecfc764ee5bc1bc88f7866dc6a494e3ee560c956dc12ae51842030251f1cedf2caca15549d0bb4ee3bef03702197350cd7586b5916ef6a0abcb5f30548d22ce5d8c4dbd82030b8d7b5481c51676b7d14d35c20346c74dcc7d96ea0b13f890f755a219993e88739da8246283ebbd82eb1b15956b5ec16ad523768c19ceba9199f97d7bb43b85fa11349ff7fb89a97b463b34c584ae9e2af6c8f20ab528750a22ff6c2297e400065fbd9a4660ec2c658afff6db9b67070352d2aa5e6cfe534eeb5ff271575b828dfd7f537e3627a1a6419ed0c84297fc3d362a52f3860a2eb7ae0a50f06d3c68c4a1463ec331ead7af2dba792332218b04d5b585de1a471d296df6e10316852d50f211e07643f749a1d75410e66e47db40bfcefe4b708d0b2879a50ccbd85939b89fe4b905a6a89a2d5a4e28d18c048e66108a06d8b6a64ec5737b5ae283d914484167c8ac7dde7ec007aad1999854c4d6a0e5f887f99de3662610d5e8d49bac7d41d6fb7d90b4b04939638e2151ba67e75362aded50edfb7d9919b345b5b7df6a909193ce64b20470e3480c68bd764968f4d8a5779ffd9a35e58558272a214ae26a094360b9f2ec97c5e0a7693f4b7509b962cd8537e90ce7be70b54e9531e7295f894b94566df49c50c2265842392dff50e17ed3f7beb9ba4ad0520a73db1d8d3b39759e7fffcbf26517316bc74437fef944fc915ec24affc1a53748cfc883e3ddea9e25063ea8383b06f0d5c9db13a0ff335f52699226b391543060ae5e2c25b585b9efdd5ff9495a4873cac58b5feff5f08717b04e81bfea349accc58fcc6a6505de3aa6ff4985d9c38bb83e8daa663ccb356df3ed52343ed7723687e416816f987c565eae22c7548c1d6b56a5b6819583da0ddf92739f65e604e37b3275a6cb1252d4ef7a515c4b1e9068d714be80066bf0d422f1e4d2ce6f95c9eac081d6e4596a6a8e16a57b732b575b7de16f176ff0e34e84b293d3fd77fa30a7b7cf12a1edd54170e56bf7f2d40620ad56acbc5cc615556300ff9e95ce3dda93c8333f23f0d97a5da12a0fe58f95d6b911f614563d343ac6e4f9fee1d149c94fc75a97ac839b6d8d7b27c5efb870d2bfc6dbe6b688490b23597d83982d7858215c59011042b1957a0b386842621c72f89a9b524008794ffa0c179753ab48d0f73e5ff13624b3b90287edaf6a5367dcfe4094a21ffad3e881b428b77ccac6924d5bde9c781d4189654d8f29885fbde070a004c6406dd3ece359c6ac7c6147f5c4906e56764e9980a669bfdddd9eb780e7f9988630d1eb098b3e4fd4c795f11441fb6d0ff7cf086eb291b1ec8d90092e1eaf9722ccdcd15408617cdb8c49043bf71a6ea0ee6b7e840344fbcd377b995bfb1faf22754fcb363f6c630501b619bbd87cc13d5df0948a176771d2d69236eb50dd313817d9687967e7d71f854db6bff803f4501d999dfe3da37ccfdf894a7914c4c113fa7a18c3468a52d646a5070614a6f02b7ff21c9f6927f5de55be85ba815f4bb9e29f26a94423c58338947c804e0627d69bc5a6e93fc5fe8cae851700253f2d494622c6127b4d77bf54a1ac27957234628cbe2fea1729ec53be7d90806d510ccddfd76fab1b9bf1207db8b05c3eaa88fa4c0a5db13cec9310f4e02c1d8114705446fd6649df3829aa12786b8d10b4540d8c1f1c8208c4b41998435e3fa1ec5199cb2d3d0c5c04c5e0b3ffd69112252106bb39333ff23b38d167a9b45ad1bdabf434c8695e2676d461b34c5f048e70b67a44d824baa090c8be13a22ef0d0970cc7a94ed4b77bfc3a40427c6c11abd2b415817243f6801d535a3adc9924a1671b645100e822a0c1876a37d9c9e230e3d762f1cfbb89a8b28255ba4cc5b46cb1635cf185578fa068b68bac93991982b48e7faacc09745a7e33bb12de6b25a2342a7e03cff06dde29b4d05de84e56c78fc6d9dcd180438da3136767d5846bfe7168faeac5b9434394bd747126c5c1ecc6621d10817ce9b6540433828a3bb8f6da0cd8f2b54a47cd5473f6bc3dc1234bd115a6890aa678d1bce7840d7a4559cda556740860079e46217c20e45ee59b8b7078d9b70cb6a249eb2e5e4071d044f456fb61649f261689b8d7a532afaf88eb30041242ce491fb7e654a1f06add370e2706f75c2fe1afe8e065804414c660ec4d96f496b1ad87592de8b7d04baa7ab142f580f262c64c57fce8ef933f18904f001809cfdf94eb679c9eced5d125b4f1d0064ca2ccf5eaf61bb7841bd408ae213deeb15d860f7ee7224b9d2dd38ee9f6c3fca6590335715c218db8f8c98e6339a6944817a1ce2e115ae984699861631b9893c143f594d6dde0895a0c7edb9912f3fcd8fd0765227b3963033306d15711387044bc373ac10d7be73cd80f1a79cf1ea0989ea9ae8a0dbbd1227bc33df652792a6bd95f1d21c6497c4c35b9a1eadc0217e322285a2eb832753aae74ef42fc983e58a126b7c23e4b0bac16f0de1eff7d41477bb25052f32cc9cc956ebd209d6b945b1fa9182857e180672a6be7edeb5234830668b1ea749d0a0dd3a244684d4dd76221c3bdf98c2f1eacb7a6dcccafd249b0ba2592c88790de40895799ea4dfb045cc2392dbb623bfe420b24e5a425b84a4b24d787a68bbec9db363ac4e9453df597f0224d8b7b21629e1989e53accbae97e189cf9b59ebf8bb89591fe3fda450af548ffc46eff98b5216e238a9246e2fb95810f8f4d89504633a6d223484a765b9e6e5497159b31c51fa6cc10641bafa81b10c5ab853f3136fa1b4334bcbde99cb4689f077ca3c29c2f1aca2a05762943073d5992aac4d9b0d411ba25905c34fd02b8eb7b9db375a6f6516446cc195eb55eda1e007e26328e9e2642a9c4e90c56440cc60a1db77713860a56820901b3022d55c621e9d54f759dd17fc5b59331c63cf30e07081bf0cdee6cc94ddfe8c6179e7ed86607d4ba7d5f1e97fbc1139b43ae5fd04c1c715f4600f028d0852a421d472b1b48e591b6edfebcd86be3db2caf967b06776096e14f0deffc9bb126ec329c49ada996b963e942d9c404967dc23bdbd0eee951b2879f2ef7ae224d4ff25edac4ddeb2c0b8e579af283e87c625d3fae5286fa855930e45207af7054763937a9247dc38e37e6dee2e325b617280846012e463707b6ccfa2fc399a66e534221a45626cd18c79d46f5c77c2d359e19ea870cd230709b5e33cd52fd43388ef91dea0a1e0df6c72688d9fd32bb67f489a3618604ef1dfa0d7f569d40cc68e39994e4edab4007c988998f59485ce4723c1eeb7c72f7e833418bab47735a91c7ab24e8555d2ccf3a812b6c634c0c3a68271ec8b536aaa442e056945feca6fb4e54d2cf60a0334f494b2bdb6fbd597de0ce9d2cf03333a0c7121e086aa4c657360fbfb60f3ce0fc0d90ff12b03464e8ff0e5e546ff79735c5c800a0f9b680a478c772f60173a760e280d8287681986038444f2103e2894d5809d062cfe8380e34bca86475da3d7634131c2a8cdc98c5927bc137db61f94eaf9a74f87cc85072c201766eae17fbd5b732859fb1b1c980b36e377aa41a95bca18ccea529420e742899af7b968c1fb9c0d181da9f86358dbeea877c3e9123a9289c362fa61d96c707ac94b427318a1e5f21078aa9d1fd7a52704e0d73e527f3ca65b7b459734dd30db5335c450f1dbcc1e4259d657d13b6d6b4adddc3d0eae034d1878cd0aa1825991d75f8e6b5b4c0d6d17e8ce709b19ff794a8ef856abdfac65cd13631f1b66b20f2ebf2f3122d18e03cbfff88206a5998fc3cb2b40634fcecdb8f5bdbfe044dbf169ccd2cd60f7bf033272f38f587943fcc75d2d65d9028c02891c8415706c2b2459b7a3c5cc82b0446088d3b3bcc033ad453136afd4ac4678320fc17288dbfa1c5180ad57508a2a298ed4ebc716ede34fded574d9779be5d56517d4dd40f197312390c488f46914b0927b13901ce70c1684801f2811168fab533998a1fdabbb6e683abfa021f6b80077f19455c34cecf5dbdb2fa6e3930eb5940cb14504050cc74249424310dff81116b8f2076b8ebece84c302e758fa90af5a1888aa8a5a2bff4aeb7ebd1c7a216bdbb84bf9c021caf3c8efbfdc5d3aede46381bcda372a5398c89868ad57287736fec2a7e8ed638974fde5875eafa506a6bd7f772d2b221f4bde4920fe0c56f8e0847e2a7e8387c64ddef4203d77a526c46d7871befe0c5f9128bd67319acd963fc040185aac4e7815f728bbd7ffd8f3d125e63320182f202fa9a52505be9585556a5d1308c118ccdf01978027cbace7ab339d6f53d15e795b7f3fedae4f86c3f257ed80ee634375dc2333ceed1ccaeab1b6be7a9611ff33d79dccdec2007558c06dfc06612d56d37882e5f1de340cf05f4fffbe1a5def6d045bc5bdaf633f07360f9028cedd103bf03fec8beb9fdbf8c5fc684d12efae1859c53e2cc3e2f508a9cd0410ec036648d3760dd591f7ae04e4cdd61a2566319c943f0b63d87e422dfe5c0d1edcb2dc515778a0d7bb2c93ced3b1435adbc51d3fdca9c13679397bc4490093d64869998d6a28bb862ead0fa411585289cc00dc199eac6c607b8a84123dad3be80dd8fd86aa202113131046336352235f34c05f5ea6d5265adda98edbbfd11d6839c5b1bfe4fad4e688558d633d4a281df44d9c0a35abd464e01f8ab01a1e272cc8cd155a40b8aca4c6b1dc894c0fdc02f15a8f67ce94c7f99b6fcc0e4a3a8a71365645ad7809d47bb26f46ed8bd02f6e8f3d277224f82f3d41695f367e343ac6d507413f4bdacf9e344a49156c4de36d68c075415f8004748055b38b8a4110f869fafcc59cdae5663eda72a05be365a50e98bfd4b00e35aef687afae7bd6622cdd725326776f6fb1476c8cf8c20a0e5223e2bea494a1bbe4e79b25a5e48ba34bc66a84ecc4a0aba98e74ca2b1f61893e61a29498d855a778a2a9ce7b7fcaa44b4aedcbd0e28d6c49bdb6776975bf69161f372b964e4288ce6a3b877c3126f90c4c9749d45b8c5c840983b035993e484a945be5fc9d2d1bd3f3de4e6de7bc74a7a07b13e9e82acc11db85454f1d928fe52ad42ca783fd20dd3e94471b498c2736af40d2a45ff74f9ef874639e33306daa8a667674571e2ed93a48f49b57e9e3382fa8090774bc795609ee510b6a1ca48d9833819cbe8ac77eeebb0e3b6c59ced2d1ab355264934ff1914a3f654249bba60a692dd36368b8a866b333320e57e9c7d3646c375696ff14e303780ffd7b957d89ccdf57823d2d1e158773c2075233dd2f331eafe3802da683c293eaa24cd8b63a7582ddb202cd6f8c837c74f823727641c7eb680fe51ce7f250adb34956e4cab17b8a5f10edf144c700e376c682dd46c8fc89830fee1a44fafe0a5a2e7581d5d16ad6267d1dc2d5be8547f9352d1591b42de94f2559b44a80038360c6394541a77d95b196558a479b609882fc597b9cbe285ad7c7a41133ed85c8ab6e6dec5bf70f9e787985512d48865022705098a6703b255a6f2b05b62fc7ab32e67f06d785ccb33fb348205a76939e6c2991486c5aae8ec1556b2f8e30ca445a4a495cbf2c6013042b8cea615e58899fccbbf1fc4f17a6dc37e46b17ada0be033dc67904fbd7903086d3417e423af64338426a84ca0c2a3252db62695f9cdf10ebc09b9da5747d30e7f4adfb374e1d2bb24542b0373b1fb897690b49fe24d8575ec9800f019c9c76459421c11f002989ac82c13c04a202cf7f9f38b053f9a680d4d5012887a11d25cad201df20a4eee6d2c0474055579ac729c7514a88b1675bbf6b773448c6c1a5ccd157f44f7e032a6b848f2e734d773f029e48fd13c90d41666f9bd4e9bea91950737b6e7502f9d2677938f240e3f905d6095bb0f8bbe961b99b2d025538c3888bfff8957e3592ee5326a75399b59c697f59fcdfbbe3bcffb8777340875611bf75486d2378e68de771800bfffe0572fb36ca855ec5fc8cb90c76455773c36ec40b101fb30c48f8a8e775f5220e024b4da9dddc2fcf4da413e7c5db9e0567cbb5fad0c91d779a0939debd9247d3f7d8107fd986f73a9c9067e6594fabde0b9e887040cfbe7d31332f41259de57b38f33275597725392efea51f290b8e1b5c243ffd9eb4c0231600f9b4b204344736849d527156c4720a463bbe88fbbdc333099d949853d5c6fda98bcd35ad3f1fb1d5a7d00541a8a202c8590e35360bb9d25d6431476649e1898f901fad37975d6dce9833956e7a78d0306f533d4aa3c9676017c7abc7e1f8f2f117774a4f5beba55d1c3cd580fb18defccc349cce24e94a4cf1f4c6f45d783ee0167a55369c9b5e1eb6d0a836f3eb2354fad3cd771a9d777ff84c63120baee86ddc52b3e6817dce339ac9c240e75f3e2f77afbffbc1d54eb5936d045370ce3b77365c5320892dc7bc36e488019461d2e552969de9f25bd8de049d693be450c43c5d22d7569fc384e8d56ddb577c5f3c3471f5ba2998bc0c697a06b6d8ba5f2f7236e78aaed69b468e761a5f07145c0326ebb94f50aaa8c5666c92006d8d139036f981003933f8e2eba106a0e251fa9f5407544e44aedbbb271a3bf1c660a9cb8c74dbd0713aaebba2dd046af8b9428709646521d6bf387a92996b35748e1e67b602309b7da0fb642e89de19f550925f4db082ef7e9821ac4b2aee93c9cf791c086751c4cb4172608a4f903dc40727858046851529205b45786e294c17abf5e5f6bc730cbfb8fd977c5501a8140ac7984a267880b53cb94157be9ac157be1cf12d8a9e5612947772b734ed6ae30e548a3b2faecf94a7e03f86317f52ac797aefb957d2a29de8f8ced414ce22c800e0dc7e49d3672fca633248f3e68c00", 0x2000, &(0x7f000000dcc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x78, 0x0, 0x8, {0x8, 0xfffffffe, 0x0, {0x4, 0xffffffffffffff9f, 0x10000000000, 0x8, 0x40000000000003, 0xfffffffffffffffe, 0x0, 0x7, 0x52, 0xa593e9c1ca988eda, 0xffffffff, 0x0, 0x0, 0x9, 0xe}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) syz_fuse_handle_req(r3, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080003006400000008000200c8"], 0x2c}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x10}}, 0x0) pread64(0xffffffffffffffff, &(0x7f0000019080)=""/102363, 0x18fdb, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff) listen(0xffffffffffffffff, 0x1) setgid(0xffffffffffffffff) 4m40.040642837s ago: executing program 35 (id=842): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='0', 0x1) socket$inet(0x2, 0x4000000000000001, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000000080)={0xb8, "a4666028c1b6e2f7b1f2b554f6fe9816e7687f2926c5103d0888e24293a666328f3db3c805f7c2c123e9372cca7603c9868948c79c74c7daeedf820bbe0bb80a82ef8b81ac1dfddc962a00f07b50ca85cb5364ea279d2dbcd4556811e988235d090e2088ef21be92d01037a85ff1ad34ad9f463fdc29162a81ad0181f666e6b47158113dc9c3f4b24d29cfc0b2b18c34d6592190425cdd5ef4c561b4ca36a55dbe0026bbb31e40f1a8168d002eab0eb5eef596fb41631821e84e65add070bc4fd6d4bfb7d05d5dd0ce89cc081a84fe02587fc9ff0fe5a51cd364ce075029f6bf3b991e74d11cd433721022894a47e526d9ed8a230aa3198168c4f45eff149d7cf622bf3571e2f87a31ca0ce723a16ae30180e060b9638efd9b3c1aadc0ad33033ceecac06fcf0cc3362f46a09cf569f373f8dc29f582dce04d78b23d988eaefb980ddb4edf9e4d7d343bb9d151d6ee82717337c155b781d663a4123867493c0bda03ef45011421ed0237afdaf83027ced0a271092095b0840b356f83230e53bd914edd076ee85bb49fc885bbba75d35366d54a31bb1219b1acbe3c8dfe0180a896bc656774c9ac5c9da695aac7a2a981072ad4db30b396e75ad4b436e77b1247aad3283ac72122bfb0fd872476450a8055abddd7f3bd96e74d07c332a03e3a3f5d9c64d842eade01a719d75866a69e4cd9f5b7659ee83035e5890b325b435552"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000a00)='A', 0x1}], 0x1) r3 = getpgid(0x0) sched_setattr(r3, &(0x7f00000002c0)={0x38, 0x3, 0x10000000, 0x9, 0x8001, 0x7fff, 0x6, 0xffffffffffffff88}, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r4, &(0x7f0000000380)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r4, 0x5) setrlimit(0x7, &(0x7f0000000300)={0x6, 0x581}) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x68, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffffb}, 0x2}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000001680)="89", 0x1}], 0x1}}], 0x1, 0x20000000) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000140)=ANY=[], 0x8397de475a1b5b02) 4m39.956719288s ago: executing program 36 (id=843): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) sched_setscheduler(r1, 0x1, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a76b1a03dc55ea62d43c809e0ed6e56162fdab317afd5c34d614367e4425bb9a97e38b8beb840200549eed5aaa86dbe646fc95b4b88e2afb55ae6f1229bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dca30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec907000000ba5ae65e31f00e641832d29ed658b91f349b80e830fa29fc891b8b0d2de59d006ce210a0351b6bbd06c77c9aa67b5d7287fc1bfa1d0bf035ccdd4b20d7f95b5c77afde046b146ce8b395126f00000000000000000000aa7c93213bc6ef4da9e28ef7", 0x135, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x0, 0x0) add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135", 0x1b, 0xfffffffffffffffe) syz_open_dev$video4linux(0x0, 0x3, 0x42583) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x35, 0x1, 0x2, 0xb100}, {0x25}, {0x0, 0x2, 0x6}, {0x6, 0x0, 0x83, 0x5}]}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r9 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r9, 0xc0045006, &(0x7f0000000040)=0xc) 4m39.754365577s ago: executing program 37 (id=836): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x5, 0x30}, 0xc) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f00000005c0)={0x8, 0x0, 0xfff, 0xfffffffa}, 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x13f, 0x3}}, 0x20) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000140)={0x3, 0x4, 0xfffffe2f, 0x1}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x111, 0x9}}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000540)='highspeed', 0x9) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000240), 0x0, 0x4004, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newpolicy={0x418, 0x13, 0x20, 0x70bd2c, 0x25dfdbfc, {{@in=@loopback, @in=@loopback, 0x4e22, 0x8, 0x4e20, 0x0, 0x2, 0x80, 0x20, 0x1d}, {0x38f8ee90, 0x3, 0x1, 0x5, 0x5, 0x6, 0x6, 0xfffffffffffffff9}, {0x9, 0x59b, 0x0, 0x100}, 0x1, 0x6e6bb5, 0x1, 0x1, 0x0, 0x2}, [@algo_auth={0x119, 0x1, {{'ghash-ce\x00'}, 0x688, "d6f5f952edb39bc36212f77651d94bb99c6abbc2d0ec0f2ec991178abc1e29a7306e399aa3c330663ffbee4b0caa757637409070e8725fe5c9476a120019e22e4d8d4e4b2ff3a0e4bf7cfaa89b403411f5732f9aa11a2807ff853b9a46c14874d5d8c5e0950bf432aae413cd144ffeda7441ce87faca56a1b5a69eee715dc6f7005ae761e1f0b8cfed2f049134d57dbf96c8af10d59ac08dc48ac96c228c13da1bc4a598bd100fcb058889b4c6ac1c32c1a2a1640e08c1606d34db4677059579303d4f085d5aa2075cf035ba9d99f4d7ad"}}, @XFRMA_IF_ID={0x8, 0x1f, 0x1}, @tfcpad={0x8}, @migrate={0x9c, 0x11, [{@in=@rand_addr=0x64010101, @in6=@empty, @in6=@dev={0xfe, 0x80, '\x00', 0x3f}, @in6=@dev={0xfe, 0x80, '\x00', 0xb}, 0x6c, 0x5, 0x0, 0x0, 0xa, 0x2}, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x33, 0x2, 0x0, 0x34ff, 0xa, 0x8}]}, @srcaddr={0x14, 0xd, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}}, @algo_comp={0x7c, 0x3, {{'deflate\x00'}, 0x1a0, "b8fbeaad81ad24611ff289cca8eef0f4471dba0678379c3201792e46c9be4427142d219b63f484324ac722e05e09c935d60f4683"}}, @lifetime_val={0x24, 0x9, {0x4, 0x6, 0x3, 0x5}}, @tfcpad={0x8, 0x16, 0xcd57}, @sa={0xe0, 0x6, {{@in=@broadcast, @in=@local, 0x4e22, 0x0, 0x4e21, 0x1ff, 0xa, 0x20, 0x80, 0x3a}, {@in6=@mcast2, 0x4d3, 0x32}, @in6=@remote, {0x6, 0x100000000, 0x41d385c9, 0x5, 0x6, 0x4, 0x2, 0xde9}, {0x0, 0x1553, 0x8000000000000000, 0x9}, {0x6, 0xcee1}, 0x70bd29, 0x3500, 0xa, 0x2, 0x6}}]}, 0x418}}, 0x4c050) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f2f00db5b686158bbcfe8875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100008}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff00}, 0x48) socket(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 3m48.216393128s ago: executing program 38 (id=942): r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000640)={0x403, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) r1 = mq_open(&(0x7f0000000000)='\\_1\x00', 0x8c2, 0x30, 0x0) lsetxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), &(0x7f00000000c0)=@v3={0x3000000, [{0xffff, 0xe000}, {0xc, 0x5}], 0xee01}, 0x18, 0x3) mq_timedreceive(r1, 0x0, 0x0, 0x45, 0x0) 3m45.555109185s ago: executing program 7 (id=955): r0 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000480), 0x4) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f0000000140)=""/123, &(0x7f0000000240)=0x7b) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) read$FUSE(0xffffffffffffffff, &(0x7f0000004180)={0x2020}, 0x2020) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) creat(0x0, 0x2b) acct(&(0x7f0000000040)='./file0\x00') unlink(&(0x7f0000000040)='./file0\x00') recvmmsg(r0, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) sendmsg$tipc(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x3, {0x1, 0x1, 0x2}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000500)="e8", 0x1}], 0x1}, 0x4800) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000080)='configfs\x00', 0x0, 0x0) openat$tun(0xffffff9c, &(0x7f0000000280), 0x2000, 0x0) syz_clone(0xa000, 0x0, 0x30, 0x0, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) 3m45.379179129s ago: executing program 39 (id=955): r0 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000480), 0x4) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f0000000140)=""/123, &(0x7f0000000240)=0x7b) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) read$FUSE(0xffffffffffffffff, &(0x7f0000004180)={0x2020}, 0x2020) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) creat(0x0, 0x2b) acct(&(0x7f0000000040)='./file0\x00') unlink(&(0x7f0000000040)='./file0\x00') recvmmsg(r0, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000001c0)=""/10, 0xa}], 0x1, &(0x7f0000000c40)=""/176, 0xb0}, 0x3}], 0x1, 0x2122, 0x0) sendmsg$tipc(r0, &(0x7f0000000200)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x3, {0x1, 0x1, 0x2}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000500)="e8", 0x1}], 0x1}, 0x4800) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000080)='configfs\x00', 0x0, 0x0) openat$tun(0xffffff9c, &(0x7f0000000280), 0x2000, 0x0) syz_clone(0xa000, 0x0, 0x30, 0x0, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) 3m19.951008382s ago: executing program 4 (id=1118): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/split_huge_pages\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1,', 0x2) 3m19.886742295s ago: executing program 4 (id=1119): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000380)={{0x1, 0x7ff, 0x4b, 0x8009}, 'syz0\x00', 0x8}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0xfffffffffffffffe, 0x2) dup3(r1, r0, 0x80000) syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') (fail_nth: 4) 3m19.885793506s ago: executing program 4 (id=1120): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2a082, 0x11b) write(r0, &(0x7f0000000000)='7', 0x1) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, 0x0) quotactl$Q_GETNEXTQUOTA(0xffffffff80000901, 0x0, 0x0, &(0x7f00000003c0)) 3m19.802315839s ago: executing program 4 (id=1121): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x3c, 0x0, 0x923, 0x70bd2c, 0x0, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24044014}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7, 0x400}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_SCRNMAP(r1, 0x4b41, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x20341, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/kvm/kvm_hv_stimer_cleanup/enable\x00', 0x8200, 0x0) write(r3, &(0x7f0000000400), 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='stacktrace', 0xa) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'dvmrp1\x00', 0x1}) ioctl$TUNSETOFFLOAD(r5, 0x400454d0, 0xa930bb9f3fd061f5) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f0000000240)) ioctl$TCSETSF2(r2, 0x402c542d, 0x0) r6 = dup(0xffffffffffffffff) read$FUSE(r6, 0x0, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0xc100) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r7, 0x4010640d, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000000145802, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x103381) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r9 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$cont(0x21, r9, 0x8, 0xffff) dup(r8) 3m19.632290286s ago: executing program 4 (id=1122): r0 = syz_open_dev$I2C(&(0x7f0000000100), 0x20004, 0x70000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0) getsockopt$inet_buf(r1, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x24b) ioctl$I2C_PEC(r0, 0x708, 0x3) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000980)={0x802}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1800000007319ef77945c044b90039637ba9151863000077899deaee95ab271c000000de000000"], 0x18}, 0x1, 0x0, 0x0, 0x4040000}, 0x40044c4) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) ppoll(&(0x7f0000000240)=[{r5, 0x2280}], 0x1, 0x0, 0x0, 0x0) write$P9_RSTATu(r5, &(0x7f0000000580)={0x21e, 0x2, 0x0, {{0x500, 0xdd, 0x0, 0x4, {}, 0x3810000, 0x0, 0x0, 0x0, 0x1b, '\x04nod\xff\x01{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, '\xc6GtZ\xc8YR\xbf\xe0\xb0pg>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4', 0x2, '\b\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0x0, 0x0, 0xee01}}, 0x21e) fsconfig$FSCONFIG_SET_FD(r4, 0x5, &(0x7f00000005c0)='fd', 0x0, r3) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r4, 0x0, 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_GET(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000740)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010002000000fcdbdf25310000000c000180080001"], 0x20}}, 0x4000000) fchdir(r6) r9 = open(&(0x7f0000000200)='./file1\x00', 0x10240, 0xc2) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r9, 0x9362, 0x0) r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x10) write$cgroup_int(r10, &(0x7f0000000000)=0xb00, 0x12) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYRES64, @ANYRESOCT=r2, @ANYRES32], 0x60}, 0x1, 0x0, 0x0, 0xc0}, 0x0) ioctl$DRM_IOCTL_RES_CTX(r6, 0xc0086426, &(0x7f0000000240)={0x1, &(0x7f00000001c0)=[{}]}) 3m19.372298332s ago: executing program 4 (id=1125): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x0, 0x80000) mmap$usbfs(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1000006, 0x20010, r0, 0x6) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$unix(0x1, 0x5, 0x0) getsockopt$bt_hci(r1, 0x0, 0x1, 0x0, &(0x7f00000000c0)) 3m19.310591164s ago: executing program 40 (id=1125): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x0, 0x80000) mmap$usbfs(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1000006, 0x20010, r0, 0x6) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$unix(0x1, 0x5, 0x0) getsockopt$bt_hci(r1, 0x0, 0x1, 0x0, &(0x7f00000000c0)) 3m6.045456841s ago: executing program 0 (id=1210): r0 = socket(0x10, 0x803, 0x2) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) (async) r3 = socket(0xa, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000540)={'veth1_macvtap\x00', 0x0}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)={0x3, 'rose0\x00', {0x5}, 0x81}) (async) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x14, &(0x7f0000000180)={0x40, 0x10, 0x8b, {0x8b, 0x22, "6ebeec66734c9d5185af46166246ec1f96c1960076c6e8e172f247fa1db9eecec81b5ebfd2f4c5293ab0e06a8b6ec246ca4cd2bf478ce03711045f24458e6f01a45d5cf60ab41c43d1f398b3200ee8e42b055c9a7929146c9206d904ba09329fd6088bfb4f60eab6373c03907fb02d9a81cc92439437b2dd344282fcf5a801c4e44c1f44d3454fe55d"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3829}}, &(0x7f0000000280)={0x0, 0x22, 0x15, {[@main=@item_4={0x3, 0x0, 0xb, "ee2a96f2"}, @global, @global=@item_4={0x3, 0x1, 0x5, "20b150a4"}, @local=@item_4={0x3, 0x2, 0xa, "6f6174d4"}, @local=@item_4={0x3, 0x2, 0x4, "c3555c77"}]}}, &(0x7f0000000300)={0x0, 0x21, 0x9, {0x9, 0x21, 0xc, 0x9, 0x1, {0x22, 0xa50}}}}, &(0x7f0000000640)={0x18, &(0x7f0000000380)={0x60, 0x8, 0xcb, "26310aa4499efbb7019308bde6331e8744a2fc7e848520ea06ab41c08f3715655be2fff0c695f3deae974d6e79efa6627d840200171c2fd6ebd2d6f1d2c7d12b71df6c8cd8b5a7382cfcbc44c19ca6d8df451442446b5a8f6406d31cd4ca746002e849e3d4b9c599b9beaeeac1e4ed489d38889fc2164dd441c71114230c4ad80b224e94fbe15de72eca7ee93cefe6ae27168907426dcf3a90b4d14ad585d792ebb53c81395d6a7d9b62ebfee8b7ad56cce39ca26d49508b363fe4055aa502ff886dd69a489b2d5dac3f80"}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0x66}, &(0x7f0000000580)={0x20, 0x1, 0x69, "c4bc58e7a7d4cf5ed3de3e57e6fb07c423757a7e2dd58b86b269b089215aa89cf7907130ec561574e2da81978273fa90c29bdc998a0146c4d8647f990ca7069aacdf416c69f7822dbdc7600016cacba42fafedb6a993aebd6050d8760d5a47b0df9efd8aead4a23a30"}, &(0x7f0000000600)={0x20, 0x3, 0x1, 0xc}}) (async) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbfd, {0xa, 0x3f, 0x0, 0xfe, r4}, [@IFA_LOCAL={0x14, 0x2, @local}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x14, 0x3b, 0x1, 0x20, 0x0, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0xc0}, 0x40010) sendmmsg$alg(r1, &(0x7f0000000140), 0x4924b68, 0x0) 3m5.386836911s ago: executing program 0 (id=1216): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000080)=[{0x0, 0x0, 0x4, 0x0, @tick, {0x0, 0x7f}, {}, @raw32={[0x40000000, 0x0, 0x7f]}}, {0x8, 0x0, 0x0, 0x0, @time={0x0, 0xff}}], 0x38) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) socket$nl_generic(0x10, 0x3, 0x10) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) close(r3) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x1, 0x4, 0x32, 0x1, 0xffffffffffffffff, 0x7, '\x00', 0x0, r2, 0x3, 0x0, 0x3, 0x2}, 0x50) readv(r1, &(0x7f0000000480)=[{&(0x7f0000001140)=""/136, 0x88}], 0x1) 3m3.576819554s ago: executing program 0 (id=1228): r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r0, 0x0, 0xffffffffffffff9c, 0x0, 0x44) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) fchdir(r1) close(r1) move_mount(r0, 0x0, 0xffffffffffffff9c, 0x0, 0x75) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@ipv6_newrule={0x24, 0x20, 0x1, 0x70bda7, 0x0, {0xa, 0x0, 0x0, 0x40}, [@FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e21, 0x4e21}}]}, 0x24}, 0x1, 0x0, 0x0, 0x24040804}, 0x4008000) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x40084) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/apparmor/parameters/debug\x00', 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1}}, 0x24}}, 0x0) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(r3, 0x40106e8c, &(0x7f0000000140)=[0x6, 0xe71]) 3m3.312803922s ago: executing program 0 (id=1231): openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) creat(&(0x7f00000000c0)='./file0\x00', 0x48) eventfd2(0x50, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r2, @ANYRESHEX=r3], 0x15) r4 = getpid() prlimit64(r4, 0x7, &(0x7f0000000200)={0x0, 0xfed}, &(0x7f0000000240)) r5 = openat$vcs(0xffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x162}) fcntl$setownex(r0, 0xf, &(0x7f0000000100)={0x2, r4}) 3m3.23445827s ago: executing program 0 (id=1232): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) sched_setscheduler(r1, 0x1, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a76b1a03dc55ea62d43c809e0ed6e56162fdab317afd5c34d614367e4425bb9a97e38b8beb840200549eed5aaa86dbe646fc95b4b88e2afb55ae6f1229bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dca30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec907000000ba5ae65e31f00e641832d29ed658b91f349b80e830fa29fc891b8b0d2de59d006ce210a0351b6bbd06c77c9aa67b5d7287fc1bfa1d0bf035ccdd4b20d7f95b5c77afde046b146ce8b395126f00000000000000000000aa7c93213bc6ef4da9e28ef7", 0x135, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x42583) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x35, 0x1, 0x2, 0xb100}, {0x25}, {0x0, 0x2, 0x6}, {0x6, 0x0, 0x83, 0x5}]}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r9 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r9, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r9, 0xc0045005, &(0x7f0000000640)=0x10) 3m2.554579247s ago: executing program 0 (id=1233): openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x101002, 0x0) syz_io_uring_setup(0xeff, &(0x7f0000000540)={0x0, 0x5961, 0x200, 0x2, 0xea}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file0\x00', 0x10, 0x1) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000fcdbdf2503000000140001800d0001006574683a6772653000000000f6c94d75fe8775ae3d4f743785d429492200525363d6e0a5cbe34135fac2e8c29539740f8f4662a40a4c7029dce81d26d73b8213eff1a27f2935d72965bcbf217ce8f8c2002168a00a8308c534024c47157190dc7d7292617a0abf3be09f6b2a6f858d20bdb02b4478bad3b404fab78daa1ca74a926742cbc3d9ec5efabdd1c06e91298374d35500e075ef3639835c4498b42d715bce4a4c4e343c9cfc1b"], 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x6, 0x7) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x0, 0x34, 0x0, 0x0, 0x400000}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x10000) ioctl$DRM_IOCTL_MODE_CURSOR(r8, 0xc01c64a3, 0x0) connect$bt_l2cap(r7, 0x0, 0x0) sendmmsg$sock(r7, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x2a18005, 0x0) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000180)={0x1, @win={{0x0, 0x8000, 0x2, 0x2}, 0x2, 0x0, &(0x7f0000000340)={{0xae04, 0x5, 0x6, 0x7}}, 0x8, &(0x7f00000003c0)="8274afbe70c5d8d90a9e78d93f4f57b42b3cd4f02b8cdd406dc1862155ed637fab3e331e05d79f94d93bba15569c4da7e5961ca1229ad0f4702379d1c22b9febc080607d", 0x4}}) pipe2$9p(&(0x7f00000001c0), 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) 2m46.542780509s ago: executing program 41 (id=1233): openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x101002, 0x0) syz_io_uring_setup(0xeff, &(0x7f0000000540)={0x0, 0x5961, 0x200, 0x2, 0xea}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file0\x00', 0x10, 0x1) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000fcdbdf2503000000140001800d0001006574683a6772653000000000f6c94d75fe8775ae3d4f743785d429492200525363d6e0a5cbe34135fac2e8c29539740f8f4662a40a4c7029dce81d26d73b8213eff1a27f2935d72965bcbf217ce8f8c2002168a00a8308c534024c47157190dc7d7292617a0abf3be09f6b2a6f858d20bdb02b4478bad3b404fab78daa1ca74a926742cbc3d9ec5efabdd1c06e91298374d35500e075ef3639835c4498b42d715bce4a4c4e343c9cfc1b"], 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x6, 0x7) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x0, 0x34, 0x0, 0x0, 0x400000}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x10000) ioctl$DRM_IOCTL_MODE_CURSOR(r8, 0xc01c64a3, 0x0) connect$bt_l2cap(r7, 0x0, 0x0) sendmmsg$sock(r7, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x2a18005, 0x0) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000180)={0x1, @win={{0x0, 0x8000, 0x2, 0x2}, 0x2, 0x0, &(0x7f0000000340)={{0xae04, 0x5, 0x6, 0x7}}, 0x8, &(0x7f00000003c0)="8274afbe70c5d8d90a9e78d93f4f57b42b3cd4f02b8cdd406dc1862155ed637fab3e331e05d79f94d93bba15569c4da7e5961ca1229ad0f4702379d1c22b9febc080607d", 0x4}}) pipe2$9p(&(0x7f00000001c0), 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) 1m43.771105058s ago: executing program 8 (id=1898): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000100)={0x3, 0x2, 0x1}) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x11, r0, 0x0) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) 1m43.606446831s ago: executing program 8 (id=1899): r0 = shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4) shmat(r0, &(0x7f0000f62000/0x1000)=nil, 0x3000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(r0, 0xc) syz_ublk_setup_io_uring(0x2327, &(0x7f0000000000)={0x0, 0x4e3b, 0x0, 0x3, 0x135}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x3, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80400000, 0x0, 0x8, 0x0, 0x6, 0x2, 0xfffffffb, 0x39, 0x747d5e13, 0x802, 0xfffffb9a, 0x0, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x83, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x10001, 0x1ff, 0x8003, 0x0, 0x3, 0xd, 0x3, 0xba55, 0x8da8, 0x4, 0x80200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x7c23, 0x6, 0x6, 0x9, 0xfffbffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x1, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x3, 0x7fff, 0x72c, 0x1c32, 0x3, 0x6, 0x10000, 0x400, 0x7ffd, 0x3, 0x1, 0xf, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000001, 0x10, 0x10, 0xfffffffd, 0x1, 0x1, 0xffffffff, 0x6, 0x3ff, 0x800, 0x7, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x411, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x80001, 0x8, 0x7, 0x200, 0x3], [0x401, 0x4d, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x7, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x400, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x5d7, 0x9], [0x108e, 0xffff, 0x7, 0x3, 0x88, 0x2, 0x1, 0x4, 0x4c, 0x2, 0x764, 0xb, 0x402, 0x1, 0x9, 0x4001000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x2, 0x2851, 0x3b, 0x20000001, 0x8000, 0x5, 0x1, 0x65f413f9, 0x4, 0x20006, 0x1, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x10, 0xe, 0xffffffff, 0x7fff, 0x80000000, 0xfffffff5, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x1, 0x7fffffff]}, 0x45c) ioctl$UI_DEV_CREATE(r2, 0x5501) readv(r2, &(0x7f0000001240)=[{&(0x7f00000012c0)=""/41, 0x29}], 0x1) 1m42.912443215s ago: executing program 8 (id=1901): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='#\x00\x00'], 0x48) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x8243, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x3, 0xff, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x2, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x240, 0x10, 0x4}}}}}]}}]}}, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x700000, 0x0) write$binfmt_misc(r2, &(0x7f00000001c0)="a38b9e1dfad9ed91038ccc99e7683de3ad32de6be60eeeb0369598c0f00be02cea0ea14abb9da8b2af16688689327dab21c9ff0c13350d703a8a79318fac33ac326bcc737f6579905b9c427f1b81d840e17591f5d289da80fbd3f97c80200cf742de3804a6ba33846c9cbd6ce729200968032c1b8c65437d08a7f0dd", 0x7c) r3 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000040), 0x2, 0x2603) ioctl$I2C_RDWR(r4, 0x707, &(0x7f00000000c0)={&(0x7f0000000380)=[{0x41, 0x4000, 0x0, 0x0}], 0x1}) syz_usb_control_io$hid(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nullb/nullb1/zoned\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)='1\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/nullb/nullb1/zone_nr_conv\x00', 0x2, 0x0) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e08091b0c"], 0xb) write(r6, &(0x7f0000001400)='2\n', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nullb/nullb1/power\x00', 0x2, 0x0) write(r7, &(0x7f0000000700)='1', 0x1) r8 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000e2793b10d10501200010010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r8, 0x0, 0x0) syz_usb_control_io$printer(r8, 0x0, 0x0) syz_usb_control_io(r8, 0x0, &(0x7f0000000c40)={0x84, &(0x7f00000006c0)={0x0, 0xa, 0x3, "3846e2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='\x00', 0x81001) unshare(0x22020400) r10 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r10, &(0x7f0000000140)='.\x00', r9, 0x0, 0x41) 1m42.271458342s ago: executing program 8 (id=1909): r0 = shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4) shmat(r0, &(0x7f0000f62000/0x1000)=nil, 0x3000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x3, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80400000, 0x0, 0x8, 0x0, 0x6, 0x2, 0xfffffffb, 0x39, 0x747d5e13, 0x802, 0xfffffb9a, 0x0, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x83, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x10001, 0x1ff, 0x8003, 0x0, 0x3, 0xd, 0x3, 0xba55, 0x8da8, 0x4, 0x80200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x7c23, 0x6, 0x6, 0x9, 0xfffbffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x1, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x3, 0x7fff, 0x72c, 0x1c32, 0x3, 0x6, 0x10000, 0x400, 0x7ffd, 0x3, 0x1, 0xf, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000001, 0x10, 0x10, 0xfffffffd, 0x1, 0x1, 0xffffffff, 0x6, 0x3ff, 0x800, 0x7, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x411, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x80001, 0x8, 0x7, 0x200, 0x3], [0x401, 0x4d, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x7, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x400, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x5d7, 0x9], [0x108e, 0xffff, 0x7, 0x3, 0x88, 0x2, 0x1, 0x4, 0x4c, 0x2, 0x764, 0xb, 0x402, 0x1, 0x9, 0x4001000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x2, 0x2851, 0x3b, 0x20000001, 0x8000, 0x5, 0x1, 0x65f413f9, 0x4, 0x20006, 0x1, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x10, 0xe, 0xffffffff, 0x7fff, 0x80000000, 0xfffffff5, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x1, 0x7fffffff]}, 0x45c) ioctl$UI_DEV_CREATE(r2, 0x5501) readv(r2, &(0x7f0000001240)=[{&(0x7f00000012c0)=""/41, 0x29}], 0x1) 1m41.9753718s ago: executing program 8 (id=1912): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) mount$binderfs(0x0, &(0x7f0000000000)='./binderfs\x00', 0x0, 0x1068, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f00000000c0)={0x6, 0x9, 0x2, 0x1fe, 0x15}) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000000)=0x8001) r2 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[], 0x120}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x2, 0x3a, 0x5d, 0x40, 0x5f9, 0xffff, 0x619f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xbd, 0x0, 0x10, 0x2, "", [{{0x9, 0x4, 0x7f, 0xc7, 0x0, 0xff, 0x2, 0xc1, 0x6}}]}}]}}, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0}) openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x105200, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x10}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7}]}]}, 0x64}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r3 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0xd}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) 1m41.020900031s ago: executing program 8 (id=1914): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x800, 0x0) fchdir(0xffffffffffffffff) syslog(0x9, 0x0, 0x0) 1m37.44954537s ago: executing program 5 (id=1949): r0 = syz_usbip_server_init(0x1) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000)) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@empty, @in=@empty, 0x4f23, 0x0, 0x4e23, 0x2, 0xa, 0x2a11bad3d5f03f04, 0x30, 0x2f}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x100000000, 0xfffffffffffffffb, 0x3, 0x8, 0x7fff}, {0x4, 0xfffffffffffffffe, 0x4, 0x9}, 0x10001, 0x0, 0x1, 0x0, 0x2, 0x3}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x210000, 0x33}, 0xa, @in=@remote, 0xfffffffe, 0x0, 0x0, 0x17, 0x0, 0x0, 0xfffffffb}}, 0xe8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) shmctl$SHM_STAT_ANY(0x0, 0xf, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="a0000000420001000000000000000000030100000f0000007d00010000112233445566778899aabb86dd2c00001c00003a0001110000010101010253aa58fe6cbdf035bc6eae44132403b1fd606412c300000000ffa62e9e156d23cfd72ddb80723d4613dc929cbc86ba94e0cd05c4a639eee919c4b391a38f086b58225d45c1b4106bb4754aebb15e0feff76718ef7ff9be52ec9c00000004000280040003"], 0xa0}, 0x1, 0x0, 0x0, 0x2000c000}, 0x0) syz_genetlink_get_family_id$SEG6(0x0, 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000004440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc051}, 0x4000) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socket$nl_netfilter(0x10, 0x3, 0xc) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10}, 0x94) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_PIT2(r6, 0x4040ae77, &(0x7f0000000180)={0x1}) ioctl$KVM_SET_PIT2(r6, 0x4070aea0, &(0x7f0000000300)={[{0xf8000000, 0x1ff, 0x4, 0x7, 0x0, 0x4, 0x6, 0x4, 0x9, 0xe1, 0x8, 0xc, 0x2}, {0x5, 0x3, 0xa7, 0x6a, 0x81, 0x7a, 0xa2, 0x8, 0x9, 0x40, 0x1, 0x8, 0x7}, {0x2, 0x0, 0xe, 0x1, 0x1, 0xd, 0x8, 0x6, 0x7, 0xcf, 0x2, 0x0, 0x5f}], 0xaed}) ioctl$KVM_SET_PIT(r6, 0x8048ae66, &(0x7f0000000240)={[{0x2, 0x6, 0x93, 0x1, 0x0, 0x5f, 0x3, 0x20, 0xa6, 0x2, 0x5, 0x9, 0xffff}, {0xfffffff9, 0xfffd, 0x0, 0x4, 0x0, 0x4, 0xce, 0x8, 0x4, 0xff, 0x4, 0xa6, 0x800000000000000}, {0xffffff01, 0x35, 0x0, 0x0, 0x4, 0x1, 0xb, 0xfe, 0x7, 0x8, 0xfe, 0x4, 0x1000000000000004}], 0xcc78}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r7, 0x2000300, 0xd, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b9", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x4c) 1m35.796443589s ago: executing program 5 (id=1952): r0 = syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x1b1c, 0xa56, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x20, 0x80, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x1, 0x48, {0x9, 0x21, 0x40c6, 0x9, 0x1, {0x22, 0x4ac}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x3, 0x3}}, [{{0x9, 0x5, 0x2, 0x3, 0x8, 0x7, 0x9, 0xd}}]}}}]}}]}}, &(0x7f0000000480)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x0, 0x7f, 0x3, 0x4, 0x20, 0x9}, 0x82, &(0x7f0000000140)={0x5, 0xf, 0x82, 0x3, [@generic={0x5f, 0x10, 0xb, "0afef63543d1af2041d81bee523fd83bae8569b48640ce7ea095841f4353fa4fe022c224786e7d836b6e2997a92afd4cb8c53f7d47f035488376b4dc077666e3984ab11df8d8e7a616eb02308516ba21070b11abeabcfafada5a2dcc"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x6, 0x1, 0x4}, @ss_container_id={0x14, 0x10, 0x4, 0x5, "4a6111cee9200cbb2cbb50d7446804e1"}]}, 0x3, [{0x4d, &(0x7f0000000240)=@string={0x4d, 0x3, "8c3d479c27ed3b37974b2d876ca55081b482d02635ff474f641b3ec54531cce5afe7b5fbc48ba01f11cc998a799d76e94fe6c1d10871ed7bcc012670608d02db4ab72dbc93849fda30fa89"}}, {0xca, &(0x7f0000000340)=@string={0xca, 0x3, "f1ed37a12d9c816185dc7f3d5359b2cdd073082ea6904e53e3f12649f061a382f18993b344912bd379c191f2a4f65297622de7b55eb0e3d33e8b9e73aa6e4fdeee0593eae3d4b60a1bc2d84c8f331e6801775c176849858f22d69f60eddeca9a223f844e37508381f8d7268389d33e36146c8d6c138d996ef00f83a2f69c95665fbbd5075024818c44fbf57f4e1937ec096eae7ddbf47537bd9b0c7a15979b5a99ee5f49bcf1aa77e5e1765b1cece41dfdc1a5707f84339817d8c0747b31014ed64937991fe60071"}}, {0x1f, &(0x7f0000000440)=@string={0x1f, 0x3, "2cc38fe7b6c6fe06014f934f8fafe64b49ed950afd4b0b77886dc5d62e"}}]}) syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000002c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x57, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xfc, 0xa0, 0x5, "", [{{0x9, 0x4, 0x0, 0x9d, 0x2, 0x3, 0x1, 0x3, 0x3, {0x9, 0x21, 0x80, 0x0, 0x1, {0x22, 0x88e}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x7, 0x5, 0x8}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x0, 0x2, 0x5}}]}}}]}}]}}, &(0x7f0000000580)={0xa, &(0x7f00000004c0)={0xa, 0x6, 0x310, 0xfd, 0x3, 0xa, 0xff, 0x4}, 0x32, &(0x7f0000000500)={0x5, 0xf, 0x32, 0x4, [@wireless={0xb, 0x10, 0x1, 0xc, 0x41, 0x3, 0xd, 0x7, 0xec}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0xc, 0x4, 0x3ff}, @wireless={0xb, 0x10, 0x1, 0x2, 0x4f, 0x9, 0x8a, 0x6, 0x2}, @ssp_cap={0x10, 0x10, 0xa, 0x8, 0x1, 0x6, 0xf000, 0x6, [0xff0000]}]}, 0x1, [{0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x4ff}}]}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000800)=ANY=[@ANYBLOB="1201100200000002ff0108020600"/25], &(0x7f0000000d00)={0xa, &(0x7f0000000840)={0xa, 0x6, 0x250, 0xca, 0x9, 0x7, 0x74, 0x4}, 0x5, &(0x7f0000000880)={0x5, 0xf, 0x5}, 0x7, [{0xee, &(0x7f0000000940)=@string={0xee, 0x3, "383126934bec2c3015b7fbca3874d8e7b5c0dc0f4c0b8e7c9c57fd275c0c7ab104423cde20791f2d3acf06dd9258c6e675740d463a0ab6df15965cd79550d3a5c191642cd390446c039ed9b467de52750f99f6408c3646b514bb87fac7d13a4ec3b4c5ca63fa336784fdc6b61222469c0b7ae47ba9c6cf8f9e02a0af9818ffc43651306e4e628a78d42e640b6cc3a08f851f33364ff7d523112d3d71653a1e98a53b759ed02d0c1894c0634b964b8d8c8a4822e0604f5b2bc1bb8f5dcc2577872b99be995168789b053e7c333c3a9d802e32dc27470c462f5b36fab5ff8b7e0445ebec8ce0f7e3c41df0a9e7"}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x440a}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x430}}, {0x1f, &(0x7f0000000a40)=@string={0x1f, 0x3, "7a12b961bc7af9a9844f4d21638b059f340ad6be0061032455d9644c72"}}, {0x12, &(0x7f0000000a80)=@string={0x12, 0x3, "c296ae6bc82ebed4649c4929eabf9b36"}}, {0x8c, &(0x7f0000000c00)=@string={0x8c, 0x3, "1382fcc60f1841d7134025c29ce32faeac9a7aebbedbe43d3b3fc0f56cfdd108c195efadbe89c90a6ffb2a033e6b008e674d3f23c5c8c811630b1b1dddc12a7d453a7ceeefc0c175dba6adec357dcd3449adacb56a0e428e0a169cf45610456cce249faec0080015d497bf1dc719c33562695fd6d3330c84fff708e88eca70b306fbc9bbcb0155f919cb"}}, {0x39, &(0x7f00000006c0)=@string={0x39, 0x3, "6938f452eae35cb6091389f0d6d3eddeddf2e487d95d475a8cccb07b45ea235dbcff748a7d1b4e8db62f60254a66c07a7d5b2c18b6807a"}}]}) syz_usb_connect(0x5, 0x52, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100a144ea220e2040114ae34010203010902400002081020020904dc0300027112070a24010400130002010209240604010107000709040101026552cc0309050a02ff"], 0x0) syz_emit_ethernet(0x42, &(0x7f0000000140)={@random="99177fa54f29", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00', 0x7, 0x11, 0x0, @remote, @local, {[], {0x0, 0xe22, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0x3, 0x0, @void}}}}}}}}, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000300"], 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x903d01) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) r3 = openat$binfmt_register(0xffffff9c, &(0x7f0000000b00), 0x1, 0x0) ppoll(&(0x7f0000000b40)=[{r2, 0x500b}, {r2, 0x2}, {r3, 0x1020}, {r2, 0x4402}], 0x4, &(0x7f0000000b80)={0x0, 0x3938700}, &(0x7f0000000bc0)={[0x800, 0x1]}, 0x8) ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) write$char_usb(r1, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000640)={{0x1}, &(0x7f00000005c0), &(0x7f0000000600)='%pS \x00'}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000680)={{0x1, 0x1, 0x18, r2}, '.\x00'}) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000740), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x8, &(0x7f0000000200)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r4 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r4, &(0x7f0000000200)='./file1\x00', 0x800, 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x40}, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) 1m32.166288268s ago: executing program 5 (id=1960): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x12, {"a2e3ad21ed0d09f91b5b090987f70906d038e7ff7fc6e5539b0d3d0e8b089b323b6d07060890e0878f0e1ac6e7049b334a959b3e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0931a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5bcd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39dd0000000039ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00b98e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d877a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240000d5}, 0x4c040) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/memory/memory2/state\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000001040)=ANY=[@ANYBLOB="1802000003000000eb68b7adb90000000009000000950000000000000044960ec6ee340fbbf1a7ecd1110e461fa3f224641cb9666b15fe13e2be6b8a948e6da1e4b63aba05b6e119d006733f2ac02d550cba37c471520cd5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) socket(0x10, 0x803, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x19, 0x4, 0x4, 0x1ffff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)="d8000000140081044e81f782db44b9040a1d08020a000000040000a118000200ff11000000000e1208000f0100810401a80016ea1f0008400304000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c01000000", 0x5f}], 0x1, 0x0, 0x0, 0x7400}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@random={'osx.', '9p\x00'}) chdir(&(0x7f0000000100)='./file0\x00') openat$dir(0xffffff9c, &(0x7f0000000040)='./bus\x00', 0x0, 0x100) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000100)={0x29, 0x22, 0x0, 0x2, 0x8, 0x1000a9, 0x5, 0x2, 0x1}) 1m32.035703142s ago: executing program 5 (id=1963): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x18, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000008850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r1}, 0xc) r2 = socket$inet(0x2, 0xa, 0x4) r3 = fcntl$dupfd(r2, 0x406, r2) write$binfmt_elf64(r3, 0x0, 0x540) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@getchain={0x5c, 0x66, 0x1, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x10, 0xb}, {0x2, 0x1}, {0x8, 0xfff1}}, [{0x8, 0xb, 0xfbd9}, {0x8, 0xb, 0x101}, {0x8, 0xb, 0xbe0}, {0x8, 0xb, 0x5}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x8040) r5 = syz_open_dev$hidraw(&(0x7f0000000040), 0x80000000, 0x20000) ioctl$HIDIOCGRAWPHYS(r5, 0x80404805, &(0x7f0000000080)) 1m31.948265s ago: executing program 5 (id=1966): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x4}}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x2, 0x6}}, 0x20) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008894}, 0x20004890) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r2 = syz_ublk_setup_io_uring(0x3b36, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0x6d1, 0x0, 0x0, 0x1000, 0x5}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r1, r6, &(0x7f0000000540)={0x0, 0x1aa5, 0x80, 0x2, 0x20000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3104, 0x1, 0x0, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587d, 0x200, 0x1, 0x69, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x800, 0x10000, 0x400000, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6253, 0x20, 0x3, 0x0, 0x0, r1}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0xdbd, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) r7 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) r8 = shmget$private(0x0, 0x3000, 0x8, &(0x7f0000ffc000/0x3000)=nil) shmctl$SHM_STAT_ANY(r8, 0xf, &(0x7f00000005c0)=""/204) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r7, 0x40049366, &(0x7f0000000180)) 1m30.700319082s ago: executing program 5 (id=1967): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x12, {"a2e3ad21ed0d09f91b5b090987f70906d038e7ff7fc6e5539b0d3d0e8b089b323b6d07060890e0878f0e1ac6e7049b334a959b3e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0931a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5bcd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39dd0000000039ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00b98e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d877a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240000d5}, 0x4c040) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/memory/memory2/state\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000001040)=ANY=[@ANYBLOB="1802000003000000eb68b7adb90000000009000000950000000000000044960ec6ee340fbbf1a7ecd1110e461fa3f224641cb9666b15fe13e2be6b8a948e6da1e4b63aba05b6e119d006733f2ac02d550cba37c471520cd5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) socket(0x10, 0x803, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x19, 0x4, 0x4, 0x1ffff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)="d8000000140081044e81f782db44b9040a1d08020a000000040000a118000200ff11000000000e1208000f0100810401a80016ea1f0008400304000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c01000000", 0x5f}], 0x1, 0x0, 0x0, 0x7400}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@random={'osx.', '9p\x00'}) chdir(&(0x7f0000000100)='./file0\x00') openat$dir(0xffffff9c, &(0x7f0000000040)='./bus\x00', 0x0, 0x100) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000100)={0x29, 0x22, 0x0, 0x2, 0x8, 0x1000a9, 0x5, 0x2, 0x1}) 1m25.115819613s ago: executing program 1 (id=1975): ioctl$sock_netdev_private(0xffffffffffffffff, 0x89f6, &(0x7f0000000340)="b2d311af94b883a7c917af570ae7b1e843a0a788f69d7891ade96769393efc8056a6f002e30c8d84568d737b56856a562c77400d2763599c42c39c2c346641f570afdc53d009685de5793fa1d5eece360b7f7647069f8c0e53a28126b06a6b5e797d92fc70f0bbf7cf41ac7523191c55decb8e836ebd8eba368cc270864fb703f797122b8690d189cd617620b20d0a9b8796") r0 = io_uring_setup(0x667, &(0x7f0000000000)={0x0, 0x8dd3, 0x1, 0x42, 0x235}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x4c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xffff, 0xf}, {0x0, 0xfff3}, {0x2, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x88a8}, @TCA_FLOWER_KEY_PORT_SRC_MIN={0x6, 0x57, 0x4e22}, @TCA_FLOWER_KEY_VLAN_PRIO={0x5, 0x18, 0x3}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r4, @ANYBLOB='\b\x00&'], 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0xb, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000fcffffff000000000946000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000000000002850000008600000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f00000007c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @empty}, {0x2, 0x4a24, @rand_addr=0x64010101}, {0x2, 0x4e25, @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x3, 0x2}) write$tun(r6, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x3, 0x0, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r10, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0xc, "3eccd8000000000000000010000000040100"}) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r11, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r11, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @empty, 0x4}], 0x1c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) 1m24.951939667s ago: executing program 42 (id=1914): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x800, 0x0) fchdir(0xffffffffffffffff) syslog(0x9, 0x0, 0x0) 1m24.440498118s ago: executing program 1 (id=1977): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000040000"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) sched_setscheduler(r1, 0x1, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a76b1a03dc55ea62d43c809e0ed6e56162fdab317afd5c34d614367e4425bb9a97e38b8beb840200549eed5aaa86dbe646fc95b4b88e2afb55ae6f1229bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dca30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec907000000ba5ae65e31f00e641832d29ed658b91f349b80e830fa29fc891b8b0d2de59d006ce210a0351b6bbd06c77c9aa67b5d7287fc1bfa1d0bf035ccdd4b20d7f95b5c77afde046b146ce8b395126f00000000000000000000aa7c93213bc6ef4da9e28ef7", 0x135, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x42583) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x35, 0x1, 0x2, 0xb100}, {0x25}, {0x0, 0x2, 0x6}, {0x6, 0x0, 0x83, 0x5}]}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r9 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r9, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r9, 0xc0045005, &(0x7f0000000640)=0x10) 1m22.564823859s ago: executing program 1 (id=1989): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000040000000400"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) sched_setscheduler(r1, 0x1, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a76b1a03dc55ea62d43c809e0ed6e56162fdab317afd5c34d614367e4425bb9a97e38b8beb840200549eed5aaa86dbe646fc95b4b88e2afb55ae6f1229bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dca30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec907000000ba5ae65e31f00e641832d29ed658b91f349b80e830fa29fc891b8b0d2de59d006ce210a0351b6bbd06c77c9aa67b5d7287fc1bfa1d0bf035ccdd4b20d7f95b5c77afde046b146ce8b395126f00000000000000000000aa7c93213bc6ef4da9e28ef7", 0x135, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x42583) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x35, 0x1, 0x2, 0xb100}, {0x25}, {0x0, 0x2, 0x6}, {0x6, 0x0, 0x83, 0x5}]}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r9 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r9, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r9, 0xc0045005, &(0x7f0000000640)=0x10) 1m21.451850829s ago: executing program 1 (id=1992): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) mount$binderfs(0x0, &(0x7f0000000000)='./binderfs\x00', 0x0, 0x1068, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000000c0)={0x6, 0x9, 0x2, 0x1fe, 0x15}) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000000)=0x8001) r3 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[], 0x120}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x2, 0x3a, 0x5d, 0x40, 0x5f9, 0xffff, 0x619f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xbd, 0x0, 0x10, 0x2, "", [{{0x9, 0x4, 0x7f, 0xc7, 0x0, 0xff, 0x2, 0xc1, 0x6}}]}}]}}, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0}) openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x105200, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x10}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7}]}]}, 0x64}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0xd}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) 1m19.928143786s ago: executing program 1 (id=1994): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x4}}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x2, 0x6}}, 0x20) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008894}, 0x20004890) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r2 = syz_ublk_setup_io_uring(0x3b36, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0x6d1, 0x0, 0x0, 0x1000, 0x5}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r1, r6, &(0x7f0000000540)={0x0, 0x1aa5, 0x80, 0x2, 0x20000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3104, 0x1, 0x0, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587d, 0x200, 0x1, 0x69, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x800, 0x10000, 0x400000, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6253, 0x20, 0x3, 0x0, 0x0, r1}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0xdbd, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) r7 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) r8 = shmget$private(0x0, 0x3000, 0x8, &(0x7f0000ffc000/0x3000)=nil) shmctl$SHM_STAT_ANY(r8, 0xf, &(0x7f00000005c0)=""/204) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r7, 0x40049366, &(0x7f0000000180)) 1m12.04120844s ago: executing program 1 (id=1998): r0 = socket$netlink(0x10, 0x3, 0x0) dup(r0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newlink={0x38, 0x10, 0x801, 0x4000000, 0xfffffffc, {0x0, 0x0, 0x4c, 0x0, 0x204e9, 0x500}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x5, 0x10, 0x5}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x4529}]}, 0x38}, 0x1, 0xffffa888}, 0x20000880) 1m11.999498706s ago: executing program 43 (id=1967): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x12, {"a2e3ad21ed0d09f91b5b090987f70906d038e7ff7fc6e5539b0d3d0e8b089b323b6d07060890e0878f0e1ac6e7049b334a959b3e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0931a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5bcd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39dd0000000039ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00b98e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d877a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240000d5}, 0x4c040) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/memory/memory2/state\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000001040)=ANY=[@ANYBLOB="1802000003000000eb68b7adb90000000009000000950000000000000044960ec6ee340fbbf1a7ecd1110e461fa3f224641cb9666b15fe13e2be6b8a948e6da1e4b63aba05b6e119d006733f2ac02d550cba37c471520cd5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, 0x0, 0x0) socket(0x10, 0x803, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x19, 0x4, 0x4, 0x1ffff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)="d8000000140081044e81f782db44b9040a1d08020a000000040000a118000200ff11000000000e1208000f0100810401a80016ea1f0008400304000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c01000000", 0x5f}], 0x1, 0x0, 0x0, 0x7400}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@random={'osx.', '9p\x00'}) chdir(&(0x7f0000000100)='./file0\x00') openat$dir(0xffffff9c, &(0x7f0000000040)='./bus\x00', 0x0, 0x100) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000100)={0x29, 0x22, 0x0, 0x2, 0x8, 0x1000a9, 0x5, 0x2, 0x1}) 1m1.872669948s ago: executing program 44 (id=1998): r0 = socket$netlink(0x10, 0x3, 0x0) dup(r0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newlink={0x38, 0x10, 0x801, 0x4000000, 0xfffffffc, {0x0, 0x0, 0x4c, 0x0, 0x204e9, 0x500}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x5, 0x10, 0x5}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x4529}]}, 0x38}, 0x1, 0xffffa888}, 0x20000880) 20.291006799s ago: executing program 3 (id=2190): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x40000095, 0x0, 0xfffffffffffffffd}]}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0xc8, 0x3}) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00000000c0)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x67c, 0x6, 0xf3b8, 0xfffffffffffffffe, 0x1000, 0x400, 0x4002004c4, 0x8, 0x0, 0x2000000097, 0x10, 0x0, 0x5, 0x4, 0x0, 0x8], 0xeeee8000, 0x402}) ioctl$KVM_RUN(r2, 0xae80, 0x2800) 20.122050361s ago: executing program 3 (id=2193): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) close(r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x4) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00', 0x1ff) r2 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r2, 0xc2c45512, &(0x7f0000000300)={{0x9, 0x5, 0x1, 0xffffffff, '\x00', 0x3}, 0x0, [0x400, 0x6, 0x9, 0x7fffffff, 0x8, 0x6, 0x3, 0x81, 0x9a, 0xfff, 0x7, 0x4e6e, 0x9d22, 0x1ff, 0x8001, 0xa7, 0x1e3, 0xf, 0x8, 0x1, 0x7, 0x10000, 0x1b, 0x2, 0x4, 0x1, 0x6, 0x1, 0x12bf, 0xab8, 0x5, 0x7, 0x2, 0x7, 0x40b6, 0x9e, 0x1, 0x7, 0x2, 0x2, 0x273f, 0x8, 0x6, 0x5, 0x4, 0xc4, 0xf, 0x49, 0xfffffffc, 0x0, 0xd7, 0x8001, 0xb93, 0x9181, 0x4, 0x3ff, 0x1a40, 0x3ff, 0x8, 0x4, 0x0, 0xcaa, 0x7fff, 0xb, 0xffff, 0x6, 0x6, 0x829, 0xffffff80, 0x401, 0x1, 0x12, 0x1, 0x6, 0x8f3, 0x8, 0x7fff, 0x96ff, 0x1, 0xffffffff, 0x3, 0x8, 0x0, 0x7fffffff, 0x3, 0x1000, 0x7, 0x2, 0xf8fc, 0xffffffff, 0x40400, 0x4, 0x3ff, 0x8000, 0xfffffe00, 0x1, 0x180000, 0x8b99, 0x7, 0x28, 0x8, 0x1, 0x2, 0x6, 0xa, 0x8, 0x4, 0xad, 0x9, 0xfffffff9, 0xc50, 0x5, 0x5, 0xd, 0x81, 0x6, 0x8, 0x7f, 0x8, 0x0, 0x4, 0x80000000, 0x2, 0x80, 0x4, 0x4, 0xc, 0x2]}) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) migrate_pages(0x0, 0x280, &(0x7f0000000000)=0x9, &(0x7f0000000080)=0x272) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r4, 0x0, 0x0, 0x200) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0x1000, &(0x7f0000006680)=0x2) munlock(&(0x7f00000ef000/0x1000)=nil, 0x1000) write$nci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x102) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/psched\x00') read$FUSE(r5, &(0x7f0000005fc0)={0x2020}, 0x2020) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, r5}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="290000000400000000000000", @ANYRES64, @ANYBLOB="5505235122b8ef52603c717ff73e94d97859ff9103f84e1389037ddbf4b7f191f67ff41df776148267a5373cad7c438d51a9a5e8a1c36a60eb8006d7ac9a0bc8c1479361d92932466092f099b68005c8a44e516f9b7d9b70403cff8569cd4d107f8912cb9abd262a025c721d7e2bf170475409f6c482e82de995e30eeaaca26ec9292d939ea3156033de93e9141c3759fe54249ddee96b01458169a39c5f1b43f2b523fb54a91328cf47122b54f42df6982c6662aeb32cd82f8cbcb7ede198125333fef5411957293d8595c07f5afdcf337d8aae8e8735f32139b81ebe821d990b80ca44ceb3775e", @ANYRES64=0x0], 0x20) 16.820682747s ago: executing program 3 (id=2205): pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, r1) write$tun(r1, &(0x7f0000000000)=ANY=[@ANYRES64=r2, @ANYRES8=r0, @ANYRES16], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r2, 0x0, 0x2) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r5, r5) setpgid(0x0, r5) fchdir(r4) faccessat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2) 14.718785173s ago: executing program 3 (id=2213): r0 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x11, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000008000000000000000fdffffff8500000011000000b7080000000000007b8af8ff00000000b7080000161300007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018030000", @ANYRES32=0x0, @ANYBLOB="0000000000000100b705000008000000850000000400000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000380)='mounts\x00') r3 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000000)) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000600)='./file0\x00', &(0x7f0000000300)='./file0/../file0\x00') bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000003f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x15) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000100)={0x80000000, 0x0, 0xffffffffffffffff}) madvise(&(0x7f00003ca000/0x1000)=nil, 0x1000, 0x66) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000002f00090027bd9f0000000000040000000c00180002ac0f0002ac0f"], 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x4) 14.575349625s ago: executing program 3 (id=2214): r0 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000000640)=""/4112, 0x1010}], 0x1, 0x4000, 0x0) 13.870914368s ago: executing program 3 (id=2217): bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) sendmsg$rds(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@mask_fadd={0x58, 0x114, 0x8, {{0xf, 0x1}, 0x0, 0x0, 0x5, 0xfffffffffffffffe, 0x7, 0x3, 0x28, 0x5}}], 0x58}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b34, &(0x7f0000000000)={'wlan0\x00'}) (fail_nth: 3) 13.623577053s ago: executing program 45 (id=2217): bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) sendmsg$rds(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@mask_fadd={0x58, 0x114, 0x8, {{0xf, 0x1}, 0x0, 0x0, 0x5, 0xfffffffffffffffe, 0x7, 0x3, 0x28, 0x5}}], 0x58}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b34, &(0x7f0000000000)={'wlan0\x00'}) (fail_nth: 3) 7.129634745s ago: executing program 7 (id=2224): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000080)='./sys\x00', 0x101001, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000018c0)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x843b13958eac55ad, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x41, 0x15001}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x40}}, 0x0) r3 = openat(r0, &(0x7f0000000000)='./sys\x00', 0xc1, 0x100) write(r3, &(0x7f0000000180)='8086 2', 0x6) 6.935575165s ago: executing program 6 (id=2242): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x10000, 0xba, &(0x7f0000000300)=""/186, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) io_setup(0x2, &(0x7f0000000000)) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r5, &(0x7f00000000c0)={0x0, 0x4b, &(0x7f0000000040)={&(0x7f0000000180)={0x58, 0x1, 0x2, 0x201, 0x0, 0x0, {0xa}, [@CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASTER={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}, 0x58}}, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001980)=@newchain={0x24, 0x1e, 0x101, 0x0, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x3, 0x7}, {0x8, 0xffe0}, {0x10, 0xb}}}, 0x24}}, 0x44004) r7 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e) syz_open_dev$vbi(0x0, 0x0, 0x2) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) 6.771966418s ago: executing program 9 (id=2243): mkdirat(0xffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async) mq_open(&(0x7f0000000180)=' \x01\x9c\x147\xb3\xcf\xfc\xc3\xa2W)\xabs\x93\xa7\xc7!Q\x8f\xf6\xec\xa5fs\xf5\x87r\xd2)r\xa7\xd6\bO\x9a\x98\xf52:\"\xf4\x12\xc0T+\xcd\x9fv|\x8d\xd5\xb2Dvc\x8e\x93\xd8\xd6\xa0\xc56\xd2x\xe3c:\x00\x00\x00\x00\x00\x00\x00\x00\x97\x97\x9c \xdc\xaavt\x18\xcen\xe4\x03\x84;7\xfb\x84r\xf4\xe7\xc9\b\x987\xaa\x85\xfb\x05%\xa8\xe5b\x81\x8e}\xe1r\xf7s2\x82\xe57&b', 0x41, 0x80, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0x203a2, 0x0) (async) r0 = syz_ublk_setup_io_uring(0x69d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf4a, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4043, 0x8a, 0x0, 0x0, 0x1000, 0x1, 0x0, 0x0, 0x1}}}, &(0x7f0000000480)=0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0xfffffffd, 0x1000, 0x3, 0x255}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8000617d, 0x8, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed80, 0x1, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x200, 0x4, 0x401f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x4, 0x2, 0x363}}], 0x1, &(0x7f0000000340)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r6) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r6, &(0x7f0000000900)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="cb23807219f89085caaab7e05d6584cdbacd2b00006ee842524b", @ANYRES16=r8, @ANYBLOB="020029bd7000fedbdf25170000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000300000008000b0001000000060016000e00000005001200000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000000000008000b000f00000006001600080000000500120000000000080001007063690011000200303030303a30303a31302e3000000000080003000300000008000b0001000000060016000200000005001200000000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000200000008000b000c00000006001600010000000500120000000000"], 0x110}}, 0x0) (async) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x40001e0, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc25c4110, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x8c0, 0x0) r9 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r9) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/block/sda/device/scsi_disk/0:0:0:0/max_write_same_blocks\x00', 0x2, 0x0) write(r7, &(0x7f00000003c0)="3635ae", 0x3) (async) r10 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/sda/device/scsi_disk/0:0:0:0/provisioning_mode\x00', 0x2, 0x0) write(r10, &(0x7f00000001c0)='writesame_16', 0xc) 6.734479s ago: executing program 7 (id=2244): syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x48885) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) getpid() mkdirat(0xffffffffffffffff, &(0x7f0000000400)='./sys/bus/pci/rescan\x00', 0x1f7) r1 = syz_open_dev$usbfs(0x0, 0x80, 0x113201) read$usbfs(r1, &(0x7f0000000600)=""/234, 0xea) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='1\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)="3100d90daaa91f198d99db922334963f621e49a6ca0b873013948d1bd6e243e5da22cf2ba7bca0e3865eaa6666cca12e329a784c6e63a08e7d57f2e2a6fa1f85d8a30f16645140e37208d917f43c0e86486bb3e9fd67f758c7f029fcbacd68c67fd996ba190681103b5cb8dbd189543ac4d64867e39469625a900852b3220d4788d9f52245fb79fec8cffbcf9a5d9764a4d5c3af2d28", 0x96) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000008c0), 0x103000, 0x0) ioctl$KVM_GET_MSRS_sys(r4, 0xc008ae88, &(0x7f00000003c0)={0x1, 0x0, [{0x8b, 0x0, 0x8}]}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x40000001, &(0x7f0000000240), 0x106, 0x1}}, 0x20) 6.366021104s ago: executing program 9 (id=2245): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) sched_setscheduler(r1, 0x1, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a76b1a03dc55ea62d43c809e0ed6e56162fdab317afd5c34d614367e4425bb9a97e38b8beb840200549eed5aaa86dbe646fc95b4b88e2afb55ae6f1229bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dca30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec907000000ba5ae65e31f00e641832d29ed658b91f349b80e830fa29fc891b8b0d2de59d006ce210a0351b6bbd06c77c9aa67b5d7287fc1bfa1d0bf035ccdd4b20d7f95b5c77afde046b146ce8b395126f00000000000000000000aa7c93213bc6ef4da9e28ef7", 0x135, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x42583) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x35, 0x1, 0x2, 0xb100}, {0x25}, {0x0, 0x2, 0x6}, {0x6, 0x0, 0x83, 0x5}]}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r9 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r9, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r9, 0xc0045005, &(0x7f0000000640)=0x10) 5.297242435s ago: executing program 6 (id=2247): mkdir(&(0x7f0000000000)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000200)='my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='my_debugfs/asoc/dais\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000006a80)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/features\x00', 0x0, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000002c80)={0xa, 0x4e26, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8000000}, 0x1c) connect$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e24, 0xfffffffe, @private2, 0x557}, 0x1c) recvmmsg(r3, 0x0, 0x0, 0x10000, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRESDEC, @ANYBLOB="010028bd7000fbdbdf254400000008000300", @ANYRES32=0x0, @ANYBLOB="8fec60ba0b78356f176ca5f6f215f973fa5f5f8d44015682b77d5085475ae42141a279b0cca59d16e1acf413f88940a42c43b2ac192636dacec6f4597aceb1264d85309903a4e7f742f8f76928d0cddcaf221c417fed33b820144528ad40ac6c936ffbbeed0f131262ed713725d8d0d57c6b1e3380bf05101d90fc15796e0b77c7b57cd5c4e972461ef0102f4d5a94fdf5263324fbb08c6b8dd24991a33498d2cc6c1e41872b81203186669c62366d5df74eb6c131279968988ef8cf7ecb3289e84cafdbc9fa636e490b8d4f5b512c0a32"], 0x1c}, 0x1, 0x0, 0x0, 0x24048081}, 0x4c040) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[], 0x60}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0x3, &(0x7f0000000380)={0x9, 0x300008b}, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000003c0)="948a78cdaddf3c2e46caaec3013033bfe3bd12ddc79382a86b223f1dd7eaa8b53dda09d90b77e718e2a3a30f9846b1178b2d76bf5603a93006c0cf562de7b0cc33728ccda3f1b4b7fe1d4e1924674f2e8d68223a027a51098ae32b1c9ea7", 0x5e}, {0x0}], 0x2) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) r5 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r2, 0x8919, &(0x7f0000000180)={'bridge_slave_0\x00', {0x2, 0x0, @dev}}) r6 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, r5, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6f, 0x0, 0x0, 0x1000, 0xffffffff, r1}}}, &(0x7f0000000300)) syz_open_dev$ublk_chdev(&(0x7f0000002000), r6, 0x2) r7 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r7, 0xc1105517, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) 5.023596441s ago: executing program 6 (id=2248): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = dup2(r0, r0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000200)={0x2, 'lo\x00', 0x3}, 0x18) write$vga_arbiter(r1, &(0x7f0000000100)=@target={'target ', {'PCI:', '11', ':', '19', ':', '18', '.', '14'}}, 0x17) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c00", 0x4e}, {&(0x7f00000000c0)="6b5d2f83d7f806000000000000006b1d2e9bb5429c7ea7988ca6", 0x1a}], 0x2}, 0x40000) 4.819998299s ago: executing program 7 (id=2249): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket(0x80000000000000a, 0x2, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) (rerun: 32) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x1, 0x800, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32], 0x3c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000240)={r3, @in6={{0xa, 0x4e21, 0xd, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0xff, 0x103}, 0x90) (async) r6 = syz_open_dev$vim2m(&(0x7f0000000140), 0x20000000fe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) (async, rerun: 32) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (rerun: 32) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$int_in(r7, 0x5452, &(0x7f00000000c0)=0x6) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r11 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r11, &(0x7f0000000280)='0', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x6, r10, 0x1, 0x2, 0x6, @local}, 0x14) (async) dup3(r1, r5, 0x80000) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xfd, 0x7, 0x4}, 0x9c) (rerun: 64) 4.732047345s ago: executing program 6 (id=2250): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000002c80)={0xa, 0x4e26, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8000000}, 0x1c) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e24, 0xfffffffe, @private2, 0x557}, 0x1c) recvmmsg(r1, 0x0, 0x0, 0x10000, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x85}, 0x4c040) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000003000000000000000000000a00030076657468300000003400128009000100766574680000000024000280200001"], 0x60}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000180)={'bridge_slave_0\x00', {0x2, 0x0, @dev}}) r4 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, &(0x7f0000000300)) syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2) r5 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r5, 0xc1105517, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x2, 0x0) lseek(r6, 0x851, 0xf5ffffff) 4.730092539s ago: executing program 9 (id=2251): mount(&(0x7f00000001c0)=@filename='./file0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='securityfs\x00', 0x40, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc2c45512, &(0x7f0000000340)={{0x3, 0x0, 0x0, 0xfffffffc, 'syz0\x00'}, 0x0, [0x0, 0xffffffff, 0xffff, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x200080, 0x4000, 0x3, 0x8, 0xfffffffc, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0xffffffff, 0xfffffffe, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, 0x20, 0x401, 0x400, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffc, 0x0, 0xfffdffc7, 0x8, 0xffff, 0x3, 0x401, 0x5, 0x3, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x3, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x65, 0x80000001, 0x0, 0x0, 0x5, 0xf1e9, 0x0, 0x0, 0x2147, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x1ff, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xffffffff, 0x5, 0xffffffff, 0x0, 0x0, 0x1, 0xfffffffd, 0x800, 0x1, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0xfffffffe, 0x200040]}) bpf$BPF_GET_PROG_INFO(0x15, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd7fa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x6f) getgid() r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x8}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x20040, 0x40, 0xe}, 0x18) r1 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000180)=0x58, 0x80000) close_range(r0, r1, 0x0) 4.045409258s ago: executing program 9 (id=2253): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507", @ANYRES32], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000001640)=0xfe, 0x4) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, 0x0, &(0x7f0000000340)) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x811}, 0x4000804) 3.889929828s ago: executing program 9 (id=2254): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000380)='./file0/file0\x00', &(0x7f00000002c0)='efivarfs\x00', 0x1084a8, &(0x7f0000000180)='grpquoTa') r0 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x194) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') connect$inet(r1, &(0x7f0000000280)={0x2, 0x4e24, @remote}, 0x10) quotactl_fd$Q_QUOTAOFF(r0, 0xffffffff80000301, 0x0, 0x0) write$nci(r0, &(0x7f00000002c0)=ANY=[], 0x5) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) r2 = syz_open_dev$vim2m(&(0x7f0000000a40), 0x10b, 0x2) semget$private(0x0, 0x1, 0x80) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000000)={0x0, 0xd, 0x2, "134604cea4ddbc704c17bc74772190f5070001ebfffdfffffee793000000e000", 0x34324142}) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r0], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="980000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffffffffff08000740010000010400068095210ca1b371a95e5c4138a54e0676fba0673b8019da633bf10a609ac232b767c8b4b24033f1ce40547c08419cf52f8e17c2032d14e961f268211e42556a6fc75256c5f32b4ae79e6805cf9f65b71cfe0b36cfde20c18dee19bad3084216e0394734390d3053ceb254399f4c37ce36cc34ed0f8f95dd1af7a5646ef2316b7276876ec6a9966cf5380702cb2209bba5839a09b4b272379095547d5bf0fcc50d00"/324], 0x98}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendto$llc(r3, &(0x7f0000000040)="e6949c50b107e8581b0c8944", 0xc, 0x4000800, &(0x7f0000000080)={0x1a, 0x1b, 0x6, 0x5, 0x4, 0x10, @broadcast}, 0x10) r5 = syz_open_dev$sg(&(0x7f00000000c0), 0x1, 0x60000) ioctl$FIBMAP(r5, 0x1, &(0x7f0000000040)=0x85) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, &(0x7f0000000140)=0x8000, 0x4) r8 = socket$xdp(0x2c, 0x3, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/mem_sleep', 0x20001, 0x18b) ioctl$LOOP_CONFIGURE(r9, 0x4c0a, &(0x7f0000000080)={r10, 0x0, {0x0, 0x0, 0x0, 0x7, 0x4010000000000ffd, 0x0, 0x0, 0x19, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0x6]}}) ioctl$LOOP_SET_BLOCK_SIZE(r9, 0x4c09, 0x800) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x1800, 0x9, 0x3}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r8, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r8, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00'}) 3.884174701s ago: executing program 6 (id=2255): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x11, &(0x7f0000001140)=ANY=[@ANYBLOB="180000000000000000000000feffffff850000007b000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000853a6d4f54d4ae0a25000000009b5aa60cf6724d45b0155476d49aeb3b2d88d08de12b85358bbc44a2f3a89a5b9d04b187877911cc438b3fa0f79cead1a95c4b55fb35cfc5f6a6510fcb6b09adcef39280b33e03bb8f0c0a00374b9efe69d38fbb20164e70e226b59d0c25476d97e63b81d41450417dbb50a449d25f0893efcf7339860f7971020292e9e0f56edab200"/175], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) r2 = syz_pidfd_open(0x0, 0x0) r3 = pidfd_getfd(r2, r2, 0x0) setns(r3, 0x20000000) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x3) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$netlink(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20008001}, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) pwrite64(r4, &(0x7f0000000240)="d3e88f66715335f9b128a834a5cc091a1b379cdd4fe8ada917c8eb03ace758b113c33e9446a60d6a163778431a2d1a162f01e2fb5a8ea233178a45f1caeb52da7057ea42df1d4cc9ec21e40cc5051b312af477aba2cb0a42a609a1444443d86f129cdc53412661e35c2aa5bb14a3b187bf02492439abf68da00c72e2d0080a84fab4398728ed98b1b0cae83729460448539e2d6332a14b3cefcc9d458052098b4c9bd7da66c865ed9e7a8c87621206c3645d7d55e880f65e27d6c9c1fd0e2a755e2ca6bbf90390cfbb87922b23b0d1ec61883aa179e6992411a065e8b5e5ae89a42c7ab14c17ad658a33db2245ab0628213effa85ae2987756fb51e2f6886f89a08f6f78781ddac056d94584d7ea3093e976e8823fd7a9b7a6fa1bec96d928a5df4fc86e0f0a1045d0ed49290a8600092a6db17b7ce59e0acfc26e79a12300de930572d8b6f8db3c287f9130d2b9d92e6a57241d2ca0d4b9c9a769d8eb5468b624feb068a1756df36231960cc3e4f4cbb41f848d5f8ffe9b3a3b25b59979481116be0bd93de900b1b43416ada78e9a4ae83a5b9ef1fab477e88c2e14233508684e601fab2b47737beef1e9931916e49a547f3dada5173abce6977672b467c5472c5338133edc96f9fa634ac040db5c3aae30cd0e66023e67ffe96f1746d6599adc56f50895aa9089e484c19dd67fbb39091d48ac6069b013baaf8a00241c942860cb4d02e4d46a6786a1f328b88e26b21c6b711f925f235a57fa7870fdfa1bb1c0c8ba97970c05d646e1c8ee358cb52a44f19e2834108e85d36f3ab442eebac8fed2228c4bd78907756ac4f21c8d4cc61a29e7f038674de8a3654b28703473ac17f9bd9670629986e171db0ea5f46e83edc1db00504f1e85bb4e3543f41c95088ef3b3cb346df915d2b37e40e3b38f7713f8ba6567df1d183bf925e098f9680aa1d37c3abc3dc3a098cc99f41a3f67335cc60cc277358a198590352dd7f186f63630d37fd307fa96e68c538a1666ef854a767872bf346a37056c461bc84a6056efe8b8f5fbfeb3ee32e720995d4b1fac3809ba28aae0e6805682ca42efe00b08d4e1f8ae75c6564e8e4637ed132be0f885de213582db32923d5062f037e20485dec2276b22232fdfe2e9269b21cee77c39fb69337e31301677abca7ed4e4165a57bea3eb3fe17618b9af917f604916db07fd7a7c6fe34fdf02c64cba7a8c17ed5589a25f0d1227a4c2e9e92212a1c85c23007cfd6d191a4080fd5d72e8cd9a4dd3b52feb0b6194ef7305783fc9f425c075406e2fb0d377c9d7412d2063e392227d85d0705d421c4598cd2af89a7228d362c6f0a9db91f78d4702a5854882f58c320d2fad37e528ec4b1c9df912ccbd3b15bbbe320fd2a235d10c41ec035e7705435550b55bbfe61e6b1c1aeda9629548914a87aaefaf759b7b61fc44ce66b36e0d57b5e5701d5cd5713f16e359d47a5f88128e9ec5af823de604b9ec55d8730d4cbdf25f1218d42cf58810a3cc931db3b6acd18d6d608b2ec851016d727a69c3d32f03ffde0eba149b3849a0fe901d20789f6a0355f0f530c843afb69cf47177a754ff5e50d94bd680f6ee0549a03e3359c7a834bf316d7e9e3a5ae61d2d528824dd97130973ef602149eb93ff9ef8de3f71de63fc99e7685eadbabb2d84bd239298ccba0739daec339b3349adb0aaac4c647608d8ab2bc0aae3f59a2d0d1e40cc1f5c600c7417d8fe23104a79b705e34d0e0e7ffd556ae43a805f9115a7d54c2ec986f2a008e875e9504c259f93d68afefdbbb79578d8211891fcb3e7116d361c0e8544e7b3500e6815551683369a103419192c1bfa37e266a76deed5dfcbb0905b9262a5c04669c9398fcf52445dbd84c42fb1947c4fda993ba3d9ee2cea0c9c6fa1cc8c204fbe16e9eb5eb89127a2cc8e57aedfc58e1096657b38800998f202704ee0caab3e8477ff31c2e17dedf655c88a813a836b8926e3e725e84d261df68033cb58ef114f68c4d57bb504aa8b838e111544398a670cebc7c07716f94f9ce25c1d4573b1a017ef2d1a044460c4200c143c9e5619ddb38056add5c59e0036eec4841bff4feda99306073cf56a4140481dca7a26b598d65b95f9181405d8997cfa19e19144dde9b3bf29853a684a8c9cf936c517d2bfb61670b00832b5530fcf6e19fab1be70ee4389972510e4cffd0cb860d5df4098110d9a9d9879c2cc1d63c7511243e782fe03a07fba921ae16b4e8ea13548f618750b26932ec94aa112d4798b717a9bbaf6b3284d3b83757c562319917c02bcca1f122ebac56cff35f98274c7cc3c9aff50ac49d40dfa692004910e148f4ce9258931eb869a548a39b447279c9a0eaf61123686b3b90501dcc9c70ea02be31ed9a1693147f61ec77eba878def24ff4e25a0558cc550943671ef07e6b10e3ba379e4c7a6c90f76bb0719206b6515ea2c99d4a286a04e14f8f7c7de2384b5897eee27037a23348e7e8f1fd85c263d6987d6e1c2ee959811f2444a77e0f6b2c9faa38ba36eecad425dfae259570070a004055be9601e61b3de02b886d846c426716854e3deb6a54450b1ef596dc4d5ecb83fbb225814559e5c0fdb2be3c5a67c2722025e94b6278fdf49aaf1412eaa1dbde068c230c6260454489ece8b0f04499bb34cf366105ea8ba918adc680145cd1024df7428b2f0607c344f13af8fc2031f01a7bd9a1eb4d8abf97b97f3b4d5d6b6b25f19003dcaf8120efee4f9bb18e9e9499cb51074e0a4129d4b6a949ac07ba134c38cc8ead91ec1940c12366db4b210e58b1b8e0dcee88638e13de7b05d4dbf1b7815898746fc6d11d0a4a1a5e88173537dbbc86eee7431ef78faa97b73c6d8e7b3fd7f3028df1a021e30eea160c7d193c2a88266ab91618f26a695266963691192b8be72300d077e07f795f557897eb886b29735e3ffb314f07c0af44614131bfc5aea1aac0f8591fa0c24e7eb8a858e9a511b71285a77f68cd544c557eb5a11d5c18719f08fda6be5a32807467cdd73f6d97239f8dc5864170de786c0c2ba8af7d58b8c204378b79d433c3de0856521317912c12bb22c9a971764c1d3a9851e04483d55b1cfb91648093829fcccee2bbe85ac2e07149924e277706a36b3a4e0fcc4024bf8552069c164fc109c7d46c047f2468e56d853ba1780d902aa4fb16192d4f09b0737098bcaf05177fc4672494c649b24dcd1362159f7413bb498e2858a046f8174ef51fab6879bd55f91a07a51e445754ef05dd589ac1f12a1afed71e94f6dd2fae10250970c58a3610ddc4dd93982cde8ec15209f735dabdf8423525a0c52e54adcf77bf31300c07dc4033a1f767e1fa82a9fa56a573362517361665089e6b3821a9ec16d6ccbf78e518ee5b543ae355c4e8abdc53da499a74b82385d56f8d3ecd6df10eaf053acac322b0e6ed58c30d071f568110a07122a98c521438a8e675f88c107c57bdc0b3dfbcb877c98fe64e5901863088a38e246b9ac56edef4cd3335b5d38f36e8675b4d167f0d463d561f4b2e6aa45296541ddada1253570a437eed30da3cec6109b05c950591f2df3a474b2318422bda5264db3f9d1624da2661ceedf340652b359259ee17e3b9a794f26868c9c654b225c5001c664061acf1e93108569e7c019d3c5b194788d775c3cbb811ae48d7ebcb5f02128556362c0c9ca56fde5c54019462c53d8a10d227b405a7bcb70759d8f748756acb6389ea7a7ffc32cbed559f8942a2206230ed3ef9144e3a9c5680293355af763219d73b6df4363cd91b45a33fc23250308eaf58cdcd3a0ebcf8df4e49ac1c04d276959ef38405602ef7435f2f39daf265f725ffbb6c2d67e4ddc0a4033f7970ca14904b1eff4bffcfd0731917e5e232da22f602944b08bbf7545daf447376e5c5ec65feff5a56d6984ed826645c743cfd39f4831cfe91b6da4ba3387e3458be854a15c82a4732dc97a8e5be7a1f23bdeb8570f7ca97bb513c1ac77bce90dc97ede433ee671a446f04d01615bbfd996c20e574da826f7e7ca9ceac1c2c4227713264d7d136473c40de4d5dff6b9fc626a75bafe879d9a017856dd067ccdde0fd962a57ca4f02fab7682f71173ee0628d0fd9a7d13f5975c98b66af56c9a431793f0737ca5e973473341d1c0a5f44337453c5a1f409fcb58846c051105138046775d153cdad7b8cb1bdfe38db5615fc4fb6d9ee7789863dffb6d47a8974366fe1577e859137dd06097ebbaa802ce85867dc1e4f73a0e3d7e7cc13bacca39c9e05c8af92734161b8f9baa659987a17a627cca34528fbf669ad57a8ff59591de8c64135d2db09058aa23331f973fc5df111365ec9fc168358b91d104c63d2e5b9e92cca7a3e3af04d8ed063033ec71bb75ba5341189fda238bf1357767a3396d7abcf77efb8497f9048a9962fa5dc88e72d0325440228717a54930a27a06436cf634cdc25c65a38c79367ea99060a26cc08e14fd1ecbca77bc48dccd1a6dc4f0cc8dd7186a9ca7061dc67f7784c8314cd8902167cfb8616b8e2bc1bf8e7695166c8da89f1be80af5c93d49ad1e58326658e88580917d3552843b907c73023cb80b7a330b458e775b909ed1c63f3cc1656d22244ad8eb57617a2500ee4dde5cc6e8a81a359ad67d710b10311b6ea8ed5fcce9467f860408b6065f289f49334861c88ae523248acf15698a4aaf81e9324005ecd77358e47267d6f8003e60cb365cecb25c6a9e8eb5273189990395459c518841c12dd1e8943ac44d33e1257b23df17d480b2300e44488c10dfb8dead6a7d3d4d5c40b0cb6eb267a945cdeadea25476c7718ed6e595b4e01fd78b8a1cf87f4bae8cdd3e05e0599f3be2f5667a6e6ceb9ed252e3907011670a4a3d29d9465bb2dae425c090948ed0b9b0403a48eba85ffedd9e7a332c25787301a0b64873f881e147a726b9820b6d1f1a4f2aec364240bb8d012581ade1c90733a2f0620864880915b11f3b26d4f44708c632da80d9f95d95a1f0c25e9f94bbf7c0934221940c25033a753aa2d5f578154321812834d72afe835a5dbcd3d1e643b654ab920c5c3529cd9cbceeaf11d6d1f247c55030567cd43086d5b4d2ffc2b3a8402e50bddaae9654a4accc34a4f2c545cdce0e7cae133be962e70324d66fb3cd68c6f5865ce108d242f074df1d079fd54d6f8bf7e150aa8af0402318d69bc9dd0cafbeb367dbb411503e1a2146b2249ec9b8779711185630c0ee0ab947a66b16e2d736e3263ee0ebf2beb3fb029d81b1e16347c018aa59dfaa588a98196a1cab9e03d75e7891521ec0024bd16ea8167ba7f9b5692d4ea4a30cc945fc41ecc9abafcc58f7d054b8accdf0f96929a5d44d0fb452d5f160217f4dc741449a73be8c8f642658691ac56459512dedcb567b863729588d22b5c41e23802f6b133e25339b54e8811c5cab", 0xef8, 0x5) r5 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r5, &(0x7f0000000140)=@in={0x2, 0x3210, @remote}, 0x80) listen(r5, 0x5) write$tun(r4, 0x0, 0x4a) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\n\x00'/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x74, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x24, 0x1e, 0x305, 0x1000000, 0x25dfdbfe, {}, [@typed={0x8, 0x3ffe, 0x0, 0x0, @pid}, @typed={0x8, 0x9, 0x0, 0x0, @fd}]}, 0x24}, 0x1, 0x8000000, 0x0, 0x400c880}, 0x0) readv(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000140)=""/197, 0xc5}], 0x1) socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x20044095}, 0x8042) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) socket$key(0xf, 0x3, 0x2) 3.798318909s ago: executing program 2 (id=2256): r0 = socket$kcm(0x2, 0x3, 0x106) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x4e21, @remote}, 0x10, 0x0, 0x0, 0x0, 0xf5}, 0x0) 3.655532963s ago: executing program 2 (id=2257): keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default user:syz 000040'], 0x2a, 0x0) r0 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r1, &(0x7f00000006c0), 0x2, 0x33, 0x25) socket(0x10, 0x3, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e40), r2) sendmsg$NL802154_CMD_SET_CCA_ED_LEVEL(r2, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x1c, r3, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008000}, 0x44080) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) keyctl$read(0xb, r0, &(0x7f0000000240)=""/112, 0x349b7f55) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb0}}, 0x0) write$binfmt_script(r1, &(0x7f00000002c0)={'#! ', './file0', [{0x20, 'user\x00'}, {0x20, 'encrypted\x00'}], 0xa, "5044bf4c4bd68592bf0fa205b44b3f3bd2d26c6cb63c171fe0fb9e8a842d9c1ce5cc47ff216c7b3ad8b5a51b47144a69b849c2f63a987b51cd5c2c90c71574d5e5501421a7e033db61591943dfa2b842a6d17b63fed333c8424d2e8b2c66fb9d9123a115e9ca05943d1dc654302fe910dd3010adcf360ba8415383830a834f1806d03dfd7f3eef6ac95a8da7d093b6e695d7fa278b1f150c163e6f5071c1b958f5274ae03dd7fca5e1306421fd4d9287c54ecbd270e1d24477d609acb78de142e1cc84aac0b3a98e08c4033fc356e596c61de0e3a3f9e589"}, 0xf4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x3c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) 3.515064294s ago: executing program 9 (id=2258): socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f0000000080)={0x59a, 0x8ab5, 0x10001, 0x20000000, 0x101, 0x80000000008, 0x63dd1ea1, 0x1}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000e306000000000000000000000085000000200000009500000000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000100)={0x3ff8, 0x0, 0x0, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, 0x0, 0x0) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x3ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000"], 0x0) ioctl$EVIOCRMFF(r1, 0x550c, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond_slave_0\x00', 0x0}) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newqdisc={0x90, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x60, 0x2, {{0x1, [], 0x0, [0x1, 0x5, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, [@TCA_MQPRIO_SHAPER={0x6}]}}}]}, 0x90}}, 0x20000000) lsm_set_self_attr(0x69, &(0x7f0000000e40)=ANY=[@ANYBLOB="0968ddbc1714eb3e0b0000000000080000000000000020"], 0x20, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/mtdblock0\x00', 0x8800, 0x0) sendfile(r5, r6, 0x0, 0x10000) 749.559076ms ago: executing program 2 (id=2259): r0 = userfaultfd(0x80000) prlimit64(0x0, 0xa, &(0x7f0000000400)={0x8, 0x10000}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$ARCH_SET_CPUID(0x1e, r1, 0x1, 0x1012) r2 = socket$packet(0x11, 0x3, 0x300) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000340), &(0x7f0000000680)={0x0, 0xfb, 0xe4, 0x1, 0x5, "6b00191369b5b4e6ec42d2e66a09a849", "4be95464fe444424cd0d332e8752fe321ce896741680654cae0bc49a73d7f85c7b2d93b65cc9be9c5d5aee70de8f8980df6d15606247a0ac0ff715109f7f8597219a41127776d6e07b9d37671795a9703fe54160b4bb339ca23d391d58e0da4962217a7f6fb41a710a05bd1f459c16f95267161b104c6a4b38e3cfdc3daf959a9750b2a76cf5e2dfacac9150f1bc6d2a0506f12f8faf468f33044b8612278fce4334fbf36f2f1b529b3ff52a0883a334ac763c61e69193d91b530142fbb5d735a9b4b7a4def94e800dbd98227081f7"}, 0xe4, 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000140)=0x15) ioctl$TCSETS(r3, 0x404c4701, &(0x7f0000000040)={0x1, 0x5, 0x0, 0x400004, 0x9, "3eccd8000000000000000010000000040100"}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r5) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') r7 = syz_io_uring_setup(0x34b9, &(0x7f0000000540)={0x0, 0x881, 0x100, 0x5, 0x50}, &(0x7f0000000040)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x3, 0x9, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r7, 0x1, 0x1, 0x1, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="400000001000370400"/20, @ANYRES32=r6, @ANYBLOB="830405000000000020001280080001006774700014000280080004000100000008000200db4c34ce"], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0) getsockname$packet(r5, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14) sendto$packet(r2, &(0x7f0000000640)='p', 0x1, 0xc855, &(0x7f0000000040)={0x11, 0x9, r11, 0x1, 0x8, 0x6, @random}, 0x14) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) migrate_pages(0x0, 0x5, 0x0, &(0x7f0000000080)=0x272) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@fallback=r0, 0x14, 0x1, 0x7, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0], &(0x7f0000000200)=[0x0]}, 0x40) 748.800653ms ago: executing program 6 (id=2260): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) sched_setscheduler(r1, 0x1, &(0x7f00000003c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r6 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a76b1a03dc55ea62d43c809e0ed6e56162fdab317afd5c34d614367e4425bb9a97e38b8beb840200549eed5aaa86dbe646fc95b4b88e2afb55ae6f1229bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dca30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec907000000ba5ae65e31f00e641832d29ed658b91f349b80e830fa29fc891b8b0d2de59d006ce210a0351b6bbd06c77c9aa67b5d7287fc1bfa1d0bf035ccdd4b20d7f95b5c77afde046b146ce8b395126f00000000000000000000aa7c93213bc6ef4da9e28ef7", 0x135, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r6}, 0x0, 0x0, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x42583) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x35, 0x1, 0x2, 0xb100}, {0x25}, {0x0, 0x2, 0x6}, {0x6, 0x0, 0x83, 0x5}]}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r9 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r9, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r9, 0xc0045005, &(0x7f0000000640)=0x10) 685.337661ms ago: executing program 7 (id=2261): sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000f8f500000000060004404e1f00000500070084000000060005"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x81, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0xf, &(0x7f00000015c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x2, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0xc2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x37}}}, &(0x7f0000000080)='GPL\x00'}, 0x90) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VIDIOC_G_FMT(r1, 0xc0d05604, &(0x7f0000000400)={0xd, @win={{}, 0x0, 0x2000000, 0x0, 0x0, 0x0}}) r2 = socket$netlink(0x10, 0x3, 0xc) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 578.501933ms ago: executing program 7 (id=2262): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (rerun: 32) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async, rerun: 64) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x9, 0xb, 0x8, 0x6}) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_SREG={0x8}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x57}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_BASE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x94}}, 0x4) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000410007e7f0bd7000fedbdf25037c7f0004002d8004000a"], 0x1c}, 0x1, 0x0, 0x0, 0x2004c080}, 0xc000) (async) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) (async, rerun: 64) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000300)={'pimreg0\x00', 0xb859b72}) (async, rerun: 64) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xfd, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x82, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) (async) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r4) sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f0000002c40)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="b0010000", @ANYRES16=r5, @ANYBLOB="010023bd7000fedbdf25010000000800040003000000790101006e016cb1d76a742f6cdc827b5620b8326361700083f2a64c36eb3be6d9a71b736ab02496daf52f9c74db40822d972e4fd677cee5e1496b5eeea93d98dff053960f72329cdc0790cc1938f30d968f4d2a46a25937c3fd1b722e3c1bbd295e9faa72ae78705725f74cc91d3ab1c566e34b7ba3b1d54ef4596a9f7a0377d38f11ef438da9fe22543d3489e653364729ef8c0f6daba4150b8415df87c88224182e7edf5992f5d963d82ece795aedfbd23286c751d599f34d6273b46e8d2304997142460d0fa9213cbe6e0a80326c05491e0080fd1affaa3d5219c64cb32e2f39b8570ad173bac5f8da28fe9c7479b03a5045eed21736104cf99a1de8cb93c98d1ec53cc86da02e60788818e923f40eb5748235941ba011618dabbf4c880efbc3b1ab04264bcf2d19e40094a8c6e14cb8321e64a657ed7faf4d37abc952efcf6770943e5d666be915934bde5544556451b7c419d3dacd913b436090279b80f0b7c71e620ee2aab98b8d98ca96e1bf5d8bc7aabb36a266d8000000080002"], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000080) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 64) r6 = socket$inet6(0xa, 0x1, 0x0) (rerun: 64) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000340)=ANY=[@ANYBLOB="3c0400000000020000071000000000027f090000000000000000000000000700000000000000000000000000000000001b16385dee23ea7d6ad6e19d8d4eb67bac6d941d3172d79e"], 0x30) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) socket(0x2a, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f00000001c0)={0x9, r1, 'id1\x00'}) ioctl$HIDIOCGRAWNAME(r7, 0x80404804, &(0x7f0000000240)) (async) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}}, 0x50) (async, rerun: 64) sendmmsg$unix(r7, &(0x7f0000000800)=[{{0x0, 0x1e, &(0x7f00000007c0)=[{&(0x7f00000004c0)="3a7af0bfc81f1e8eeaebdd3f007d65edce308914664997d4aefd799008fdf149ffe478c5394e1eeaec7e0ba349e3bf8d3a3d71da6420e896cecc6eb01082e6f3b3474beb749ae25e4af94557ad4c3c794f70e2c37a89b5e2574c5ebed9f1b7753aa21dc09c60407cd39cc2aa785ad87d054c29501c7ee05882821644422faffb6fa556543479a9f1af3afe0358cc840ff4c8e76a7c5bc5a4274236d895e30bd2259151a85f476beeee0c9105564b2aeb0cd7bbdc017974d6d8992c9609a1fe15487875f1d9", 0xc5}, {&(0x7f00000005c0)}], 0x2, 0x0, 0x0, 0x4004004}}], 0x1, 0x80) (rerun: 64) 191.494779ms ago: executing program 2 (id=2263): unshare(0x8040480) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000200)={0x1a000, r1}, 0x0) 140.323482ms ago: executing program 2 (id=2264): getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000480)={0x9, &(0x7f0000000100)=[{0x3, 0xd2, 0x4, 0x3}, {0x402, 0xfe, 0xa8, 0xfffffff3}, {0x1, 0x6, 0x2, 0x81}, {0x2, 0x3, 0x7d, 0x9}, {0x3ff, 0x0, 0x8}, {0xff4a, 0x5, 0x0, 0xfff}, {0x37, 0x8, 0x4, 0x2}, {0x0, 0x6, 0x9, 0x7}, {0xa97, 0x10, 0x2, 0x3}]}, 0x8) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x0) r1 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000080)={0xa52, 0x8004, 0x8000, 0x5}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000280)={0x0, 0x40010001}, &(0x7f00000002c0)=0x8) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000400), &(0x7f00000004c0)=0x4) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000300)={0x0, 0x7}, &(0x7f0000000340)=0x8) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000700)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWFLOWTABLE={0xb0, 0x16, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x90, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x7c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bridge\x00'}, {0x14, 0x1, 'vxcan1\x00'}, {0x14, 0x1, 'veth1_to_batadv\x00'}, {0x14, 0x1, 'pimreg1\x00'}, {0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'batadv0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, @NFT_OBJECT_CT_HELPER=@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}}, @NFT_MSG_NEWSET={0x84, 0x9, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_DESC={0x4}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x2}, @NFTA_SET_EXPR={0x38, 0x11, 0x0, 0x1, @byteorder={{0xe}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_DREG={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x84}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0xf7}, @NFTA_BYTEORDER_DREG={0x8}]}}}, @NFTA_SET_TIMEOUT={0x7, 0xb, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x106}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}]}, @NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x1c8}, 0x1, 0x0, 0x0, 0x14}, 0x4000080) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000180)="1c00000021006bcd210002006e04fcff80000010000000017aa60864", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x100) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000000)=@in={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000040)}, {&(0x7f0000000600)="0a1b5f90383adb3fe443aef33e09493213037104e52c8f90daa7a162e0b17a0f4fc0432c7b7bd1460735227a4b8c7bf8fbed61e5518958792a01a18e0685e791947c8f0ae242f26f10885255693bbff8f664fa473a327e6a1ecceeed57d6951aef6c62dc51373fe53bcca758e1f4eb9b373de86179ff4d7365d8938324bb30e2cd61205f09f1dfcba12e270c14ba2452945fa51cf18a5217cee5c30a0211e2da3e018611042253e2118db260bf50f4cb1c3ab6afc36eaf0cc086af713e4641c08b30bd0e4625a3d6ac77a21cc8180e435f46f36c22b1f21b91bcb4d6784120f4532b2c07", 0xe4}, {&(0x7f0000000180)="9e3f5622b69bafa410a18c88d95b7c9ad5869338905b0bdfc00b2b7bb6026ef175ce", 0x22}], 0x3, &(0x7f0000000580)=ANY=[@ANYRES64=0x0, @ANYRES64=r0, @ANYRES64=r3, @ANYRES8=r0, @ANYBLOB="2c000000840000000100000081760a00030000000d0000000700000000000020ff7f000000000000", @ANYRES32=r5, @ANYRES64=r0], 0xa4, 0x98b0eea837222de7}, 0x10) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) 0s ago: executing program 2 (id=2265): openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) (async) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="23000000081b000002000000ffff000005"], 0x48) getrandom(&(0x7f0000000580)=""/265, 0xffffff3f, 0x3) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000a80)={0x0, 0x0, &(0x7f00000003c0), &(0x7f00000009c0), 0x5b0, r0}, 0x38) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000a80)={0x0, 0x0, &(0x7f00000003c0), &(0x7f00000009c0), 0x5b0, r0}, 0x38) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) (async) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r1) (async) close(r1) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) (async) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r2 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd) keyctl$read(0xb, r2, &(0x7f0000000240)=""/112, 0x349b7f55) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000b00)={0x409, "abacd211119ca94c63377526aeb5ab2c7b9c64e00755c139ed0ee04200", 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r4, 0x541b, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) kernel console output (not intermixed with test programs): is unknown, defaulting to 1000 [ 514.769164][T14691] wlan0 speed is unknown, defaulting to 1000 [ 514.936514][ T5882] usb 14-1: new high-speed USB device number 26 using dummy_hcd [ 515.096512][ T5882] usb 14-1: Using ep0 maxpacket: 8 [ 515.097114][ T5882] usb 14-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 515.098242][ T5882] usb 14-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 515.098342][ T5882] usb 14-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 515.098374][ T5882] usb 14-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 515.098400][ T5882] usb 14-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 515.098434][ T5882] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.685723][T14670] bridge0: port 1(bridge_slave_0) entered blocking state [ 515.685922][T14670] bridge0: port 1(bridge_slave_0) entered disabled state [ 515.686272][T14670] bridge_slave_0: entered allmulticast mode [ 515.687576][T14670] bridge_slave_0: entered promiscuous mode [ 515.689483][T14670] bridge0: port 2(bridge_slave_1) entered blocking state [ 515.689601][T14670] bridge0: port 2(bridge_slave_1) entered disabled state [ 515.689659][T14670] bridge_slave_1: entered allmulticast mode [ 515.690706][T14670] bridge_slave_1: entered promiscuous mode [ 515.713225][T14670] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 515.717119][T14670] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 515.742092][T14670] team0: Port device team_slave_0 added [ 515.744083][T14670] team0: Port device team_slave_1 added [ 515.760502][T14670] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 515.760545][T14670] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 515.760604][T14670] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 515.762473][T14670] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 515.762486][T14670] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 515.762506][T14670] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 515.802100][T14670] hsr_slave_0: entered promiscuous mode [ 515.802761][T14670] hsr_slave_1: entered promiscuous mode [ 515.804194][T14670] debugfs: 'hsr0' already exists in 'hsr' [ 515.804215][T14670] Cannot create hsr debugfs directory [ 516.678255][T11953] Bluetooth: hci2: command tx timeout [ 516.745497][T14670] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 516.752201][T14670] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 516.754496][T14670] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 516.762053][T14670] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 516.763034][T14670] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 516.767420][T14670] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 516.768067][T14670] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 516.774538][T14670] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 516.867556][T14670] 8021q: adding VLAN 0 to HW filter on device bond0 [ 516.888597][T14670] 8021q: adding VLAN 0 to HW filter on device team0 [ 516.895265][ T6365] bridge0: port 1(bridge_slave_0) entered blocking state [ 516.895402][ T6365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 516.927759][ T6365] bridge0: port 2(bridge_slave_1) entered blocking state [ 516.927902][ T6365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 517.289690][T14670] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 517.353937][T14670] veth0_vlan: entered promiscuous mode [ 517.368797][T14670] veth1_vlan: entered promiscuous mode [ 517.394484][T14670] veth0_macvtap: entered promiscuous mode [ 517.419519][T14670] veth1_macvtap: entered promiscuous mode [ 517.454618][T14670] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 517.467300][T14670] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 517.511918][ T5884] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.512115][ T5884] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.512159][ T5884] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.512192][ T5884] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.643006][ T6223] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 517.643057][ T6223] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 517.679221][ T6365] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 517.679285][ T6365] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 517.871804][ T5882] usb 14-1: usb_control_msg returned -71 [ 517.873635][ T5882] usbtmc 14-1:16.0: can't read capabilities [ 517.885567][ T5882] usb 14-1: USB disconnect, device number 26 [ 518.036852][T14786] o2cb: This node has not been configured. [ 518.036919][T14786] o2cb: Cluster check failed. Fix errors before retrying. [ 518.038263][T14786] (syz.9.2021,14786,3):user_dlm_register:674 ERROR: status = -22 [ 518.038280][T14786] (syz.9.2021,14786,3):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "domain1" [ 518.107469][T14773] input: syz1 as /devices/virtual/input/input31 [ 518.892140][T11953] Bluetooth: hci2: command tx timeout [ 518.967220][T14817] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.968434][T14817] bridge0: port 2(bridge_slave_1) entered disabled state [ 519.376238][T14828] dlm: plock device version mismatch: kernel (1.2.0), user (1.1792.0) [ 519.427120][ T1127] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) [ 519.441888][ T1127] ata1.00: configured for UDMA/100 [ 519.547681][ T9642] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 519.556489][T14835] wlan0 speed is unknown, defaulting to 1000 [ 519.864488][ T9642] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 520.257779][T14850] Invalid ELF header magic: != ELF [ 520.493648][ T9642] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 520.508153][T14834] ceph: No mds server is up or the cluster is laggy [ 520.875865][T14855] netlink: 'syz.3.2024': attribute type 4 has an invalid length. [ 520.916785][T14855] FAULT_INJECTION: forcing a failure. [ 520.916785][T14855] name fail_futex, interval 1, probability 0, space 0, times 0 [ 520.916835][T14855] CPU: 3 UID: 0 PID: 14855 Comm: syz.3.2024 Tainted: G L syzkaller #0 PREEMPT(full) [ 520.916864][T14855] Tainted: [L]=SOFTLOCKUP [ 520.916871][T14855] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 520.916879][T14855] Call Trace: [ 520.916885][T14855] [ 520.916892][T14855] dump_stack_lvl+0x100/0x190 [ 520.916912][T14855] should_fail_ex.cold+0x5/0xa [ 520.916930][T14855] get_futex_key+0x1d0/0x14f0 [ 520.916954][T14855] ? __pfx_get_futex_key+0x10/0x10 [ 520.916977][T14855] futex_wake+0xf4/0x5e0 [ 520.916991][T14855] ? find_held_lock+0x2b/0x80 [ 520.917007][T14855] ? __pfx_futex_wake+0x10/0x10 [ 520.917024][T14855] ? rcu_read_lock_any_held+0x6a/0x90 [ 520.917042][T14855] ? find_held_lock+0x2b/0x80 [ 520.917060][T14855] ? ksys_write+0x190/0x250 [ 520.917077][T14855] ? ksys_write+0x190/0x250 [ 520.917098][T14855] do_futex+0x2b2/0x440 [ 520.917120][T14855] ? __pfx_do_futex+0x10/0x10 [ 520.917141][T14855] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 520.917173][T14855] __ia32_sys_futex_time32+0x2f4/0x470 [ 520.917189][T14855] ? xfd_validate_state+0x129/0x190 [ 520.917207][T14855] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 520.917225][T14855] __do_fast_syscall_32+0x13a/0x8b0 [ 520.917243][T14855] do_fast_syscall_32+0x32/0x70 [ 520.917259][T14855] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 520.917274][T14855] RIP: 0023:0xf700efec [ 520.917311][T14855] Code: Unable to access opcode bytes at 0xf700efc2. [ 520.917324][T14855] RSP: 002b:00000000f53fd5cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 520.917349][T14855] RAX: ffffffffffffffda RBX: 00000000f7404f8c RCX: 0000000000000081 [ 520.917364][T14855] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 520.917380][T14855] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 520.917394][T14855] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 520.917405][T14855] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 520.917422][T14855] [ 521.112770][T11953] Bluetooth: hci2: command tx timeout [ 521.258413][T14862] input: syz1 as /devices/virtual/input/input32 [ 521.369487][ T9642] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 521.533172][ T9642] usb 7-1: unable to get BOS descriptor or descriptor too short [ 521.533224][ T9642] usb 7-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 521.541796][ T9642] usb 7-1: config 189 has an invalid interface number: 127 but max is 0 [ 521.544862][ T9642] usb 7-1: config 189 has no interface number 0 [ 521.547006][ T9642] usb 7-1: config 189 interface 127 has no altsetting 0 [ 521.551328][ T9642] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.554256][ T9642] usb 7-1: Product: syz [ 521.555744][ T9642] usb 7-1: Manufacturer: syz [ 521.557313][ T9642] usb 7-1: SerialNumber: syz [ 521.819311][ T9642] usbserial_generic 7-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 521.823996][ T9642] usbserial_generic 7-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 521.824104][ T9642] usbserial_generic 7-1:189.127: device has no bulk endpoints [ 521.824483][ T9642] safe_serial 7-1:189.127: safe_serial converter detected [ 521.824564][ T9642] safe_serial 7-1:189.127: probe with driver safe_serial failed with error -22 [ 521.845937][ T9642] usb 7-1: USB disconnect, device number 9 [ 522.621019][ T5779] netdevsim netdevsim9 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 522.621088][ T5779] netdevsim netdevsim9 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.803393][ T5779] netdevsim netdevsim9 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 522.803467][ T5779] netdevsim netdevsim9 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 522.964091][ T5094] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 522.972313][ T5094] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 522.975691][ T5094] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 522.982942][ T5094] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 522.993430][ T5094] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 523.085960][T11398] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 523.136802][T14890] wlan0 speed is unknown, defaulting to 1000 [ 523.335239][T11953] Bluetooth: hci2: command tx timeout [ 523.372281][T11398] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 523.396539][ T5779] netdevsim netdevsim9 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 523.419821][ T5779] netdevsim netdevsim9 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.912886][T11398] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 523.957281][T14889] ceph: No mds server is up or the cluster is laggy [ 524.053425][ T5779] netdevsim netdevsim9 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 524.053514][ T5779] netdevsim netdevsim9 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.356788][T14885] wlan0 speed is unknown, defaulting to 1000 [ 524.661782][ T5779] bridge_slave_1: left promiscuous mode [ 524.661955][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 524.971953][T14905] trusted_key: encrypted_key: insufficient parameters specified [ 524.983315][ T5779] bridge_slave_0: left promiscuous mode [ 524.983518][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.253746][T11953] Bluetooth: hci0: command tx timeout [ 525.276825][T11953] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 525.304930][T11953] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 525.312739][T11953] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 525.331717][T11953] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 525.339487][T11953] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 525.501800][ T5779] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 525.518065][ T5779] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 525.523356][ T5779] bond0 (unregistering): Released all slaves [ 525.539809][ T5779] bond1 (unregistering): (slave dummy0): Releasing active interface [ 525.545846][ T5779] bond1 (unregistering): Released all slaves [ 525.792392][T12079] smbdirect: ib_dev[syz0] removed [ 525.933386][ T5779] hsr_slave_0: left promiscuous mode [ 525.940201][ T5779] hsr_slave_1: left promiscuous mode [ 525.947890][ T5779] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 525.952103][ T5779] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 525.973852][ T5779] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 525.977582][ T5779] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 525.990194][ T5779] veth1_macvtap: left promiscuous mode [ 525.995861][ T5779] veth0_macvtap: left promiscuous mode [ 525.998493][T14916] FAULT_INJECTION: forcing a failure. [ 525.998493][T14916] name failslab, interval 1, probability 0, space 0, times 0 [ 525.998560][T14916] CPU: 2 UID: 0 PID: 14916 Comm: syz.2.2038 Tainted: G L syzkaller #0 PREEMPT(full) [ 525.998595][T14916] Tainted: [L]=SOFTLOCKUP [ 525.998602][T14916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 525.998612][T14916] Call Trace: [ 525.998618][T14916] [ 525.998627][T14916] dump_stack_lvl+0x100/0x190 [ 525.998653][T14916] should_fail_ex.cold+0x5/0xa [ 525.998681][T14916] should_failslab+0xc2/0x120 [ 525.998709][T14916] __kmalloc_noprof+0xfc/0x840 [ 525.998731][T14916] ? trace_kmalloc+0xeb/0x110 [ 525.998843][T14916] ? lsm_blob_alloc+0x68/0x90 [ 525.998860][T14916] lsm_blob_alloc+0x68/0x90 [ 525.998872][T14916] security_sk_alloc+0x2d/0x290 [ 525.998889][T14916] sk_prot_alloc+0x12a/0x2a0 [ 525.998940][T14916] sk_alloc+0x36/0xe80 [ 525.998957][T14916] bpf_prog_test_run_skb+0x4d2/0x3530 [ 525.999002][T14916] ? lock_acquire+0x1d1/0x380 [ 525.999022][T14916] ? __fget_files+0x34/0x3d0 [ 525.999035][T14916] ? find_held_lock+0x2b/0x80 [ 525.999048][T14916] ? __fget_files+0x161/0x3d0 [ 525.999063][T14916] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 525.999084][T14916] ? fput+0x7c/0x100 [ 525.999098][T14916] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 525.999117][T14916] __sys_bpf+0x2265/0x4a30 [ 525.999133][T14916] ? __pfx___sys_bpf+0x10/0x10 [ 525.999144][T14916] ? __pfx_futex_hash+0x10/0x10 [ 525.999233][T14916] ? get_pid_task+0xfc/0x250 [ 525.999248][T14916] ? get_pid_task+0xfc/0x250 [ 525.999265][T14916] ? find_held_lock+0x2b/0x80 [ 525.999283][T14916] ? rcu_read_lock_any_held+0x6a/0x90 [ 525.999299][T14916] ? find_held_lock+0x2b/0x80 [ 525.999313][T14916] ? ksys_write+0x190/0x250 [ 525.999326][T14916] ? ksys_write+0x190/0x250 [ 525.999349][T14916] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 525.999366][T14916] ? xfd_validate_state+0x129/0x190 [ 525.999388][T14916] ? __ia32_sys_bpf+0xcc/0x170 [ 525.999400][T14916] __ia32_sys_bpf+0xcc/0x170 [ 525.999413][T14916] ? __do_fast_syscall_32+0xb3/0x8b0 [ 525.999432][T14916] __do_fast_syscall_32+0x13a/0x8b0 [ 525.999458][T14916] do_fast_syscall_32+0x32/0x70 [ 525.999474][T14916] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 525.999494][T14916] RIP: 0023:0xf70aefec [ 525.999514][T14916] Code: Unable to access opcode bytes at 0xf70aefc2. [ 525.999520][T14916] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 525.999533][T14916] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000800002c0 [ 525.999540][T14916] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 525.999547][T14916] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 525.999554][T14916] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 525.999561][T14916] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 525.999575][T14916] [ 526.027720][ T5779] veth1_vlan: left promiscuous mode [ 526.027791][ T5779] veth0_vlan: left promiscuous mode [ 526.183141][T14924] sd 0:0:0:0: PR command failed: 1026 [ 526.183213][T14924] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 526.183261][T14924] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 526.402448][ T5779] team0 (unregistering): Port device team_slave_1 removed [ 526.409545][ T5779] team0 (unregistering): Port device team_slave_0 removed [ 526.914560][T14885] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.916642][T14885] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.916793][T14885] bridge_slave_0: entered allmulticast mode [ 526.920638][T14885] bridge_slave_0: entered promiscuous mode [ 526.924545][T14885] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.924610][T14885] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.924677][T14885] bridge_slave_1: entered allmulticast mode [ 526.928403][T14885] bridge_slave_1: entered promiscuous mode [ 526.954054][T14885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 526.959776][T14885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 526.988298][T14885] team0: Port device team_slave_0 added [ 526.991679][ T5449] 8021q: adding VLAN 0 to HW filter on device eth11 [ 526.995541][T14885] team0: Port device team_slave_1 added [ 527.029852][T14885] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 527.032716][T14885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 527.041315][T14885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 527.049578][T14885] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 527.049632][T14885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 527.049660][T14885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 527.074913][ T10] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 527.111540][ T5779] IPVS: stop unused estimator thread 0... [ 527.139408][T14885] hsr_slave_0: entered promiscuous mode [ 527.139951][T14885] hsr_slave_1: entered promiscuous mode [ 527.140264][T14885] debugfs: 'hsr0' already exists in 'hsr' [ 527.140290][T14885] Cannot create hsr debugfs directory [ 527.241771][ T10] usb 8-1: unable to get BOS descriptor or descriptor too short [ 527.241831][ T10] usb 8-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 527.252349][ T10] usb 8-1: config 189 has an invalid interface number: 127 but max is 0 [ 527.252387][ T10] usb 8-1: config 189 has no interface number 0 [ 527.252439][ T10] usb 8-1: config 189 interface 127 has no altsetting 0 [ 527.268027][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.268069][ T10] usb 8-1: Product: syz [ 527.268099][ T10] usb 8-1: Manufacturer: syz [ 527.268121][ T10] usb 8-1: SerialNumber: syz [ 527.306596][ T5779] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.338498][T14909] bridge0: port 1(bridge_slave_0) entered blocking state [ 527.338682][T14909] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.338819][T14909] bridge_slave_0: entered allmulticast mode [ 527.340102][T14909] bridge_slave_0: entered promiscuous mode [ 527.341925][T14909] bridge0: port 2(bridge_slave_1) entered blocking state [ 527.341965][T14909] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.342031][T14909] bridge_slave_1: entered allmulticast mode [ 527.342707][T14909] bridge_slave_1: entered promiscuous mode [ 527.365435][T14909] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 527.368961][T14909] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 527.374106][ T9643] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 527.403064][T14909] team0: Port device team_slave_0 added [ 527.417065][T14909] team0: Port device team_slave_1 added [ 527.438328][T11953] Bluetooth: hci0: command tx timeout [ 527.485059][ T5779] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.536707][ T9643] usb 7-1: unable to get BOS descriptor or descriptor too short [ 527.540041][ T9643] usb 7-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 527.544130][ T9643] usb 7-1: config 189 has an invalid interface number: 127 but max is 0 [ 527.549152][ T9643] usb 7-1: config 189 has no interface number 0 [ 527.549263][ T9643] usb 7-1: config 189 interface 127 has no altsetting 0 [ 527.558292][ T9643] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.558344][ T9643] usb 7-1: Product: syz [ 527.558357][ T9643] usb 7-1: Manufacturer: syz [ 527.558370][ T9643] usb 7-1: SerialNumber: syz [ 527.609885][T11953] Bluetooth: hci3: command tx timeout [ 527.619181][T14909] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 527.619248][T14909] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 527.619296][T14909] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 527.620644][T14909] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 527.620654][T14909] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 527.620672][T14909] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 527.688674][ T5779] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.709499][T14909] hsr_slave_0: entered promiscuous mode [ 527.710171][T14909] hsr_slave_1: entered promiscuous mode [ 527.710594][T14909] debugfs: 'hsr0' already exists in 'hsr' [ 527.710608][T14909] Cannot create hsr debugfs directory [ 527.828133][ T5779] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.041968][ T5449] 8021q: adding VLAN 0 to HW filter on device eth10 [ 528.128576][ T10] usbserial_generic 8-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 528.128621][ T10] usbserial_generic 8-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 528.128661][ T10] usbserial_generic 8-1:189.127: device has no bulk endpoints [ 528.130647][ T10] safe_serial 8-1:189.127: safe_serial converter detected [ 528.130766][ T10] safe_serial 8-1:189.127: probe with driver safe_serial failed with error -22 [ 528.141726][ T10] usb 8-1: USB disconnect, device number 17 [ 528.255716][ T5779] bridge_slave_1: left allmulticast mode [ 528.255767][ T5779] bridge_slave_1: left promiscuous mode [ 528.256174][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 528.293633][ T5779] bridge_slave_0: left allmulticast mode [ 528.293671][ T5779] bridge_slave_0: left promiscuous mode [ 528.293967][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 528.459188][ T5779] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 528.471878][ T5779] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 528.476202][ T5779] bond0 (unregistering): Released all slaves [ 528.592719][ T5779] tipc: Disabling bearer [ 528.601684][ T5779] tipc: Left network mode [ 528.785897][T14975] FAULT_INJECTION: forcing a failure. [ 528.785897][T14975] name failslab, interval 1, probability 0, space 0, times 0 [ 528.785988][T14975] CPU: 0 UID: 0 PID: 14975 Comm: syz.3.2042 Tainted: G L syzkaller #0 PREEMPT(full) [ 528.786006][T14975] Tainted: [L]=SOFTLOCKUP [ 528.786010][T14975] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 528.786018][T14975] Call Trace: [ 528.786022][T14975] [ 528.786027][T14975] dump_stack_lvl+0x100/0x190 [ 528.786046][T14975] should_fail_ex.cold+0x5/0xa [ 528.786062][T14975] should_failslab+0xc2/0x120 [ 528.786089][T14975] kmem_cache_alloc_noprof+0x92/0x6a0 [ 528.786102][T14975] ? rcu_read_lock_any_held+0x6a/0x90 [ 528.786115][T14975] ? do_getname+0x35/0x390 [ 528.786133][T14975] do_getname+0x35/0x390 [ 528.786150][T14975] do_sys_openat2+0xc7/0x1e0 [ 528.786166][T14975] ? __pfx_do_sys_openat2+0x10/0x10 [ 528.786180][T14975] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 528.786198][T14975] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 528.786213][T14975] __ia32_compat_sys_openat+0x12d/0x210 [ 528.786229][T14975] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 528.786251][T14975] do_int80_emulation+0x166/0x650 [ 528.786267][T14975] asm_int80_emulation+0x1a/0x20 [ 528.786280][T14975] RIP: 0023:0xf71475ab [ 528.786291][T14975] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 528.786366][T14975] RSP: 002b:00000000f53fd03c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 528.786380][T14975] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53fd100 [ 528.786388][T14975] RDX: 0000000000000801 RSI: 0000000000000000 RDI: 0000000000000000 [ 528.786395][T14975] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 528.786402][T14975] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 528.786409][T14975] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 528.786425][T14975] [ 528.888526][ T9643] usbserial_generic 7-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 528.888577][ T9643] usbserial_generic 7-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 528.888620][ T9643] usbserial_generic 7-1:189.127: device has no bulk endpoints [ 528.888950][ T9643] safe_serial 7-1:189.127: safe_serial converter detected [ 528.889014][ T9643] safe_serial 7-1:189.127: probe with driver safe_serial failed with error -22 [ 528.897959][ T9643] usb 7-1: USB disconnect, device number 10 [ 528.926662][T14978] bridge0: port 3(macvlan2) entered blocking state [ 528.927103][T14978] bridge0: port 3(macvlan2) entered disabled state [ 528.927220][T14978] macvlan2: entered allmulticast mode [ 528.927236][T14978] ip6gretap0: entered allmulticast mode [ 528.930098][T14978] macvlan2: entered promiscuous mode [ 528.930503][T14978] bridge0: port 3(macvlan2) entered blocking state [ 528.930550][T14978] bridge0: port 3(macvlan2) entered forwarding state [ 528.958663][ T5449] 8021q: adding VLAN 0 to HW filter on device eth12 [ 528.976371][T14885] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 528.991813][T14885] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 529.040433][ T5779] hsr_slave_0: left promiscuous mode [ 529.044943][ T5779] hsr_slave_1: left promiscuous mode [ 529.045691][ T5779] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 529.045711][ T5779] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 529.047636][ T5779] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 529.047650][ T5779] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 529.056637][ T5779] veth1_macvtap: left promiscuous mode [ 529.056744][ T5779] veth0_macvtap: left promiscuous mode [ 529.056858][ T5779] veth1_vlan: left promiscuous mode [ 529.056935][ T5779] veth0_vlan: left promiscuous mode [ 529.197655][ T5779] team0 (unregistering): Port device team_slave_1 removed [ 529.206874][ T5779] team0 (unregistering): Port device team_slave_0 removed [ 529.271903][T14885] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 529.279951][T14885] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 529.280308][T14981] tipc: Started in network mode [ 529.280320][T14981] tipc: Node identity 4, cluster identity 4711 [ 529.280327][T14981] tipc: Node number set to 4 [ 529.282542][T14885] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 529.304710][T14885] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 529.315137][T14885] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 529.326002][T14885] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 529.577906][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 529.577973][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 529.607878][ T5449] 8021q: adding VLAN 0 to HW filter on device eth13 [ 529.647306][T14885] 8021q: adding VLAN 0 to HW filter on device bond0 [ 529.660897][T14885] 8021q: adding VLAN 0 to HW filter on device team0 [ 529.666017][ T1169] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.666098][ T1169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 529.671770][T11953] Bluetooth: hci0: command tx timeout [ 529.747860][T12079] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.747944][T12079] bridge0: port 2(bridge_slave_1) entered forwarding state [ 529.830238][T15001] input: syz1 as /devices/virtual/input/input33 [ 529.831611][T11953] Bluetooth: hci3: command tx timeout [ 529.941772][T14909] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 529.945971][T14909] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 529.946693][T14909] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 529.952968][T14909] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 529.953432][T14909] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 529.959222][T14909] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 529.962497][T14909] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 529.966264][T14909] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 530.006675][T14909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 530.017923][T14909] 8021q: adding VLAN 0 to HW filter on device team0 [ 530.029619][T12079] bridge0: port 1(bridge_slave_0) entered blocking state [ 530.029710][T12079] bridge0: port 1(bridge_slave_0) entered forwarding state [ 530.039356][T12079] bridge0: port 2(bridge_slave_1) entered blocking state [ 530.039439][T12079] bridge0: port 2(bridge_slave_1) entered forwarding state [ 530.186260][T14885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 530.357929][T14885] veth0_vlan: entered promiscuous mode [ 530.362556][T14909] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 530.367723][T14885] veth1_vlan: entered promiscuous mode [ 530.391479][T14885] veth0_macvtap: entered promiscuous mode [ 530.393912][T14885] veth1_macvtap: entered promiscuous mode [ 530.401534][T14885] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 530.408089][T14885] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 530.464430][ T5884] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.464690][ T5884] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.464711][ T5884] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.464728][ T5884] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.612224][ T6223] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 530.612262][ T6223] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.658527][ T6223] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 530.658583][ T6223] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.688460][T14909] veth0_vlan: entered promiscuous mode [ 530.693819][T14909] veth1_vlan: entered promiscuous mode [ 530.724770][T14909] veth0_macvtap: entered promiscuous mode [ 530.724899][T15074] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2048'. [ 530.737459][T15074] gretap1: entered promiscuous mode [ 530.765405][T14909] veth1_macvtap: entered promiscuous mode [ 530.821065][T14909] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 530.828454][T14909] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 530.833530][ T5884] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.833655][ T5884] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.833681][ T5884] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.833699][ T5884] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.924820][ T6223] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 530.924891][ T6223] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.965962][ T6223] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 530.966023][ T6223] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.985436][T15075] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2049'. [ 530.985489][T15075] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 531.115168][T11953] Bluetooth: hci2: command tx timeout [ 531.752373][T15090] input: syz1 as /devices/virtual/input/input34 [ 531.886635][T11953] Bluetooth: hci0: command tx timeout [ 532.012195][ T5449] 8021q: adding VLAN 0 to HW filter on device eth11 [ 532.055372][T11953] Bluetooth: hci3: command tx timeout [ 532.635523][T15126] input: syz1 as /devices/virtual/input/input35 [ 532.755418][ T5449] 8021q: adding VLAN 0 to HW filter on device eth10 [ 533.686577][T15176] Invalid ELF header magic: != ELF [ 533.714978][T15179] FAULT_INJECTION: forcing a failure. [ 533.714978][T15179] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 533.715035][T15179] CPU: 0 UID: 0 PID: 15179 Comm: syz.2.2061 Tainted: G L syzkaller #0 PREEMPT(full) [ 533.715052][T15179] Tainted: [L]=SOFTLOCKUP [ 533.715057][T15179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 533.715063][T15179] Call Trace: [ 533.715068][T15179] [ 533.715072][T15179] dump_stack_lvl+0x100/0x190 [ 533.715090][T15179] should_fail_ex.cold+0x5/0xa [ 533.715105][T15179] _copy_from_user+0x2e/0xd0 [ 533.715119][T15179] get_compat_msghdr+0xb3/0x480 [ 533.715135][T15179] ? __pfx_get_compat_msghdr+0x10/0x10 [ 533.715155][T15179] ___sys_sendmsg+0x1b6/0x1e0 [ 533.715173][T15179] ? __pfx____sys_sendmsg+0x10/0x10 [ 533.715196][T15179] ? find_held_lock+0x2b/0x80 [ 533.715216][T15179] __sys_sendmsg+0x160/0x210 [ 533.715229][T15179] ? __pfx___sys_sendmsg+0x10/0x10 [ 533.715245][T15179] ? __pfx_ksys_write+0x10/0x10 [ 533.715259][T15179] __do_fast_syscall_32+0x13a/0x8b0 [ 533.715274][T15179] ? lockdep_hardirqs_on+0x7d/0x110 [ 533.715289][T15179] do_fast_syscall_32+0x32/0x70 [ 533.715303][T15179] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 533.715318][T15179] RIP: 0023:0xf70aefec [ 533.715329][T15179] Code: Unable to access opcode bytes at 0xf70aefc2. [ 533.715340][T15179] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 533.715352][T15179] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 533.715359][T15179] RDX: 0000000000004040 RSI: 0000000000000000 RDI: 0000000000000000 [ 533.715365][T15179] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 533.715371][T15179] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 533.715378][T15179] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 533.715391][T15179] [ 533.835531][T15176] syz.6.2059 (15176): /proc/15176/oom_adj is deprecated, please use /proc/15176/oom_score_adj instead. [ 533.859059][T15189] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2063'. [ 533.970034][T15173] input: syz1 as /devices/virtual/input/input36 [ 534.112732][ T43] kauditd_printk_skb: 1 callbacks suppressed [ 534.112795][ T43] audit: type=1326 audit(1788267548.334:586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.112876][ T43] audit: type=1326 audit(1788267548.334:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.112912][ T43] audit: type=1326 audit(1788267548.334:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.150277][ T43] audit: type=1326 audit(1788267548.334:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.150373][ T43] audit: type=1326 audit(1788267548.334:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.150409][ T43] audit: type=1326 audit(1788267548.334:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.150442][ T43] audit: type=1326 audit(1788267548.334:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.150476][ T43] audit: type=1326 audit(1788267548.334:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.150509][ T43] audit: type=1326 audit(1788267548.334:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.150546][ T43] audit: type=1326 audit(1788267548.334:595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15185 comm="syz.3.2062" exe="/syz-executor" sig=0 arch=40000003 syscall=394 compat=1 ip=0xf700efec code=0x7ffc0000 [ 534.289170][T11953] Bluetooth: hci3: command tx timeout [ 534.816807][T15213] FAULT_INJECTION: forcing a failure. [ 534.816807][T15213] name failslab, interval 1, probability 0, space 0, times 0 [ 534.816866][T15213] CPU: 0 UID: 0 PID: 15213 Comm: syz.9.2066 Tainted: G L syzkaller #0 PREEMPT(full) [ 534.816894][T15213] Tainted: [L]=SOFTLOCKUP [ 534.816900][T15213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 534.816907][T15213] Call Trace: [ 534.816911][T15213] [ 534.816917][T15213] dump_stack_lvl+0x100/0x190 [ 534.816936][T15213] should_fail_ex.cold+0x5/0xa [ 534.816952][T15213] should_failslab+0xc2/0x120 [ 534.816968][T15213] kmem_cache_alloc_noprof+0x92/0x6a0 [ 534.816981][T15213] ? rcu_read_lock_any_held+0x6a/0x90 [ 534.816994][T15213] ? do_getname+0x35/0x390 [ 534.817011][T15213] do_getname+0x35/0x390 [ 534.817029][T15213] do_sys_openat2+0xc7/0x1e0 [ 534.817044][T15213] ? __pfx_do_sys_openat2+0x10/0x10 [ 534.817058][T15213] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 534.817077][T15213] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 534.817092][T15213] __ia32_compat_sys_openat+0x12d/0x210 [ 534.817113][T15213] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 534.817145][T15213] do_int80_emulation+0x166/0x650 [ 534.817172][T15213] asm_int80_emulation+0x1a/0x20 [ 534.817193][T15213] RIP: 0023:0xf71875ab [ 534.817209][T15213] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 534.817226][T15213] RSP: 002b:00000000f544603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 534.817246][T15213] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5446100 [ 534.817260][T15213] RDX: 0000000000000801 RSI: 0000000000000000 RDI: 0000000000000000 [ 534.817273][T15213] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 534.817283][T15213] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 534.817296][T15213] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 534.817320][T15213] [ 534.855095][T15210] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2065'. [ 534.855109][T15210] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 534.866532][ T9898] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 535.046381][ T9898] usb 7-1: Using ep0 maxpacket: 8 [ 535.050213][ T9898] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 535.051136][ T9898] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 535.051154][ T9898] usb 7-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 535.051167][ T9898] usb 7-1: config 0 interface 0 has no altsetting 0 [ 535.051184][ T9898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 535.052647][ T9898] usb 7-1: config 0 descriptor?? [ 535.158844][T15217] input: syz1 as /devices/virtual/input/input37 [ 535.249185][ T9643] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 535.411761][ T9643] usb 11-1: unable to get BOS descriptor or descriptor too short [ 535.414334][ T9643] usb 11-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 535.418463][ T9643] usb 11-1: config 189 has an invalid interface number: 127 but max is 0 [ 535.421281][ T9643] usb 11-1: config 189 has no interface number 0 [ 535.421341][ T9643] usb 11-1: config 189 interface 127 has no altsetting 0 [ 535.428075][ T9643] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.431340][ T9643] usb 11-1: Product: syz [ 535.431377][ T9643] usb 11-1: Manufacturer: syz [ 535.431386][ T9643] usb 11-1: SerialNumber: syz [ 536.035273][T15264] jffs2: notice: (15264) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 536.062973][ T9643] usbserial_generic 11-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 536.063119][ T9643] usbserial_generic 11-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 536.063186][ T9643] usbserial_generic 11-1:189.127: device has no bulk endpoints [ 536.075776][ T9643] safe_serial 11-1:189.127: safe_serial converter detected [ 536.078978][ T9643] safe_serial 11-1:189.127: probe with driver safe_serial failed with error -22 [ 536.088018][ T9643] usb 11-1: USB disconnect, device number 2 [ 536.664997][T15282] FAULT_INJECTION: forcing a failure. [ 536.664997][T15282] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 536.665057][T15282] CPU: 3 UID: 0 PID: 15282 Comm: syz.6.2072 Tainted: G L syzkaller #0 PREEMPT(full) [ 536.665094][T15282] Tainted: [L]=SOFTLOCKUP [ 536.665100][T15282] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 536.665107][T15282] Call Trace: [ 536.665113][T15282] [ 536.665118][T15282] dump_stack_lvl+0x100/0x190 [ 536.665138][T15282] should_fail_ex.cold+0x5/0xa [ 536.665153][T15282] _copy_from_user+0x2e/0xd0 [ 536.665167][T15282] input_event_from_user+0x137/0x290 [ 536.665186][T15282] ? __pfx_input_event_from_user+0x10/0x10 [ 536.665205][T15282] ? input_inject_event+0x198/0x380 [ 536.665224][T15282] evdev_write+0x27a/0x430 [ 536.665243][T15282] ? __pfx_evdev_write+0x10/0x10 [ 536.665266][T15282] ? bpf_lsm_file_permission+0x9/0x10 [ 536.665282][T15282] ? security_file_permission+0x76/0x210 [ 536.665299][T15282] ? rw_verify_area+0xce/0x6d0 [ 536.665318][T15282] vfs_write+0x2aa/0x1050 [ 536.665329][T15282] ? __pfx_evdev_write+0x10/0x10 [ 536.665345][T15282] ? lock_acquire+0x1d1/0x380 [ 536.665361][T15282] ? __fget_files+0x34/0x3d0 [ 536.665372][T15282] ? __pfx_vfs_write+0x10/0x10 [ 536.665382][T15282] ? find_held_lock+0x2b/0x80 [ 536.665393][T15282] ? __fget_files+0x215/0x3d0 [ 536.665404][T15282] ? __fget_files+0x215/0x3d0 [ 536.665418][T15282] ? __fget_files+0x21f/0x3d0 [ 536.665433][T15282] ksys_write+0x1f8/0x250 [ 536.665444][T15282] ? __pfx_ksys_write+0x10/0x10 [ 536.665454][T15282] ? ksys_write+0x1ac/0x250 [ 536.665465][T15282] ? __pfx_ksys_write+0x10/0x10 [ 536.665478][T15282] __do_fast_syscall_32+0x13a/0x8b0 [ 536.665494][T15282] ? lockdep_hardirqs_on+0x7d/0x110 [ 536.665509][T15282] do_fast_syscall_32+0x32/0x70 [ 536.665525][T15282] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 536.665540][T15282] RIP: 0023:0xf7fa4fec [ 536.665554][T15282] Code: Unable to access opcode bytes at 0xf7fa4fc2. [ 536.665560][T15282] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 536.665571][T15282] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800001c0 [ 536.665579][T15282] RDX: 00000000fffffe58 RSI: 0000000000000000 RDI: 0000000000000000 [ 536.665586][T15282] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 536.665592][T15282] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 536.665599][T15282] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 536.665613][T15282] [ 536.733541][T15284] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2073'. [ 537.319403][T15294] Invalid ELF header magic: != ELF [ 537.321473][T15291] input: syz1 as /devices/virtual/input/input38 [ 537.890619][ T9898] usbhid 7-1:0.0: can't add hid device: -71 [ 537.890736][ T9898] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 537.901508][ T9898] usb 7-1: USB disconnect, device number 11 [ 537.945221][T15304] netlink: 'syz.2.2077': attribute type 15 has an invalid length. [ 538.075823][T15309] kvm: Disabled LAPIC found during irq injection [ 538.202272][T15311] input: syz1 as /devices/virtual/input/input39 [ 538.534855][T15319] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2082'. [ 538.534912][T15319] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 539.107336][T15339] use of bytesused == 0 is deprecated and will be removed in the future, [ 539.107379][T15339] use the actual size instead. [ 539.108873][T15339] FAULT_INJECTION: forcing a failure. [ 539.108873][T15339] name failslab, interval 1, probability 0, space 0, times 0 [ 539.108914][T15339] CPU: 3 UID: 0 PID: 15339 Comm: syz.3.2088 Tainted: G L syzkaller #0 PREEMPT(full) [ 539.108941][T15339] Tainted: [L]=SOFTLOCKUP [ 539.108947][T15339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 539.108954][T15339] Call Trace: [ 539.108958][T15339] [ 539.108963][T15339] dump_stack_lvl+0x100/0x190 [ 539.108982][T15339] should_fail_ex.cold+0x5/0xa [ 539.108997][T15339] should_failslab+0xc2/0x120 [ 539.109012][T15339] __kmalloc_noprof+0xfc/0x840 [ 539.109025][T15339] ? nft_trans_alloc+0x1d/0x2d0 [ 539.109046][T15339] nft_trans_alloc+0x1d/0x2d0 [ 539.109063][T15339] nf_tables_newflowtable+0x1d8d/0x2830 [ 539.109083][T15339] ? __pfx_nf_tables_newflowtable+0x10/0x10 [ 539.109100][T15339] ? __pfx___nla_validate_parse+0x10/0x10 [ 539.109119][T15339] ? lock_acquire+0x1d1/0x380 [ 539.109133][T15339] ? net_generic+0x25/0x2a0 [ 539.109150][T15339] ? __nla_parse+0x40/0x60 [ 539.109168][T15339] nfnetlink_rcv_batch+0x1410/0x2880 [ 539.109190][T15339] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 539.109205][T15339] ? find_held_lock+0x2b/0x80 [ 539.109217][T15339] ? __local_bh_enable_ip+0xa5/0x120 [ 539.109235][T15339] ? lockdep_hardirqs_on+0x7d/0x110 [ 539.109248][T15339] ? __dev_queue_xmit+0xa12/0x4970 [ 539.109285][T15339] ? __nla_parse+0x40/0x60 [ 539.109303][T15339] nfnetlink_rcv+0x3bd/0x440 [ 539.109316][T15339] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 539.109334][T15339] netlink_unicast+0x585/0x850 [ 539.109347][T15339] ? __pfx_netlink_unicast+0x10/0x10 [ 539.109358][T15339] ? aa_sk_perm+0x389/0xab0 [ 539.109376][T15339] netlink_sendmsg+0x8b0/0xda0 [ 539.109392][T15339] ? __pfx_netlink_sendmsg+0x10/0x10 [ 539.109404][T15339] ? apparmor_socket_sendmsg+0x165/0x280 [ 539.109419][T15339] ____sys_sendmsg+0xa4d/0xbe0 [ 539.109434][T15339] ? __pfx_netlink_sendmsg+0x10/0x10 [ 539.109447][T15339] ? __pfx_____sys_sendmsg+0x10/0x10 [ 539.109469][T15339] ___sys_sendmsg+0x190/0x1e0 [ 539.109486][T15339] ? __pfx____sys_sendmsg+0x10/0x10 [ 539.109509][T15339] ? find_held_lock+0x2b/0x80 [ 539.109529][T15339] __sys_sendmsg+0x160/0x210 [ 539.109542][T15339] ? __pfx___sys_sendmsg+0x10/0x10 [ 539.109559][T15339] ? __pfx_ksys_write+0x10/0x10 [ 539.109573][T15339] __do_fast_syscall_32+0x13a/0x8b0 [ 539.109588][T15339] ? lockdep_hardirqs_on+0x7d/0x110 [ 539.109603][T15339] do_fast_syscall_32+0x32/0x70 [ 539.109631][T15339] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 539.109646][T15339] RIP: 0023:0xf700efec [ 539.109660][T15339] Code: Unable to access opcode bytes at 0xf700efc2. [ 539.109665][T15339] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 539.109676][T15339] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000080009b40 [ 539.109683][T15339] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 539.109690][T15339] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 539.109696][T15339] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 539.109702][T15339] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 539.109716][T15339] [ 539.176179][T15340] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2088'. [ 539.312870][T15343] 9p: Bad value for 'wfdno' [ 539.315327][T15343] FAULT_INJECTION: forcing a failure. [ 539.315327][T15343] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 539.315411][T15343] CPU: 0 UID: 0 PID: 15343 Comm: syz.6.2091 Tainted: G L syzkaller #0 PREEMPT(full) [ 539.315437][T15343] Tainted: [L]=SOFTLOCKUP [ 539.315444][T15343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 539.315455][T15343] Call Trace: [ 539.315462][T15343] [ 539.315470][T15343] dump_stack_lvl+0x100/0x190 [ 539.315498][T15343] should_fail_ex.cold+0x5/0xa [ 539.315522][T15343] _copy_from_user+0x2e/0xd0 [ 539.315543][T15343] memdup_user_nul+0x6c/0x120 [ 539.315572][T15343] bitmap_parse_user+0x24/0x90 [ 539.315594][T15343] irq_affinity_proc_write+0x147/0x260 [ 539.315622][T15343] ? __pfx_irq_affinity_proc_write+0x10/0x10 [ 539.315649][T15343] ? lock_acquire+0x1d1/0x380 [ 539.315672][T15343] ? ksys_write+0x12a/0x250 [ 539.315691][T15343] ? __pfx_irq_affinity_proc_write+0x10/0x10 [ 539.315732][T15343] proc_reg_write+0x240/0x330 [ 539.315759][T15343] vfs_write+0x2aa/0x1050 [ 539.315776][T15343] ? __pfx_proc_reg_write+0x10/0x10 [ 539.315797][T15343] ? lock_acquire+0x1d1/0x380 [ 539.315820][T15343] ? __fget_files+0x34/0x3d0 [ 539.315839][T15343] ? __pfx_vfs_write+0x10/0x10 [ 539.315854][T15343] ? find_held_lock+0x2b/0x80 [ 539.315873][T15343] ? __fget_files+0x215/0x3d0 [ 539.315896][T15343] ? __fget_files+0x21f/0x3d0 [ 539.315921][T15343] ksys_write+0x12a/0x250 [ 539.315938][T15343] ? __pfx_ksys_write+0x10/0x10 [ 539.315954][T15343] ? ksys_write+0x1ac/0x250 [ 539.315970][T15343] ? __pfx_ksys_write+0x10/0x10 [ 539.315991][T15343] __do_fast_syscall_32+0x13a/0x8b0 [ 539.316016][T15343] ? lockdep_hardirqs_on+0x7d/0x110 [ 539.316040][T15343] do_fast_syscall_32+0x32/0x70 [ 539.316064][T15343] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 539.316087][T15343] RIP: 0023:0xf7fa4fec [ 539.316107][T15343] Code: Unable to access opcode bytes at 0xf7fa4fc2. [ 539.316116][T15343] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 539.316134][T15343] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000300 [ 539.316146][T15343] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 539.316156][T15343] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 539.316167][T15343] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 539.316177][T15343] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 539.316201][T15343] [ 539.525364][T15350] 9p: Bad value for 'wfdno' [ 539.757954][T15347] ftl_cs: FTL header not found. [ 540.012491][T15347] block2mtd: mtd1: [/dev/loop0] erase_size = 4KiB [4096] [ 540.018043][T15362] 9p: Bad value for 'wfdno' [ 540.079274][ T10] Process accounting resumed [ 540.084017][T15363] netlink: 'syz.2.2096': attribute type 1 has an invalid length. [ 540.240570][T15366] input: syz1 as /devices/virtual/input/input40 [ 540.480902][T15373] netlink: 'syz.9.2100': attribute type 1 has an invalid length. [ 540.480960][T15373] netlink: 'syz.9.2100': attribute type 3 has an invalid length. [ 540.480994][T15373] netlink: 224 bytes leftover after parsing attributes in process `syz.9.2100'. [ 540.486785][T15373] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2100'. [ 540.805735][ T10] usb 14-1: new high-speed USB device number 27 using dummy_hcd [ 540.980808][ T10] usb 14-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 540.984268][ T10] usb 14-1: config 1 has an invalid interface number: 3 but max is 0 [ 540.984311][ T10] usb 14-1: config 1 has no interface number 0 [ 541.007678][ T10] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.007715][ T10] usb 14-1: Product: syz [ 541.007745][ T10] usb 14-1: Manufacturer: syz [ 541.007767][ T10] usb 14-1: SerialNumber: syz [ 541.018935][ T10] usb 14-1: 3:1 : does not exist [ 541.033595][ T10] usb 14-1: 3:2 : does not exist [ 541.255191][ T9898] usb 14-1: USB disconnect, device number 27 [ 542.065092][T15396] FAULT_INJECTION: forcing a failure. [ 542.065092][T15396] name failslab, interval 1, probability 0, space 0, times 0 [ 542.065174][T15396] CPU: 2 UID: 0 PID: 15396 Comm: syz.2.2103 Tainted: G L syzkaller #0 PREEMPT(full) [ 542.065194][T15396] Tainted: [L]=SOFTLOCKUP [ 542.065199][T15396] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 542.065206][T15396] Call Trace: [ 542.065212][T15396] [ 542.065218][T15396] dump_stack_lvl+0x100/0x190 [ 542.065238][T15396] should_fail_ex.cold+0x5/0xa [ 542.065256][T15396] should_failslab+0xc2/0x120 [ 542.065286][T15396] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 542.065301][T15396] ? find_held_lock+0x2b/0x80 [ 542.065315][T15396] ? sock_alloc_inode+0x26/0x2c0 [ 542.065334][T15396] ? __pfx_sock_alloc_inode+0x10/0x10 [ 542.065351][T15396] sock_alloc_inode+0x26/0x2c0 [ 542.065367][T15396] ? __pfx_sock_alloc_inode+0x10/0x10 [ 542.065382][T15396] alloc_inode+0x68/0x250 [ 542.065400][T15396] sock_alloc+0x44/0x280 [ 542.065414][T15396] ? security_socket_create+0x7f/0x250 [ 542.065436][T15396] __sock_create+0xc2/0x860 [ 542.065457][T15396] __sys_socket+0x14d/0x260 [ 542.065474][T15396] ? xfd_validate_state+0x129/0x190 [ 542.065494][T15396] ? __pfx___sys_socket+0x10/0x10 [ 542.065518][T15396] __ia32_sys_socket+0x72/0xb0 [ 542.065537][T15396] ? lockdep_hardirqs_on+0x7d/0x110 [ 542.065553][T15396] __do_fast_syscall_32+0x13a/0x8b0 [ 542.065570][T15396] ? lockdep_hardirqs_on+0x7d/0x110 [ 542.065586][T15396] do_fast_syscall_32+0x32/0x70 [ 542.065602][T15396] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 542.065630][T15396] RIP: 0023:0xf70aefec [ 542.065645][T15396] Code: Unable to access opcode bytes at 0xf70aefc2. [ 542.065650][T15396] RSP: 002b:00000000f53a050c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 542.065663][T15396] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000000000001 [ 542.065670][T15396] RDX: 0000000000000084 RSI: 0000000000000000 RDI: 0000000000000000 [ 542.065678][T15396] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 542.065685][T15396] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 542.065692][T15396] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 542.065707][T15396] [ 542.065809][T15396] socket: no more sockets [ 542.101048][T15402] udevd[15402]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb14/14-1/14-1:1.3/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 542.842305][T15416] jffs2: notice: (15416) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 542.942888][ T9898] usb 14-1: new high-speed USB device number 28 using dummy_hcd [ 543.105527][ T9898] usb 14-1: unable to get BOS descriptor or descriptor too short [ 543.105591][ T9898] usb 14-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 543.106873][ T9898] usb 14-1: config 189 has an invalid interface number: 127 but max is 0 [ 543.106888][ T9898] usb 14-1: config 189 has no interface number 0 [ 543.106902][ T9898] usb 14-1: config 189 interface 127 has no altsetting 0 [ 543.108563][ T9898] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.108575][ T9898] usb 14-1: Product: syz [ 543.108583][ T9898] usb 14-1: Manufacturer: syz [ 543.108590][ T9898] usb 14-1: SerialNumber: syz [ 543.164797][T15422] netlink: 'syz.3.2108': attribute type 1 has an invalid length. [ 543.164902][T15422] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2108'. [ 543.164960][T15422] netlink: 29 bytes leftover after parsing attributes in process `syz.3.2108'. [ 543.366522][T15428] FAULT_INJECTION: forcing a failure. [ 543.366522][T15428] name failslab, interval 1, probability 0, space 0, times 0 [ 543.371540][T15428] CPU: 0 UID: 0 PID: 15428 Comm: syz.6.2110 Tainted: G L syzkaller #0 PREEMPT(full) [ 543.371572][T15428] Tainted: [L]=SOFTLOCKUP [ 543.371577][T15428] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 543.371585][T15428] Call Trace: [ 543.371590][T15428] [ 543.371595][T15428] dump_stack_lvl+0x100/0x190 [ 543.371615][T15428] should_fail_ex.cold+0x5/0xa [ 543.371630][T15428] should_failslab+0xc2/0x120 [ 543.371644][T15428] __kmalloc_noprof+0xfc/0x840 [ 543.371657][T15428] ? handler_new_ref+0x1ab/0xc60 [ 543.371677][T15428] handler_new_ref+0x1ab/0xc60 [ 543.371697][T15428] v4l2_ctrl_new+0xe67/0x23a0 [ 543.371718][T15428] ? __pfx_v4l2_ctrl_new+0x10/0x10 [ 543.371734][T15428] ? __pfx_v4l2_ctrl_new+0x10/0x10 [ 543.371756][T15428] v4l2_ctrl_new_std+0x1bb/0x290 [ 543.371778][T15428] ? __pfx_v4l2_ctrl_new_std+0x10/0x10 [ 543.371794][T15428] ? __pfx_v4l2_ctrl_new_std+0x10/0x10 [ 543.371813][T15428] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 543.371828][T15428] ? media_request_object_init+0x105/0x180 [ 543.371845][T15428] vicodec_open+0x1d9/0xf70 [ 543.371857][T15428] ? kobject_get_unless_zero+0x156/0x200 [ 543.371877][T15428] v4l2_open+0x1d2/0x490 [ 543.371896][T15428] ? __pfx_v4l2_open+0x10/0x10 [ 543.371912][T15428] chrdev_open+0x234/0x6a0 [ 543.371925][T15428] ? __pfx_apparmor_file_open+0x10/0x10 [ 543.371941][T15428] ? __pfx_chrdev_open+0x10/0x10 [ 543.371954][T15428] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 543.371971][T15428] do_dentry_open+0x6ab/0x14d0 [ 543.371983][T15428] ? __pfx_chrdev_open+0x10/0x10 [ 543.371998][T15428] vfs_open+0x82/0x3f0 [ 543.372014][T15428] path_openat+0x19fa/0x2440 [ 543.372030][T15428] ? __pfx_path_openat+0x10/0x10 [ 543.372046][T15428] do_file_open+0x20e/0x430 [ 543.372059][T15428] ? __pfx_do_file_open+0x10/0x10 [ 543.372081][T15428] ? _raw_spin_unlock+0x28/0x50 [ 543.372093][T15428] ? alloc_fd+0x471/0x7a0 [ 543.372109][T15428] do_sys_openat2+0x10f/0x1e0 [ 543.372125][T15428] ? __pfx_do_sys_openat2+0x10/0x10 [ 543.372141][T15428] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 543.372157][T15428] ? __fget_files+0x21f/0x3d0 [ 543.372172][T15428] __ia32_compat_sys_openat+0x12d/0x210 [ 543.372190][T15428] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 543.372206][T15428] ? ksys_write+0x1ac/0x250 [ 543.372222][T15428] do_int80_emulation+0x166/0x650 [ 543.372240][T15428] asm_int80_emulation+0x1a/0x20 [ 543.372252][T15428] RIP: 0023:0xf71a75ab [ 543.372262][T15428] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 543.372273][T15428] RSP: 002b:00000000f546603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 543.372286][T15428] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5466100 [ 543.372293][T15428] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 543.372300][T15428] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 543.372313][T15428] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 543.372320][T15428] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 543.372334][T15428] [ 543.906928][T15433] gadgetfs: bound to dummy_udc driver [ 544.002340][T15431] input: syz1 as /devices/virtual/input/input41 [ 544.537718][ T9898] usbserial_generic 14-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 544.537766][ T9898] usbserial_generic 14-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 544.537806][ T9898] usbserial_generic 14-1:189.127: device has no bulk endpoints [ 544.538111][ T9898] safe_serial 14-1:189.127: safe_serial converter detected [ 544.538171][ T9898] safe_serial 14-1:189.127: probe with driver safe_serial failed with error -22 [ 544.549005][ T9898] usb 14-1: USB disconnect, device number 28 [ 545.015785][ T9643] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 545.167089][T15466] WARNING! power/level is deprecated; use power/control instead [ 545.184766][T15466] netlink: 'syz.9.2119': attribute type 15 has an invalid length. [ 545.199909][ T9643] usb 7-1: unable to get BOS descriptor or descriptor too short [ 545.203332][ T9643] usb 7-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 545.216049][ T9643] usb 7-1: config 189 has an invalid interface number: 127 but max is 0 [ 545.216104][ T9643] usb 7-1: config 189 has no interface number 0 [ 545.216158][ T9643] usb 7-1: config 189 interface 127 has no altsetting 0 [ 545.231208][ T9643] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.231262][ T9643] usb 7-1: Product: syz [ 545.231304][ T9643] usb 7-1: Manufacturer: syz [ 545.231337][ T9643] usb 7-1: SerialNumber: syz [ 545.253278][T15469] netlink: 64 bytes leftover after parsing attributes in process `syz.9.2120'. [ 545.316831][ T5912] block nbd0: Possible stuck request ffff8880273f7000: control (read@0,1024B). Runtime 330 seconds [ 545.322179][ T5912] block nbd0: Possible stuck request ffff8880273f71c0: control (read@1024,3072B). Runtime 330 seconds [ 545.443782][ T50] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 545.770773][ T9643] usbserial_generic 7-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 545.777469][ T9643] usbserial_generic 7-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 545.782328][ T9643] usbserial_generic 7-1:189.127: device has no bulk endpoints [ 545.782916][ T9643] safe_serial 7-1:189.127: safe_serial converter detected [ 545.783022][ T9643] safe_serial 7-1:189.127: probe with driver safe_serial failed with error -22 [ 545.809455][ T9643] usb 7-1: USB disconnect, device number 12 [ 546.457034][T15489] input: syz1 as /devices/virtual/input/input42 [ 546.495229][T15503] Unsupported ieee802154 address type: 0 [ 554.654564][ T5878] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 554.812902][T15565] netlink: 45 bytes leftover after parsing attributes in process `syz.9.2136'. [ 554.816282][ T5878] usb 11-1: unable to get BOS descriptor or descriptor too short [ 554.816326][ T5878] usb 11-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 554.821005][ T5878] usb 11-1: config 189 has an invalid interface number: 127 but max is 0 [ 554.821029][ T5878] usb 11-1: config 189 has no interface number 0 [ 554.821051][ T5878] usb 11-1: config 189 interface 127 has no altsetting 0 [ 554.823587][ T5878] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.823607][ T5878] usb 11-1: Product: syz [ 554.823620][ T5878] usb 11-1: Manufacturer: syz [ 554.823631][ T5878] usb 11-1: SerialNumber: syz [ 556.090055][ T5878] usbserial_generic 11-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 556.090098][ T5878] usbserial_generic 11-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 556.090177][ T5878] usbserial_generic 11-1:189.127: device has no bulk endpoints [ 556.090500][ T5878] safe_serial 11-1:189.127: safe_serial converter detected [ 556.090577][ T5878] safe_serial 11-1:189.127: probe with driver safe_serial failed with error -22 [ 556.091648][ T5878] usb 11-1: USB disconnect, device number 3 [ 556.125469][T15576] netlink: 'syz.2.2140': attribute type 4 has an invalid length. [ 556.147115][T15576] netlink: 'syz.2.2140': attribute type 4 has an invalid length. [ 556.194150][T15570] input: syz1 as /devices/virtual/input/input43 [ 557.951640][T15627] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2145'. [ 558.087703][T15632] binder: 15621:15632 ioctl c0306201 0 returned -14 [ 558.182384][T15639] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2148'. [ 558.323344][T15642] input: syz1 as /devices/virtual/input/input44 [ 558.349027][T15645] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2148'. [ 558.610802][T15588] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 558.907573][T15653] sctp: [Deprecated]: syz.3.2149 (pid 15653) Use of struct sctp_assoc_value in delayed_ack socket option. [ 558.907573][T15653] Use struct sctp_sack_info instead [ 559.273340][T15653] xt_SECMARK: invalid mode: 0 [ 559.398745][ T5209] usb 14-1: new high-speed USB device number 29 using dummy_hcd [ 559.559625][ T5209] usb 14-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 559.560848][ T5209] usb 14-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 559.560898][ T5209] usb 14-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 559.560947][ T5209] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.569511][ T5209] spcp8x5 14-1:1.0: SPCP8x5 converter detected [ 559.608814][ T5209] usb 14-1: SPCP8x5 converter now attached to ttyUSB0 [ 560.104636][T15686] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 560.124601][T15686] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 560.137974][T15686] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 560.144687][T15686] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 560.145052][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff888028a6efa0] (rel) "_HPX" [ 560.145163][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [PCI0] (ffff88801d6e0bc0) [ 560.145244][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.145320][T15686] nsdump-0064 ns_print_pathname : [_HPX] [ 560.145542][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0" [ 560.145572][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0 (ffff88801d6e0bc0) For [_HPX] (Untyped) [ 560.145741][T15686] nssearch-0126 ns_search_one_scope : Name [_HPX] (Untyped) not found in search in scope [PCI0] ffff88801d6e0bc0 first child ffff88801d6e0b80 [ 560.145837][T15686] nssearch-0364 ns_search_and_enter : _HPX Not found in ffff88801d6e0bc0 [Not adding] [ 560.145920][T15686] nsaccess-0605 ns_lookup : Name [_HPX] not found in scope [PCI0] ffff88801d6e0bc0 [ 560.146109][T15686] nsutils-0682 ns_get_node_unlocked : _HPX, AE_NOT_FOUND [ 560.146247][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff888028a6ec60] (rel) "_HPP" [ 560.146326][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [PCI0] (ffff88801d6e0bc0) [ 560.146407][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.146482][T15686] nsdump-0064 ns_print_pathname : [_HPP] [ 560.146691][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0" [ 560.146720][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0 (ffff88801d6e0bc0) For [_HPP] (Untyped) [ 560.146827][T15686] nssearch-0126 ns_search_one_scope : Name [_HPP] (Untyped) not found in search in scope [PCI0] ffff88801d6e0bc0 first child ffff88801d6e0b80 [ 560.146914][T15686] nssearch-0364 ns_search_and_enter : _HPP Not found in ffff88801d6e0bc0 [Not adding] [ 560.170529][T15686] nsaccess-0605 ns_lookup : Name [_HPP] not found in scope [PCI0] ffff88801d6e0bc0 [ 560.170571][T15686] nsutils-0682 ns_get_node_unlocked : _HPP, AE_NOT_FOUND [ 560.171002][T15686] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 560.175089][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff888070829600] (rel) "_EJ0" [ 560.175115][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 560.175132][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.175148][T15686] nsdump-0064 ns_print_pathname : [_EJ0] [ 560.175190][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 560.175198][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_EJ0] (Untyped) [ 560.175226][T15686] nssearch-0126 ns_search_one_scope : Name [_EJ0] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 560.175252][T15686] nssearch-0364 ns_search_and_enter : _EJ0 Not found in ffff888020de3dc0 [Not adding] [ 560.175269][T15686] nsaccess-0605 ns_lookup : Name [_EJ0] not found in scope [S08_] ffff888020de3dc0 [ 560.175287][T15686] nsutils-0682 ns_get_node_unlocked : _EJ0, AE_NOT_FOUND [ 560.175536][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff8880708295e0] (rel) "_RST" [ 560.175565][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 560.175596][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.175624][T15686] nsdump-0064 ns_print_pathname : [_RST] [ 560.175819][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 560.175832][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_RST] (Untyped) [ 560.175877][T15686] nssearch-0126 ns_search_one_scope : Name [_RST] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 560.175912][T15686] nssearch-0364 ns_search_and_enter : _RST Not found in ffff888020de3dc0 [Not adding] [ 560.175941][T15686] nsaccess-0605 ns_lookup : Name [_RST] not found in scope [S08_] ffff888020de3dc0 [ 560.175968][T15686] nsutils-0682 ns_get_node_unlocked : _RST, AE_NOT_FOUND [ 560.219570][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff888070829560] (rel) "_DSM" [ 560.219596][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 560.219614][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.219630][T15686] nsdump-0064 ns_print_pathname : [_DSM] [ 560.219673][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 560.219680][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 560.219710][T15686] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 560.219729][T15686] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 560.219745][T15686] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 560.219762][T15686] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 560.305499][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff8880708294e0] (rel) "_PLD" [ 560.305538][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 560.305568][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.305595][T15686] nsdump-0064 ns_print_pathname : [_PLD] [ 560.305668][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 560.305683][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_PLD] (Untyped) [ 560.305730][T15686] nssearch-0126 ns_search_one_scope : Name [_PLD] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 560.305764][T15686] nssearch-0364 ns_search_and_enter : _PLD Not found in ffff888020de3dc0 [Not adding] [ 560.305790][T15686] nsaccess-0605 ns_lookup : Name [_PLD] not found in scope [S08_] ffff888020de3dc0 [ 560.305818][T15686] nsutils-0682 ns_get_node_unlocked : _PLD, AE_NOT_FOUND [ 560.328230][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff8880708294a0] (rel) "_DSM" [ 560.328267][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 560.328298][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.328325][T15686] nsdump-0064 ns_print_pathname : [_DSM] [ 560.328403][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 560.328415][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 560.328465][T15686] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 560.328498][T15686] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 560.328524][T15686] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 560.328553][T15686] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 560.329031][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff888070829460] (rel) "_DSM" [ 560.329062][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 560.329092][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.329119][T15686] nsdump-0064 ns_print_pathname : [_DSM] [ 560.329182][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 560.329193][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 560.329240][T15686] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 560.329272][T15686] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 560.329298][T15686] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 560.329328][T15686] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 560.329679][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff888070829420] (rel) "_DSM" [ 560.329712][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 560.329744][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.329774][T15686] nsdump-0064 ns_print_pathname : [_DSM] [ 560.329846][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 560.329860][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 560.329910][T15686] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 560.337549][T15686] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 560.337591][T15686] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 560.337674][T15686] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 560.338051][T15686] nsutils-0289 ns_build_internal_name: Returning [ffff8880708291e0] (rel) "_DSM" [ 560.338084][T15686] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 560.338115][T15686] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 560.338141][T15686] nsdump-0064 ns_print_pathname : [_DSM] [ 560.338208][T15686] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 560.338219][T15686] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 560.338263][T15686] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 560.338295][T15686] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 560.338320][T15686] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 560.341870][T15686] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 560.384233][T15686] pci 0000:00:01.0: Adding to iommu group 1 [ 560.479612][T15686] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 560.479634][T15686] pci 0000:00:01.0: vgaarb: bridge control possible [ 560.479647][T15686] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 560.521607][T15686] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 560.532572][T15686] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 560.560332][T15686] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 560.600268][T15686] [drm] Found bochs VGA, ID 0xb0c5. [ 560.601647][T15686] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 560.636804][T15697] input: syz1 as /devices/virtual/input/input46 [ 560.719276][T15686] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 560.859637][T15686] Console: switching to colour frame buffer device 160x50 [ 560.922168][T15686] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 561.082347][T15702] hub 8-0:1.0: USB hub found [ 561.082646][T15702] hub 8-0:1.0: 1 port detected [ 561.168914][T15704] netlink: 'syz.6.2156': attribute type 1 has an invalid length. [ 561.168972][T15704] netlink: 200 bytes leftover after parsing attributes in process `syz.6.2156'. [ 561.169012][T15704] netlink: 29 bytes leftover after parsing attributes in process `syz.6.2156'. [ 561.338776][T15708] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2158'. [ 561.499365][T15710] input: syz1 as /devices/virtual/input/input47 [ 562.167248][T15717] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2160'. [ 562.252362][T15719] binder: 15716:15719 ioctl c0306201 0 returned -14 [ 562.336613][ T58] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 562.367732][ T9642] usb 14-1: USB disconnect, device number 29 [ 562.374477][ T9642] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 562.374837][ T9642] spcp8x5 14-1:1.0: device disconnected [ 562.494382][T15726] sctp: [Deprecated]: syz.9.2162 (pid 15726) Use of struct sctp_assoc_value in delayed_ack socket option. [ 562.494382][T15726] Use struct sctp_sack_info instead [ 562.510983][ T58] usb 7-1: unable to get BOS descriptor or descriptor too short [ 562.511068][ T58] usb 7-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f [ 562.512137][ T58] usb 7-1: config 189 has an invalid interface number: 127 but max is 0 [ 562.512159][ T58] usb 7-1: config 189 has no interface number 0 [ 562.512186][ T58] usb 7-1: config 189 interface 127 has no altsetting 0 [ 562.514268][ T58] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.514291][ T58] usb 7-1: Product: syz [ 562.514307][ T58] usb 7-1: Manufacturer: syz [ 562.514322][ T58] usb 7-1: SerialNumber: syz [ 562.631948][T15726] xt_SECMARK: invalid mode: 0 [ 563.047015][T15734] FAULT_INJECTION: forcing a failure. [ 563.047015][T15734] name failslab, interval 1, probability 0, space 0, times 0 [ 563.047060][T15734] CPU: 3 UID: 0 PID: 15734 Comm: syz.3.2163 Tainted: G L syzkaller #0 PREEMPT(full) [ 563.047097][T15734] Tainted: [L]=SOFTLOCKUP [ 563.047103][T15734] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 563.047110][T15734] Call Trace: [ 563.047115][T15734] [ 563.047120][T15734] dump_stack_lvl+0x100/0x190 [ 563.047194][T15734] should_fail_ex.cold+0x5/0xa [ 563.047211][T15734] should_failslab+0xc2/0x120 [ 563.047246][T15734] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 563.047259][T15734] ? __d_alloc+0x35/0xa50 [ 563.047277][T15734] __d_alloc+0x35/0xa50 [ 563.047294][T15734] d_alloc_pseudo+0x1c/0xc0 [ 563.047311][T15734] alloc_file_pseudo+0x118/0x290 [ 563.047330][T15734] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 563.047345][T15734] ? alloc_fd+0x471/0x7a0 [ 563.047360][T15734] sock_alloc_file+0x50/0x210 [ 563.047395][T15734] __sys_socket+0x1c0/0x260 [ 563.047412][T15734] ? xfd_validate_state+0x129/0x190 [ 563.047430][T15734] ? __pfx___sys_socket+0x10/0x10 [ 563.047452][T15734] __ia32_sys_socket+0x72/0xb0 [ 563.047470][T15734] ? lockdep_hardirqs_on+0x7d/0x110 [ 563.047503][T15734] __do_fast_syscall_32+0x13a/0x8b0 [ 563.047521][T15734] do_fast_syscall_32+0x32/0x70 [ 563.047536][T15734] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 563.047550][T15734] RIP: 0023:0xf700efec [ 563.047564][T15734] Code: Unable to access opcode bytes at 0xf700efc2. [ 563.047569][T15734] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 563.047581][T15734] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 563.047589][T15734] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 563.047596][T15734] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 563.047602][T15734] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 563.047609][T15734] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 563.047623][T15734] [ 563.195122][ T58] usbserial_generic 7-1:189.127: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 563.195162][ T58] usbserial_generic 7-1:189.127: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 563.195221][ T58] usbserial_generic 7-1:189.127: device has no bulk endpoints [ 563.195548][ T58] safe_serial 7-1:189.127: safe_serial converter detected [ 563.195624][ T58] safe_serial 7-1:189.127: probe with driver safe_serial failed with error -22 [ 563.210178][T15739] netlink: 'syz.6.2164': attribute type 1 has an invalid length. [ 563.215554][ T58] usb 7-1: USB disconnect, device number 13 [ 563.239742][T15739] 8021q: adding VLAN 0 to HW filter on device bond1 [ 563.265766][T15739] 8021q: adding VLAN 0 to HW filter on device bond1 [ 563.269988][T15739] bond1: (slave gre1): The slave device specified does not support setting the MAC address [ 563.276018][T15739] bond1: (slave gre1): Error -95 calling set_mac_address [ 563.554797][T11398] usb 11-1: new high-speed USB device number 4 using dummy_hcd [ 563.726068][T11398] usb 11-1: Using ep0 maxpacket: 8 [ 563.727843][T11398] usb 11-1: unable to get BOS descriptor or descriptor too short [ 563.730530][T11398] usb 11-1: New USB device found, idVendor=1e0e, idProduct=9200, bcdDevice=f9.9d [ 563.739731][T11398] usb 11-1: config 106 has an invalid interface number: 220 but max is 0 [ 563.742878][T11398] usb 11-1: config 106 has no interface number 0 [ 563.746864][T11398] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.749924][T11398] usb 11-1: Product: syz [ 563.749952][T11398] usb 11-1: Manufacturer: syz [ 563.749974][T11398] usb 11-1: SerialNumber: syz [ 564.031931][T15739] macvlan2: entered promiscuous mode [ 564.032004][T15739] macvlan2: entered allmulticast mode [ 564.032449][T15739] bond1: entered promiscuous mode [ 564.032865][T15739] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 564.041848][T15739] bond1: left promiscuous mode [ 564.105283][T11398] usb 11-1: USB disconnect, device number 4 [ 564.715182][T15784] jffs2: notice: (15784) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 565.001741][T15792] FAULT_INJECTION: forcing a failure. [ 565.001741][T15792] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 565.001801][T15792] CPU: 2 UID: 0 PID: 15792 Comm: syz.2.2181 Tainted: G L syzkaller #0 PREEMPT(full) [ 565.001840][T15792] Tainted: [L]=SOFTLOCKUP [ 565.001847][T15792] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 565.001859][T15792] Call Trace: [ 565.001866][T15792] [ 565.001874][T15792] dump_stack_lvl+0x100/0x190 [ 565.001903][T15792] should_fail_ex.cold+0x5/0xa [ 565.001924][T15792] _copy_from_user+0x2e/0xd0 [ 565.001945][T15792] snd_rawmidi_kernel_write1+0x390/0x7c0 [ 565.001983][T15792] snd_rawmidi_write+0x2dc/0xc60 [ 565.002032][T15792] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 565.002059][T15792] ? common_file_perm+0x266/0x500 [ 565.002083][T15792] ? __pfx_default_wake_function+0x10/0x10 [ 565.002112][T15792] ? bpf_lsm_file_permission+0x9/0x10 [ 565.002134][T15792] ? security_file_permission+0x76/0x210 [ 565.002160][T15792] ? rw_verify_area+0xce/0x6d0 [ 565.002188][T15792] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 565.002213][T15792] vfs_writev+0x5ed/0xdd0 [ 565.002246][T15792] ? __pfx_vfs_writev+0x10/0x10 [ 565.002277][T15792] ? lock_acquire+0x1d1/0x380 [ 565.002300][T15792] ? __fget_files+0x34/0x3d0 [ 565.002327][T15792] ? __fget_files+0x21f/0x3d0 [ 565.002352][T15792] ? do_writev+0x28a/0x340 [ 565.002377][T15792] do_writev+0x28a/0x340 [ 565.002405][T15792] ? __pfx_do_writev+0x10/0x10 [ 565.002431][T15792] ? ksys_write+0x1ac/0x250 [ 565.002449][T15792] ? __pfx_ksys_write+0x10/0x10 [ 565.002473][T15792] __do_fast_syscall_32+0x13a/0x8b0 [ 565.002498][T15792] ? lockdep_hardirqs_on+0x7d/0x110 [ 565.002524][T15792] do_fast_syscall_32+0x32/0x70 [ 565.002548][T15792] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 565.002597][T15792] RIP: 0023:0xf70aefec [ 565.002617][T15792] Code: Unable to access opcode bytes at 0xf70aefc2. [ 565.002626][T15792] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000092 [ 565.002644][T15792] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000840 [ 565.002658][T15792] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 565.002674][T15792] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 565.002686][T15792] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 565.002697][T15792] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 565.002720][T15792] [ 565.015331][T15795] mac80211_hwsim hwsim33 syzkaller0: entered promiscuous mode [ 565.015365][T15795] mac80211_hwsim hwsim33 syzkaller0: entered allmulticast mode [ 565.180073][T15797] netlink: 'syz.3.2183': attribute type 11 has an invalid length. [ 565.366712][T15810] 0: reclassify loop, rule prio 0, protocol 03 [ 565.381697][T15810] vlan2: entered promiscuous mode [ 565.382068][ T10] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 565.393428][T15810] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2186'. [ 565.393611][T15811] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2186'. [ 565.475653][T15814] netlink: 'syz.6.2187': attribute type 4 has an invalid length. [ 565.475710][T15814] netlink: 224 bytes leftover after parsing attributes in process `syz.6.2187'. [ 565.520908][ T10] usb 7-1: device descriptor read/64, error -71 [ 565.777320][ T10] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 565.916268][ T10] usb 7-1: device descriptor read/64, error -71 [ 566.037832][ T10] usb usb7-port1: attempt power cycle [ 566.354344][ T5882] usb 14-1: new high-speed USB device number 30 using dummy_hcd [ 566.397483][ T10] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 566.420243][ T10] usb 7-1: device descriptor read/8, error -71 [ 566.516995][ T5882] usb 14-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 566.517884][ T5882] usb 14-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 566.517922][ T5882] usb 14-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 566.517955][ T5882] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.519715][T15829] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 566.523720][ T5882] usb 14-1: Quirk or no altset; falling back to MIDI 1.0 [ 566.677246][ T10] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 566.699158][ T10] usb 7-1: device descriptor read/8, error -71 [ 566.814022][ T10] usb usb7-port1: unable to enumerate USB device [ 567.012719][T15841] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(7) [ 567.012750][T15841] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 567.017942][T15841] vhci_hcd vhci_hcd.0: Device attached [ 567.213267][ T9729] usb 14-1: USB disconnect, device number 30 [ 567.305446][ T10] usb 50-1: SetAddress Request (2) to port 0 [ 567.305516][ T10] usb 50-1: new SuperSpeed USB device number 2 using vhci_hcd [ 568.059658][T15850] FAULT_INJECTION: forcing a failure. [ 568.059658][T15850] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 568.059705][T15850] CPU: 0 UID: 0 PID: 15850 Comm: syz.9.2198 Tainted: G L syzkaller #0 PREEMPT(full) [ 568.059734][T15850] Tainted: [L]=SOFTLOCKUP [ 568.059740][T15850] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 568.059747][T15850] Call Trace: [ 568.059752][T15850] [ 568.059757][T15850] dump_stack_lvl+0x100/0x190 [ 568.059776][T15850] should_fail_ex.cold+0x5/0xa [ 568.059791][T15850] _copy_from_user+0x2e/0xd0 [ 568.059804][T15850] get_compat_msghdr+0xb3/0x480 [ 568.059822][T15850] ? __pfx_get_compat_msghdr+0x10/0x10 [ 568.059842][T15850] ___sys_sendmsg+0x1b6/0x1e0 [ 568.059861][T15850] ? __pfx____sys_sendmsg+0x10/0x10 [ 568.059885][T15850] ? find_held_lock+0x2b/0x80 [ 568.059906][T15850] __sys_sendmsg+0x160/0x210 [ 568.059920][T15850] ? __pfx___sys_sendmsg+0x10/0x10 [ 568.059937][T15850] ? __pfx_ksys_write+0x10/0x10 [ 568.059951][T15850] __do_fast_syscall_32+0x13a/0x8b0 [ 568.059967][T15850] ? lockdep_hardirqs_on+0x7d/0x110 [ 568.059982][T15850] do_fast_syscall_32+0x32/0x70 [ 568.059998][T15850] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 568.060012][T15850] RIP: 0023:0xf7f86fec [ 568.060026][T15850] Code: Unable to access opcode bytes at 0xf7f86fc2. [ 568.060031][T15850] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 568.060043][T15850] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 568.060051][T15850] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 568.060057][T15850] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 568.060064][T15850] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 568.060071][T15850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 568.060096][T15850] [ 568.910668][T15865] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 569.137088][T15868] FAULT_INJECTION: forcing a failure. [ 569.137088][T15868] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 569.143890][T15868] CPU: 0 UID: 0 PID: 15868 Comm: syz.9.2203 Tainted: G L syzkaller #0 PREEMPT(full) [ 569.143920][T15868] Tainted: [L]=SOFTLOCKUP [ 569.143925][T15868] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 569.143932][T15868] Call Trace: [ 569.143938][T15868] [ 569.143942][T15868] dump_stack_lvl+0x100/0x190 [ 569.143962][T15868] should_fail_ex.cold+0x5/0xa [ 569.143977][T15868] _copy_from_user+0x2e/0xd0 [ 569.143990][T15868] kstrtouint_from_user+0xd6/0x1d0 [ 569.144005][T15868] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 569.144024][T15868] ? lock_acquire+0x1d1/0x380 [ 569.144042][T15868] proc_fail_nth_write+0x83/0x220 [ 569.144053][T15868] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 569.144068][T15868] vfs_write+0x2aa/0x1050 [ 569.144080][T15868] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 569.144090][T15868] ? lock_acquire+0x1d1/0x380 [ 569.144104][T15868] ? __fget_files+0x34/0x3d0 [ 569.144120][T15868] ? __pfx_vfs_write+0x10/0x10 [ 569.144130][T15868] ? find_held_lock+0x2b/0x80 [ 569.144141][T15868] ? __fget_files+0x215/0x3d0 [ 569.144155][T15868] ? __fget_files+0x21f/0x3d0 [ 569.144170][T15868] ksys_write+0x12a/0x250 [ 569.144181][T15868] ? __pfx_ksys_write+0x10/0x10 [ 569.144196][T15868] do_int80_emulation+0x166/0x650 [ 569.144214][T15868] asm_int80_emulation+0x1a/0x20 [ 569.144225][T15868] RIP: 0023:0xf71875ab [ 569.144235][T15868] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 569.144246][T15868] RSP: 002b:00000000f54464bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 569.144257][T15868] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54465d0 [ 569.144264][T15868] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 569.144271][T15868] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 569.144277][T15868] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 569.144284][T15868] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 569.144298][T15868] [ 569.607921][T15873] team0: Device gtp0 is up. Set it down before adding it as a team port [ 571.297112][T15896] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 571.333395][T15896] overlayfs: failed to resolve './file1/file1': -2 [ 571.599273][T15898] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2213'. [ 571.861494][T15900] netlink: 'syz.6.2215': attribute type 11 has an invalid length. [ 572.748100][ T5884] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.934249][ T5094] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 572.946218][ T5094] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 572.950587][ T5094] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 572.961119][ T5094] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 572.963727][ T5094] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 573.342406][ T5884] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.504074][ T5884] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.728708][T15842] vhci_hcd: connection reset by peer [ 573.728911][ T5779] vhci_hcd vhci_hcd.6: stop threads [ 573.728927][ T5779] vhci_hcd vhci_hcd.6: release socket [ 573.734157][ T10] usb 50-1: device descriptor read/8, error -110 [ 573.750169][ T5779] vhci_hcd vhci_hcd.6: disconnect device [ 573.789944][ T5884] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.083353][ T43] kauditd_printk_skb: 321 callbacks suppressed [ 574.083408][ T43] audit: type=1326 audit(1788267584.745:917): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.083454][ T43] audit: type=1326 audit(1788267584.745:918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.103684][ T43] audit: type=1326 audit(1788267584.763:919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.103744][ T43] audit: type=1326 audit(1788267584.763:920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.124557][ T43] audit: type=1326 audit(1788267584.782:921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=219 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.124641][ T43] audit: type=1326 audit(1788267584.782:922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.124667][ T43] audit: type=1326 audit(1788267584.782:923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.124688][ T43] audit: type=1326 audit(1788267584.782:924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.124710][ T43] audit: type=1326 audit(1788267584.782:925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.124730][ T43] audit: type=1326 audit(1788267584.782:926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15927 comm="syz.2.2220" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 574.177092][ T10] usb usb50-port1: attempt power cycle [ 574.365658][ T5884] macvlan2: left allmulticast mode [ 574.365730][ T5884] ip6gretap0: left allmulticast mode [ 574.377320][ T5884] macvlan2: left promiscuous mode [ 574.377552][ T5884] bridge0: port 3(macvlan2) entered disabled state [ 574.383019][ T5884] bridge_slave_1: left allmulticast mode [ 574.383079][ T5884] bridge_slave_1: left promiscuous mode [ 574.383334][ T5884] bridge0: port 2(bridge_slave_1) entered disabled state [ 574.387790][ T5884] bridge_slave_0: left allmulticast mode [ 574.387805][ T5884] bridge_slave_0: left promiscuous mode [ 574.387904][ T5884] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.517351][ T5884] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 574.522765][ T5884] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 574.527493][ T5884] bond0 (unregistering): Released all slaves [ 574.616387][ T5884] tipc: Left network mode [ 574.746194][T15941] netlink: 45 bytes leftover after parsing attributes in process `syz.6.2222'. [ 574.850060][ T10] usb usb50-port1: unable to enumerate USB device [ 575.223307][T11953] Bluetooth: hci2: command tx timeout [ 575.284280][T15909] bridge0: port 1(bridge_slave_0) entered blocking state [ 575.284347][T15909] bridge0: port 1(bridge_slave_0) entered disabled state [ 575.284471][T15909] bridge_slave_0: entered allmulticast mode [ 575.285193][T15909] bridge_slave_0: entered promiscuous mode [ 575.301223][T15909] bridge0: port 2(bridge_slave_1) entered blocking state [ 575.303605][T15909] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.303724][T15909] bridge_slave_1: entered allmulticast mode [ 575.346042][T15909] bridge_slave_1: entered promiscuous mode [ 575.422549][ T5449] 8021q: adding VLAN 0 to HW filter on device eth14 [ 575.431710][ T5884] hsr_slave_0: left promiscuous mode [ 575.434654][ T5884] hsr_slave_1: left promiscuous mode [ 575.435085][ T5884] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 575.435098][ T5884] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 575.438586][ T5884] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 575.438598][ T5884] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 575.473818][ T5884] veth1_macvtap: left promiscuous mode [ 575.473902][ T5884] veth0_macvtap: left promiscuous mode [ 575.476138][ T5884] veth1_vlan: left promiscuous mode [ 575.476191][ T5884] veth0_vlan: left promiscuous mode [ 575.635378][T15959] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2226'. [ 575.699560][ T5884] team0 (unregistering): Port device team_slave_1 removed [ 575.724299][ T5884] team0 (unregistering): Port device team_slave_0 removed [ 575.820143][T15909] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 575.844396][T15909] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 575.869590][T15962] faux_driver vgem: [drm] Unknown color mode 55545; guessing buffer size. [ 575.883093][T15909] team0: Port device team_slave_0 added [ 575.885359][T15909] team0: Port device team_slave_1 added [ 575.922667][T15909] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 575.922740][T15909] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.922794][T15909] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 575.926728][T15909] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 575.926747][T15909] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.926770][T15909] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 576.009380][T15909] hsr_slave_0: entered promiscuous mode [ 576.009857][T15909] hsr_slave_1: entered promiscuous mode [ 576.010156][T15909] debugfs: 'hsr0' already exists in 'hsr' [ 576.010167][T15909] Cannot create hsr debugfs directory [ 576.233218][ T5449] 8021q: adding VLAN 0 to HW filter on device eth15 [ 576.348893][T15976] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2229'. [ 576.348971][T15976] FAULT_INJECTION: forcing a failure. [ 576.348971][T15976] name failslab, interval 1, probability 0, space 0, times 0 [ 576.348990][T15976] CPU: 0 UID: 0 PID: 15976 Comm: syz.2.2229 Tainted: G L syzkaller #0 PREEMPT(full) [ 576.349006][T15976] Tainted: [L]=SOFTLOCKUP [ 576.349010][T15976] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 576.349017][T15976] Call Trace: [ 576.349021][T15976] [ 576.349026][T15976] dump_stack_lvl+0x100/0x190 [ 576.349045][T15976] should_fail_ex.cold+0x5/0xa [ 576.349060][T15976] should_failslab+0xc2/0x120 [ 576.349074][T15976] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 576.349087][T15976] ? __alloc_skb+0x5b7/0x710 [ 576.349098][T15976] ? __alloc_skb+0x140/0x710 [ 576.349112][T15976] __alloc_skb+0x140/0x710 [ 576.349122][T15976] ? __alloc_skb+0x5b7/0x710 [ 576.349133][T15976] ? __pfx___alloc_skb+0x10/0x10 [ 576.349148][T15976] netlink_ack+0x117/0xb80 [ 576.349163][T15976] netlink_rcv_skb+0x333/0x420 [ 576.349174][T15976] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 576.349190][T15976] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 576.349207][T15976] ? ns_capable+0xd2/0xf0 [ 576.349224][T15976] nfnetlink_rcv+0x1b3/0x440 [ 576.349238][T15976] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 576.349252][T15976] ? netlink_deliver_tap+0x1ae/0xcc0 [ 576.349271][T15976] netlink_unicast+0x585/0x850 [ 576.349286][T15976] ? __pfx_netlink_unicast+0x10/0x10 [ 576.349301][T15976] netlink_sendmsg+0x8b0/0xda0 [ 576.349314][T15976] ? __pfx_netlink_sendmsg+0x10/0x10 [ 576.349326][T15976] ? apparmor_socket_sendmsg+0x165/0x280 [ 576.349342][T15976] ____sys_sendmsg+0xa4d/0xbe0 [ 576.349356][T15976] ? __pfx_netlink_sendmsg+0x10/0x10 [ 576.349368][T15976] ? __pfx_____sys_sendmsg+0x10/0x10 [ 576.349390][T15976] ___sys_sendmsg+0x190/0x1e0 [ 576.349407][T15976] ? __pfx____sys_sendmsg+0x10/0x10 [ 576.349430][T15976] ? find_held_lock+0x2b/0x80 [ 576.349466][T15976] __sys_sendmsg+0x160/0x210 [ 576.349479][T15976] ? __pfx___sys_sendmsg+0x10/0x10 [ 576.349496][T15976] ? __pfx_ksys_write+0x10/0x10 [ 576.349510][T15976] __do_fast_syscall_32+0x13a/0x8b0 [ 576.349525][T15976] ? lockdep_hardirqs_on+0x7d/0x110 [ 576.349539][T15976] do_fast_syscall_32+0x32/0x70 [ 576.349554][T15976] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 576.349569][T15976] RIP: 0023:0xf70aefec [ 576.349581][T15976] Code: Unable to access opcode bytes at 0xf70aefc2. [ 576.349586][T15976] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 576.349598][T15976] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 576.349605][T15976] RDX: 0000000000040000 RSI: 0000000000000000 RDI: 0000000000000000 [ 576.349612][T15976] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 576.349618][T15976] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 576.349625][T15976] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 576.349638][T15976] [ 576.706734][ T5449] 8021q: adding VLAN 0 to HW filter on device eth16 [ 576.920618][T15909] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 576.926788][T15909] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 576.927776][T15909] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 576.931832][T15909] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 576.938541][T15909] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 576.944342][T15909] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 576.945364][T15909] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 576.951564][T15909] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 576.954125][ T5449] 8021q: adding VLAN 0 to HW filter on device eth17 [ 577.046466][T15909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 577.054663][T15909] 8021q: adding VLAN 0 to HW filter on device team0 [ 577.066867][ T6365] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.066997][ T6365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 577.073658][ T6365] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.073786][ T6365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 577.446286][ T5912] block nbd0: Possible stuck request ffff8880273f7000: control (read@0,1024B). Runtime 360 seconds [ 577.446337][ T5912] block nbd0: Possible stuck request ffff8880273f71c0: control (read@1024,3072B). Runtime 360 seconds [ 577.467193][T11953] Bluetooth: hci2: command tx timeout [ 577.818731][T16043] FAULT_INJECTION: forcing a failure. [ 577.818731][T16043] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 577.832524][T16043] CPU: 2 UID: 0 PID: 16043 Comm: syz.2.2236 Tainted: G L syzkaller #0 PREEMPT(full) [ 577.832573][T16043] Tainted: [L]=SOFTLOCKUP [ 577.832581][T16043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 577.832592][T16043] Call Trace: [ 577.832599][T16043] [ 577.832606][T16043] dump_stack_lvl+0x100/0x190 [ 577.832636][T16043] should_fail_ex.cold+0x5/0xa [ 577.832658][T16043] ? __pfx_eventfd_write+0x10/0x10 [ 577.832677][T16043] _copy_from_user+0x2e/0xd0 [ 577.832701][T16043] eventfd_write+0xd9/0x680 [ 577.832721][T16043] ? import_ubuf+0x1b6/0x220 [ 577.832740][T16043] ? __pfx_eventfd_write+0x10/0x10 [ 577.832761][T16043] ? common_file_perm+0x266/0x500 [ 577.832790][T16043] ? bpf_lsm_file_permission+0x9/0x10 [ 577.832816][T16043] ? security_file_permission+0x76/0x210 [ 577.832844][T16043] ? rw_verify_area+0xce/0x6d0 [ 577.832873][T16043] ? __pfx_eventfd_write+0x10/0x10 [ 577.832891][T16043] vfs_writev+0x5ed/0xdd0 [ 577.832923][T16043] ? __pfx_vfs_writev+0x10/0x10 [ 577.832952][T16043] ? lock_acquire+0x1d1/0x380 [ 577.832974][T16043] ? __fget_files+0x34/0x3d0 [ 577.833002][T16043] ? __fget_files+0x21f/0x3d0 [ 577.833027][T16043] ? do_writev+0x13e/0x340 [ 577.833053][T16043] do_writev+0x13e/0x340 [ 577.833082][T16043] ? __pfx_do_writev+0x10/0x10 [ 577.833107][T16043] ? ksys_write+0x1ac/0x250 [ 577.833124][T16043] ? __pfx_ksys_write+0x10/0x10 [ 577.833154][T16043] __do_fast_syscall_32+0x13a/0x8b0 [ 577.833177][T16043] ? lockdep_hardirqs_on+0x7d/0x110 [ 577.833200][T16043] do_fast_syscall_32+0x32/0x70 [ 577.833222][T16043] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 577.833242][T16043] RIP: 0023:0xf70aefec [ 577.833263][T16043] Code: Unable to access opcode bytes at 0xf70aefc2. [ 577.833272][T16043] RSP: 002b:00000000f547c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000092 [ 577.833292][T16043] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000340 [ 577.833304][T16043] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 577.833315][T16043] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 577.833326][T16043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 577.833336][T16043] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 577.833362][T16043] [ 577.843084][T15909] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 577.861535][T16046] ip6t_rt: too many addresses specified [ 578.563237][T15909] veth0_vlan: entered promiscuous mode [ 578.580772][T15909] veth1_vlan: entered promiscuous mode [ 578.630212][T15909] veth0_macvtap: entered promiscuous mode [ 578.670546][T15909] veth1_macvtap: entered promiscuous mode [ 578.731033][T15909] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 578.776170][T15909] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 579.021438][T12080] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 579.021492][T12080] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 579.028267][ T5779] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.028333][ T5779] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.028377][ T5779] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.028398][ T5779] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.072646][T12072] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 579.072705][T12072] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 579.188902][T16084] team0: Device gtp0 is up. Set it down before adding it as a team port [ 579.668772][T11953] Bluetooth: hci2: command tx timeout [ 579.827491][T16110] Console: switching to colour dummy device 80x25 [ 580.090251][T16108] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 580.100943][T16108] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 580.101518][T16108] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 580.104160][T16108] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 580.104839][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e17c40] (rel) "_HPX" [ 580.104867][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [PCI0] (ffff88801d6e0bc0) [ 580.104994][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.105014][T16108] nsdump-0064 ns_print_pathname : [_HPX] [ 580.105166][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0" [ 580.105175][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0 (ffff88801d6e0bc0) For [_HPX] (Untyped) [ 580.105275][T16108] nssearch-0126 ns_search_one_scope : Name [_HPX] (Untyped) not found in search in scope [PCI0] ffff88801d6e0bc0 first child ffff88801d6e0b80 [ 580.105330][T16108] nssearch-0364 ns_search_and_enter : _HPX Not found in ffff88801d6e0bc0 [Not adding] [ 580.105348][T16108] nsaccess-0605 ns_lookup : Name [_HPX] not found in scope [PCI0] ffff88801d6e0bc0 [ 580.107784][T16108] nsutils-0682 ns_get_node_unlocked : _HPX, AE_NOT_FOUND [ 580.107912][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e17ba0] (rel) "_HPP" [ 580.107957][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [PCI0] (ffff88801d6e0bc0) [ 580.107976][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.108109][T16108] nsdump-0064 ns_print_pathname : [_HPP] [ 580.108158][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0" [ 580.108166][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0 (ffff88801d6e0bc0) For [_HPP] (Untyped) [ 580.108200][T16108] nssearch-0126 ns_search_one_scope : Name [_HPP] (Untyped) not found in search in scope [PCI0] ffff88801d6e0bc0 first child ffff88801d6e0b80 [ 580.108220][T16108] nssearch-0364 ns_search_and_enter : _HPP Not found in ffff88801d6e0bc0 [Not adding] [ 580.108238][T16108] nsaccess-0605 ns_lookup : Name [_HPP] not found in scope [PCI0] ffff88801d6e0bc0 [ 580.108460][T16108] nsutils-0682 ns_get_node_unlocked : _HPP, AE_NOT_FOUND [ 580.108973][T16108] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 580.109810][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e17b80] (rel) "_EJ0" [ 580.109953][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 580.110124][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.110152][T16108] nsdump-0064 ns_print_pathname : [_EJ0] [ 580.111340][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 580.111355][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_EJ0] (Untyped) [ 580.111508][T16108] nssearch-0126 ns_search_one_scope : Name [_EJ0] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 580.111543][T16108] nssearch-0364 ns_search_and_enter : _EJ0 Not found in ffff888020de3dc0 [Not adding] [ 580.111568][T16108] nsaccess-0605 ns_lookup : Name [_EJ0] not found in scope [S08_] ffff888020de3dc0 [ 580.111790][T16108] nsutils-0682 ns_get_node_unlocked : _EJ0, AE_NOT_FOUND [ 580.112767][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e17140] (rel) "_RST" [ 580.112805][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 580.112832][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.112956][T16108] nsdump-0064 ns_print_pathname : [_RST] [ 580.113127][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 580.113140][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_RST] (Untyped) [ 580.113280][T16108] nssearch-0126 ns_search_one_scope : Name [_RST] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 580.113317][T16108] nssearch-0364 ns_search_and_enter : _RST Not found in ffff888020de3dc0 [Not adding] [ 580.113343][T16108] nsaccess-0605 ns_lookup : Name [_RST] not found in scope [S08_] ffff888020de3dc0 [ 580.113413][T16108] nsutils-0682 ns_get_node_unlocked : _RST, AE_NOT_FOUND [ 580.120517][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e17160] (rel) "_DSM" [ 580.120547][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 580.120567][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.120586][T16108] nsdump-0064 ns_print_pathname : [_DSM] [ 580.120668][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 580.120676][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 580.120773][T16108] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 580.120885][T16108] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 580.120904][T16108] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 580.120952][T16108] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 580.142964][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e171c0] (rel) "_PLD" [ 580.143055][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 580.143112][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.143217][T16108] nsdump-0064 ns_print_pathname : [_PLD] [ 580.143378][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 580.143484][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_PLD] (Untyped) [ 580.143637][T16108] nssearch-0126 ns_search_one_scope : Name [_PLD] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 580.143761][T16108] nssearch-0364 ns_search_and_enter : _PLD Not found in ffff888020de3dc0 [Not adding] [ 580.143873][T16108] nsaccess-0605 ns_lookup : Name [_PLD] not found in scope [S08_] ffff888020de3dc0 [ 580.143929][T16108] nsutils-0682 ns_get_node_unlocked : _PLD, AE_NOT_FOUND [ 580.146985][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e17240] (rel) "_DSM" [ 580.147100][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 580.147396][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.147661][T16108] nsdump-0064 ns_print_pathname : [_DSM] [ 580.147870][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 580.147883][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 580.147933][T16108] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 580.148064][T16108] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 580.148144][T16108] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 580.148172][T16108] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 580.149278][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e172a0] (rel) "_DSM" [ 580.149332][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 580.150036][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.150061][T16108] nsdump-0064 ns_print_pathname : [_DSM] [ 580.150356][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 580.150369][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 580.150444][T16108] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 580.150674][T16108] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 580.150859][T16108] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 580.151026][T16108] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 580.151773][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888059e172c0] (rel) "_DSM" [ 580.151856][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 580.152029][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.152053][T16108] nsdump-0064 ns_print_pathname : [_DSM] [ 580.152180][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 580.152193][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 580.152241][T16108] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 580.152335][T16108] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 580.152364][T16108] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 580.152392][T16108] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 580.170420][T16108] nsutils-0289 ns_build_internal_name: Returning [ffff888020ccd200] (rel) "_DSM" [ 580.170946][T16108] nsaccess-0399 ns_lookup : Searching relative to prefix scope [S08_] (ffff888020de3dc0) [ 580.171082][T16108] nsaccess-0522 ns_lookup : Simple Pathname (1 segment, Flags=2) [ 580.171108][T16108] nsdump-0064 ns_print_pathname : [_DSM] [ 580.171415][T16108] acpi_ns_get_normalized_pathname: Path "\_SB.PCI0.S08" [ 580.171430][T16108] nssearch-0074 ns_search_one_scope : Searching \_SB.PCI0.S08 (ffff888020de3dc0) For [_DSM] (Untyped) [ 580.171624][T16108] nssearch-0126 ns_search_one_scope : Name [_DSM] (Untyped) not found in search in scope [S08_] ffff888020de3dc0 first child ffff888020de3d80 [ 580.171663][T16108] nssearch-0364 ns_search_and_enter : _DSM Not found in ffff888020de3dc0 [Not adding] [ 580.171754][T16108] nsaccess-0605 ns_lookup : Name [_DSM] not found in scope [S08_] ffff888020de3dc0 [ 580.171842][T16108] nsutils-0682 ns_get_node_unlocked : _DSM, AE_NOT_FOUND [ 580.186978][T16108] pci 0000:00:01.0: Adding to iommu group 1 [ 580.220190][T16108] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 580.220212][T16108] pci 0000:00:01.0: vgaarb: bridge control possible [ 580.220224][T16108] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 580.237006][T16108] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 580.237343][T16108] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 580.250879][T16108] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 580.273174][T16108] [drm] Found bochs VGA, ID 0xb0c5. [ 580.273189][T16108] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 580.372703][T16108] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 580.489746][T16108] Console: switching to colour frame buffer device 160x50 [ 580.497738][T16108] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 580.835543][T16131] Bluetooth: MGMT ver 1.23 [ 580.873928][T16131] NILFS (loop2): device size too small [ 580.928468][ T43] kauditd_printk_skb: 9 callbacks suppressed [ 580.928536][ T43] audit: type=1800 audit(1788267590.138:936): pid=16133 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.2247" name="features" dev="configfs" ino=61912 res=0 errno=0 [ 581.273456][T16136] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2248'. [ 581.490436][T16140] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 581.891060][T11953] Bluetooth: hci2: command tx timeout [ 582.092605][T16144] syzkaller0: entered promiscuous mode [ 582.092646][T16144] syzkaller0: entered allmulticast mode [ 582.301318][T16169] netlink: 20 bytes leftover after parsing attributes in process `syz.9.2253'. [ 582.428812][T16175] netlink: 72 bytes leftover after parsing attributes in process `syz.9.2254'. [ 582.431761][T16175] netlink: 12 bytes leftover after parsing attributes in process `syz.9.2254'. [ 582.443434][T16175] program syz.9.2254 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 582.450777][T16175] loop7: detected capacity change from 0 to 7 [ 582.560839][T16175] Dev loop7: unable to read RDB block 7 [ 582.563030][T16175] loop7: unable to read partition table [ 582.565393][T16175] loop7: partition table beyond EOD, truncated [ 582.568164][T16175] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 582.666005][T15402] buffer_io_error: 9 callbacks suppressed [ 582.666168][T15402] Buffer I/O error on dev loop7, logical block 0, async page read [ 582.678988][T15402] Buffer I/O error on dev loop7, logical block 0, async page read [ 582.679750][T15402] Buffer I/O error on dev loop7, logical block 0, async page read [ 583.222137][ T9729] usb 14-1: new high-speed USB device number 31 using dummy_hcd [ 583.384226][ T9729] usb 14-1: Using ep0 maxpacket: 8 [ 583.385040][ T9729] usb 14-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 583.385985][ T9729] usb 14-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 583.386006][ T9729] usb 14-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 583.388185][ T9729] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.388206][ T9729] usb 14-1: Product: syz [ 583.388219][ T9729] usb 14-1: Manufacturer: syz [ 583.388232][ T9729] usb 14-1: SerialNumber: syz [ 583.393131][ T9729] usb 14-1: config 0 descriptor?? [ 584.022422][T16186] jffs2: notice: (16186) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 586.109786][T16204] netlink: 'syz.7.2262': attribute type 10 has an invalid length. [ 586.117181][T16204] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2262'. [ 586.124653][T16215] netlink: 'syz.2.2264': attribute type 11 has an invalid length. [ 586.556088][ T113] [ 586.556085][ C2] BUG: workqueue leaked atomic, lock or RCU: kworker/2:6[9740] [ 586.556085][ C2] preempt=0x00000101 lock=4->0 RCU=0->0 workfn=usb_giveback_urb_bh [ 586.556251][ C2] INFO: lockdep is turned off. [ 586.556300][ C2] CPU: 2 UID: 0 PID: 9740 Comm: kworker/2:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 586.556341][ C2] Tainted: [L]=SOFTLOCKUP [ 586.556349][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 586.556361][ C2] Workqueue: usb_hub_wq hub_event [ 586.556387][ C2] Call Trace: [ 586.556394][ C2] [ 586.556401][ C2] dump_stack_lvl+0x100/0x190 [ 586.556425][ C2] ? __pfx_usb_giveback_urb_bh+0x10/0x10 [ 586.556453][ C2] process_one_work.cold+0x16d/0x2f2 [ 586.556476][ C2] ? __pfx_usb_giveback_urb_bh+0x10/0x10 [ 586.556508][ C2] ? __pfx_process_one_work+0x10/0x10 [ 586.556532][ C2] ? lock_acquire+0x1d1/0x380 [ 586.556558][ C2] ? __pfx_usb_giveback_urb_bh+0x10/0x10 [ 586.556586][ C2] bh_worker+0x6a5/0x8f0 [ 586.556615][ C2] ? __pfx_bh_worker+0x10/0x10 [ 586.556636][ C2] ? __pfx_sched_clock_cpu+0x10/0x10 [ 586.556658][ C2] ? clockevents_program_event+0x1ef/0x820 [ 586.556680][ C2] workqueue_softirq_action+0x14a/0x1b0 [ 586.556706][ C2] tasklet_action+0x14/0x70 [ 586.556732][ C2] handle_softirqs+0x1e6/0x9d0 [ 586.556759][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 586.556784][ C2] ? _raw_spin_unlock+0x28/0x50 [ 586.556829][ C2] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 586.556853][ C2] __irq_exit_rcu+0x194/0x210 [ 586.556878][ C2] irq_exit_rcu+0x9/0x30 [ 586.556903][ C2] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 586.556925][ C2] [ 586.556931][ C2] [ 586.556938][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 586.556958][ C2] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 [ 586.556980][ C2] Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 ea 66 16 f6 48 89 df e8 12 bd 16 f6 e8 fd 5f 43 f6 fb bf 01 00 00 00 e2 c3 05 f6 65 48 83 3d f1 55 bb 08 00 74 06 5b c3 cc cc cc cc [ 586.556998][ C2] RSP: 0018:ffffc90003a276d8 EFLAGS: 00000206 [ 586.557014][ C2] RAX: 000000000001a94b RBX: ffffffff902871c0 RCX: 0000000000000040 [ 586.557027][ C2] RDX: 0000000000000001 RSI: ffffffff8e3ef999 RDI: 0000000000000001 [ 586.557039][ C2] RBP: ffff888025c09118 R08: 0000000000000001 R09: 0000000000000000 [ 586.557051][ C2] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024910078 [ 586.557062][ C2] R13: 0000000000000000 R14: ffff8880249ba000 R15: ffff888025c09120 [ 586.557080][ C2] ? _raw_spin_unlock_irq+0x23/0x50 [ 586.557099][ C2] usb_hcd_submit_urb+0xac3/0x2150 [ 586.557120][ C2] usb_submit_urb+0x827/0x19b0 [ 586.557141][ C2] ? __init_swait_queue_head+0xca/0x150 [ 586.557169][ C2] usb_start_wait_urb+0x10e/0x580 [ 586.557190][ C2] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 586.557214][ C2] ? __asan_memset+0x23/0x50 [ 586.557260][ C2] usb_control_msg+0x328/0x4b0 [ 586.557281][ C2] ? __pfx_usb_control_msg+0x10/0x10 [ 586.557301][ C2] ? hub_ext_port_status+0x1bb/0x690 [ 586.557322][ C2] hub_event+0x1294/0x4420 [ 586.557352][ C2] ? __lock_acquire+0x4c5/0x1ec0 [ 586.557377][ C2] ? __pfx_hub_event+0x10/0x10 [ 586.557400][ C2] ? __pfx_debug_mutex_unlock+0x10/0x10 [ 586.557421][ C2] ? lock_acquire+0x1d1/0x380 [ 586.557444][ C2] ? process_one_work+0xa2c/0x1b10 [ 586.557465][ C2] ? process_one_work+0x906/0x1b10 [ 586.557486][ C2] ? process_one_work+0x906/0x1b10 [ 586.557510][ C2] process_one_work+0xac7/0x1b10 [ 586.557535][ C2] ? __pfx_process_one_work+0x10/0x10 [ 586.557558][ C2] ? lock_acquire+0x1d1/0x380 [ 586.557583][ C2] ? __pfx_hub_event+0x10/0x10 [ 586.557613][ C2] worker_thread+0x5ef/0xe50 [ 586.557637][ C2] ? __pfx_worker_thread+0x10/0x10 [ 586.557659][ C2] ? kthread+0x13a/0x450 [ 586.557677][ C2] ? __pfx_worker_thread+0x10/0x10 [ 586.557696][ C2] kthread+0x373/0x450 [ 586.557714][ C2] ? __pfx_kthread+0x10/0x10 [ 586.557732][ C2] ret_from_fork+0x730/0xd60 [ 586.557760][ C2] ? __pfx_ret_from_fork+0x10/0x10 [ 586.557787][ C2] ? __switch_to+0x800/0x10f0 [ 586.557809][ C2] ? __pfx_kthread+0x10/0x10 [ 586.557829][ C2] ret_from_fork_asm+0x1a/0x30 [ 586.557850][ C2] [ 586.557902][ T9740] usb 14-1: USB disconnect, device number 31 [ 586.709318][ T113] ====================================================== [ 586.711844][ T113] WARNING: possible circular locking dependency detected [ 586.714218][ T113] syzkaller #0 Tainted: G L [ 586.716137][ T113] ------------------------------------------------------ [ 586.718278][ T113] kswapd1/113 is trying to acquire lock: [ 586.720032][ T113] ffff88804f2c0b60 (&f->sem){+.+.}-{4:4}, at: jffs2_do_clear_inode+0x5a/0x470 [ 586.722815][ T113] [ 586.722815][ T113] but task is already holding lock: [ 586.725121][ T113] ffffffff8efc8ce0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 [ 586.728008][ T113] [ 586.728008][ T113] which lock already depends on the new lock. [ 586.728008][ T113] [ 586.731725][ T113] [ 586.731725][ T113] the existing dependency chain (in reverse order) is: [ 586.734868][ T113] [ 586.734868][ T113] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 586.737163][ T113] lock_acquire+0x1d1/0x380 [ 586.738776][ T113] fs_reclaim_acquire+0xc4/0x100 [ 586.740501][ T113] kmem_cache_alloc_noprof+0x63/0x6a0 [ 586.742378][ T113] jffs2_do_read_inode+0x307/0x520 [ 586.744157][ T113] jffs2_iget+0x32b/0xe30 [ 586.745713][ T113] jffs2_do_fill_super+0x44b/0xa50 [ 586.747757][ T113] jffs2_fill_super+0x283/0x370 [ 586.749584][ T113] mtd_get_sb+0x2f0/0x4c0 [ 586.751636][ T113] get_tree_mtd+0x6f9/0x8a0 [ 586.753728][ T113] vfs_get_tree+0x92/0x320 [ 586.755675][ T113] path_mount+0x7d0/0x24c0 [ 586.757526][ T113] __ia32_sys_mount+0x292/0x310 [ 586.759257][ T113] __do_fast_syscall_32+0x13a/0x8b0 [ 586.761040][ T113] do_fast_syscall_32+0x32/0x70 [ 586.762730][ T113] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 586.764871][ T113] [ 586.764871][ T113] -> #0 (&f->sem){+.+.}-{4:4}: [ 586.767038][ T113] check_prev_add+0xeb/0xe60 [ 586.768654][ T113] __lock_acquire+0x1492/0x1ec0 [ 586.770695][ T113] lock_acquire+0x1d1/0x380 [ 586.772290][ T113] __mutex_lock+0x1a4/0x1bd0 [ 586.774050][ T113] jffs2_do_clear_inode+0x5a/0x470 [ 586.776234][ T113] evict+0x3c2/0xad0 [ 586.778013][ T113] dispose_list+0x117/0x1e0 [ 586.779927][ T113] prune_icache_sb+0xea/0x150 [ 586.781557][ T113] super_cache_scan+0x3ac/0x5c0 [ 586.783277][ T113] do_shrink_slab+0x416/0x1200 [ 586.784957][ T113] shrink_slab+0xa82/0x12e0 [ 586.786611][ T113] shrink_one+0x398/0x850 [ 586.788228][ T113] shrink_node+0x2b20/0x4320 [ 586.789897][ T113] balance_pgdat+0xb20/0x1f00 [ 586.791550][ T113] kswapd+0x556/0xb50 [ 586.792992][ T113] kthread+0x373/0x450 [ 586.794545][ T113] ret_from_fork+0x730/0xd60 [ 586.796341][ T113] ret_from_fork_asm+0x1a/0x30 [ 586.798312][ T113] [ 586.798312][ T113] other info that might help us debug this: [ 586.798312][ T113] [ 586.802001][ T113] Possible unsafe locking scenario: [ 586.802001][ T113] [ 586.804448][ T113] CPU0 CPU1 [ 586.806117][ T113] ---- ---- [ 586.807809][ T113] lock(fs_reclaim); [ 586.809085][ T113] lock(&f->sem); [ 586.811083][ T113] lock(fs_reclaim); [ 586.813105][ T113] lock(&f->sem); [ 586.814320][ T113] [ 586.814320][ T113] *** DEADLOCK *** [ 586.814320][ T113] [ 586.816829][ T113] locks held by kswapd1/113: 2, last CPU#3: [ 586.818691][ T113] #0: ffffffff8efc8ce0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xbce/0x1f00 [ 586.821702][ T113] #1: ffff8880263fa0e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_cache_scan+0x9b/0x5c0 [ 586.825138][ T113] [ 586.825138][ T113] stack backtrace: [ 586.826970][ T113] CPU: 3 UID: 0 PID: 113 Comm: kswapd1 Tainted: G L syzkaller #0 PREEMPT(full) [ 586.830187][ T113] Tainted: [L]=SOFTLOCKUP [ 586.831508][ T113] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 586.834738][ T113] Call Trace: [ 586.835995][ T113] [ 586.837257][ T113] dump_stack_lvl+0x100/0x190 [ 586.839328][ T113] print_circular_bug.cold+0x178/0x1be [ 586.841469][ T113] check_noncircular+0x146/0x160 [ 586.843038][ T113] check_prev_add+0xeb/0xe60 [ 586.844562][ T113] __lock_acquire+0x1492/0x1ec0 [ 586.846086][ T113] lock_acquire+0x1d1/0x380 [ 586.847515][ T113] ? jffs2_do_clear_inode+0x5a/0x470 [ 586.849152][ T113] ? __pfx___might_resched+0x10/0x10 [ 586.850807][ T113] __mutex_lock+0x1a4/0x1bd0 [ 586.852233][ T113] ? jffs2_do_clear_inode+0x5a/0x470 [ 586.854280][ T113] ? jffs2_do_clear_inode+0x5a/0x470 [ 586.856052][ T113] ? mark_held_locks+0x40/0x70 [ 586.857592][ T113] ? __pfx___mutex_lock+0x10/0x10 [ 586.859345][ T113] ? lockdep_hardirqs_on+0x7d/0x110 [ 586.861257][ T113] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 586.863329][ T113] ? xa_destroy+0x227/0x390 [ 586.864876][ T113] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 586.866608][ T113] ? jffs2_do_clear_inode+0x5a/0x470 [ 586.868256][ T113] jffs2_do_clear_inode+0x5a/0x470 [ 586.870114][ T113] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 586.872224][ T113] evict+0x3c2/0xad0 [ 586.873854][ T113] ? _raw_spin_unlock+0x28/0x50 [ 586.875822][ T113] ? __list_lru_walk_one+0x26d/0x550 [ 586.878011][ T113] ? __pfx_evict+0x10/0x10 [ 586.879914][ T113] ? _raw_spin_unlock+0x28/0x50 [ 586.881564][ T113] ? dentry_kill+0x584/0xc20 [ 586.883217][ T113] dispose_list+0x117/0x1e0 [ 586.884980][ T113] prune_icache_sb+0xea/0x150 [ 586.886691][ T113] ? list_lru_count_one+0x147/0x320 [ 586.888778][ T113] ? __pfx_prune_icache_sb+0x10/0x10 [ 586.890915][ T113] super_cache_scan+0x3ac/0x5c0 [ 586.892997][ T113] do_shrink_slab+0x416/0x1200 [ 586.894887][ T113] shrink_slab+0xa82/0x12e0 [ 586.896732][ T113] ? shrink_slab+0x677/0x12e0 [ 586.898605][ T113] ? __pfx_shrink_slab+0x10/0x10 [ 586.900514][ T113] ? lock_acquire+0x1d1/0x380 [ 586.902279][ T113] shrink_one+0x398/0x850 [ 586.903642][ T113] ? shrink_node+0x2b00/0x4320 [ 586.905149][ T113] shrink_node+0x2b20/0x4320 [ 586.906788][ T113] ? shrink_node+0x286e/0x4320 [ 586.908765][ T113] ? __pfx_shrink_node+0x10/0x10 [ 586.910877][ T113] ? find_held_lock+0x2b/0x80 [ 586.912894][ T113] ? balance_pgdat+0xb20/0x1f00 [ 586.914974][ T113] balance_pgdat+0xb20/0x1f00 [ 586.916837][ T113] ? do_raw_spin_lock+0x128/0x260 [ 586.918742][ T113] ? __pfx_balance_pgdat+0x10/0x10 [ 586.920716][ T113] ? lockdep_hardirqs_on+0x7d/0x110 [ 586.922546][ T113] ? __lock_acquire+0x4c5/0x1ec0 [ 586.924318][ T113] ? find_held_lock+0x2b/0x80 [ 586.926199][ T113] ? cgroup1_freezing+0x12c/0x3b0 [ 586.928061][ T113] ? cgroup1_freezing+0x12c/0x3b0 [ 586.930144][ T113] ? cgroup1_freezing+0x136/0x3b0 [ 586.931663][ T113] ? freezing_slow_path+0xb5/0x1a0 [ 586.933091][ T113] kswapd+0x556/0xb50 [ 586.934504][ T113] ? __pfx_kswapd+0x10/0x10 [ 586.936196][ T113] ? rcu_cleanup_dead_rnp+0x2e0/0x2e0 [ 586.938200][ T113] ? __pfx_autoremove_wake_function+0x10/0x10 [ 586.940498][ T113] ? __kthread_parkme+0x18f/0x230 [ 586.942285][ T113] ? kthread+0x13a/0x450 [ 586.943834][ T113] ? __pfx_kswapd+0x10/0x10 [ 586.945805][ T113] kthread+0x373/0x450 [ 586.947982][ T113] ? __pfx_kthread+0x10/0x10 [ 586.949640][ T113] ret_from_fork+0x730/0xd60 [ 586.951132][ T113] ? __pfx_ret_from_fork+0x10/0x10 [ 586.952766][ T113] ? __switch_to+0x800/0x10f0 [ 586.954235][ T113] ? __pfx_kthread+0x10/0x10 [ 586.955698][ T113] ret_from_fork_asm+0x1a/0x30 [ 586.957211][ T113] [ 595.227429][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 595.229582][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 VM DIAGNOSIS: 13:00:28 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000246 RBX=1ffff920005a0e71 RCX=0000000000000000 RDX=0000000000000000 RSI=00000000000000e7 RDI=ffff88802301aa44 RBP=0000000000000000 RSP=ffffc90002d07388 R8 =0000000000000007 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=ffffffff8bffb3c0 R13=00000000000000e7 R14=ffff88802301a580 R15=8000000000000000 RIP=ffffffff81d6493a RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096968000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000008078e000 CR3=000000005f7ea000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000000 RBX=0000000000000006 RCX=0000000000000001 RDX=ffff88801cb24b00 RSI=ffffffff81b64e9e RDI=ffff88801cb24b00 RBP=0000000000000001 RSP=ffffc9000047fdf8 R8 =0000000000000001 R9 =0000000000000003 R10=0000000000000006 R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200008ffc4 R15=0000000000000000 RIP=ffffffff81b64e9f RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096a68000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000003321bff8 CR3=000000000eb96000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001e000000000 0000000600000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=ffffc90006ca0001 RBX=ffffc90006c9fb60 RCX=ffffffff92347801 RDX=ffffc90006c9fb68 RSI=ffffc90006c9fb40 RDI=ffffc90006c9f3f0 RBP=ffffc90006c98000 RSP=ffffc90006c9f370 R8 =0000000000000001 R9 =0000000000000000 R10=ffffc90006c9f3e0 R11=000000000004d7bb R12=ffffc90006c9f430 R13=ffffc90006c9f3e0 R14=ffffc90006c9fb60 R15=ffffc90006c9f414 RIP=ffffffff81b948ad RFL=00000212 [----A--] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096b68000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000002ec24224 CR3=0000000026076000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=000000000534c002 Opmask01=0000000000000000 Opmask02=00000000ffffffff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000559c7e9c9c50 0000559c7e9c9c50 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe6931e370 0000003000000010 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f6c737973007325 2e73250064252e73 2500656c6f736e6f 632f7665642f000a ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4a49565c56005600 0b56000041000b56 000040494a564b4a 460a5340410a000a ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 5f5f203f20205d32 43202020205b5d30 39313735352e3638 3520205b203a6c65 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6363206363206363 2063632033632062 3520363020343720 3030203830206262 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2035352031662064 3320333820383420 3536203666203530 203363203265203e ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 38653c2030302030 3020303020313020 6662206266203666 2033342066352064 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6620386520366620 3631206462203231 2038652066642039 3820383420366620 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000032 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85ae0d15 RDI=ffffffff9bc4f1e0 RBP=ffffffff9bc4f1a0 RSP=ffffc900021569c0 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=6f6c203a4f464e49 R12=0000000000000000 R13=0000000000000032 R14=000000000000000a R15=ffffc90002156cd8 RIP=ffffffff85ae0d3f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096c68000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f743b108 CR3=000000004ff64000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000