last executing test programs: 43.177084203s ago: executing program 0 (id=48): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x8) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000240)={r1, 0xa49a, 0x30}, 0xc) setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000001c0)={r1, 0xfff9, 0x80, 0xfffffffa, 0x5, 0x4}, 0x14) syz_clone3(&(0x7f0000000240)={0x200a00000, 0x0, 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000014c0)=ANY=[@ANYBLOB="5000000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0180000000000000280012800a000100767863616e000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB="00b000002000000008000a00", @ANYRES32=r4, @ANYBLOB="42dd5f5275a83b2ca40420a9b5f18ab599bb6e1efe869223ec781e0b7b70876ccc87761b9183dd2662550f7473d66641a23a80eb45712249469fedf32e96b305f29830412f35d80d5b64e6d860fbd0c85e9ae4c152a37308bcb14b25507d5bb02fb617e43bf2be71125f758e22aed776af4974e87c0e7556c1714e0f1475b934b7ef37edb8"], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb299b000) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') getdents64(r6, &(0x7f00000003c0)=""/4101, 0x1005) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000140)=@req={0x82, 0x57b3, 0x3, 0x9}, 0x10) recvmmsg$unix(r7, &(0x7f0000004400)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000300)=""/27, 0x1b}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r7, &(0x7f00000030c0), 0x0, 0x9200000000000000) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x40830) ioctl$VIDIOC_S_OUTPUT(0xffffffffffffffff, 0xc004562f, &(0x7f0000000000)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xfffff000) clock_adjtime(0x17, &(0x7f00000008c0)={0xea35, 0x9, 0x4000379ee6, 0x0, 0x9, 0x9, 0x8a, 0xd20, 0x100000000000006, 0x7ffffffe, 0x3, 0x4, 0x800000000000009, 0x80000000000002, 0x8001, 0xfffffffffffffffc, 0x800002, 0x8000000000002, 0x9, 0x5, 0x200, 0x3, 0x11cb, 0x100000000, 0x1, 0x100000009}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="008000000000000028bd7000fedbdf2500000000", @ANYRES32=r5, @ANYRESDEC=r5], 0x5c}}, 0x40) rt_sigsuspend(0xffffffffffffffff, 0x8) rmdir(&(0x7f0000000080)='./cgroup/../file0\x00') 40.365747741s ago: executing program 0 (id=52): listns(&(0x7f0000001140)={0x20, 0x0, 0x2}, &(0x7f0000000040)=[0x0, 0x0], 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) syz_usb_connect$uac2(0x3, 0x8b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000300000020532b2300400001020301090279000301fb4004080b02010103200109040000000101200009240108000c1900e508240a00040b060308240a0901030602090401000001022000090401010101022000090501090002080706082501800f07000009040200000102200009040201010102"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000340), 0x75, 0x943f41) ioctl$USBDEVFS_DROP_PRIVILEGES(r1, 0x4004551e, &(0x7f00000000c0)=0xffffffff) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x8010, 0xffffffffffffffff, 0x3b1db000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x142, 0x14) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) write(r2, &(0x7f0000000080)='4', 0x1) ioctl$USBDEVFS_CONNECTINFO(r1, 0x8108551b, &(0x7f0000002a40)) ioctl$USBDEVFS_RESET(r1, 0x5514) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x0) r4 = fsmount(r0, 0x0, 0x1) syz_emit_ethernet(0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa820c6000000000180600ec000000000000000000000000000002fe8000000000000000000000000000aa80004001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="6002000b90780000ac020000"], 0x0) fchdir(r4) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r5, 0x101, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x2) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040f04fc0106046d51df0607be55a79544c83c910f14f5fde76ab57888de40282b00f57bc4059863e9004f549b37ec5ae2bc3aee22f1f81dff0f0000000000000f9d12291afec4840ba299e806e7b980526c51403409ca0415074781bc5d59c6f8d734a89b44d280e5cc01512ba363d76e7db82254ed43413e51f2595d7afbf76c50e571dbb3efa1"], 0x7) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r8) sendmsg$TIPC_CMD_GET_LINKS(r8, &(0x7f00000003c0)={0x0, 0xa6, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r9, 0x1, 0x70bd29, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x0) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x100) getdents64(r5, &(0x7f0000001040)=""/122, 0x7a) 36.806356855s ago: executing program 0 (id=57): r0 = socket$kcm(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x38, r1, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x9, 0x1c}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1464}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]]}, 0x38}, 0x1, 0x0, 0x0, 0x40049d0}, 0x20000000) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000080)="1400000016000b63d25a80648c2566e506bce1e8", 0x14}], 0x1}, 0x0) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="120100006325a640402000498b4d000000010902240001000000000904000002214c6a0009050702000000da000905890e"], 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000004d40)={0x1, 0x0, [{0x48}]}) syz_usb_connect$uac1(0x3, 0xc9, &(0x7f0000000880)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x582, 0x3, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb7, 0x3, 0x1, 0x2, 0xc0, 0x7, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x61, 0x47}, [@output_terminal={0x9, 0x24, 0x3, 0x5, 0x307, 0x5, 0x5, 0x7}, @mixer_unit={0x8, 0x24, 0x4, 0x4, 0xfd, "2fcde3"}, @input_terminal={0xc, 0x24, 0x2, 0x4, 0x400, 0x4, 0x6, 0x6, 0x7}, @selector_unit={0xa, 0x24, 0x5, 0x5, 0x6, "50f8def906"}, @mixer_unit={0x9, 0x24, 0x4, 0x3, 0x22, "8cdef798"}, @extension_unit={0xd, 0x24, 0x8, 0x4, 0x9, 0x1b, "f0e5bb6f6a63"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x401, 0x5, 0x2, 'f'}, @as_header={0x7, 0x24, 0x1, 0x4, 0xe2, 0x1001}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x8, 0x1, 0x80, {0x7, 0x25, 0x1, 0x8, 0x92, 0xffff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x2, 0x2, 0x0, 0x3, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x47, 0x0, 0x2, {0x7, 0x25, 0x1, 0x0, 0x0, 0x9}}}}}}}}]}}, &(0x7f0000000d00)={0xa, &(0x7f0000000980)={0xa, 0x6, 0x310, 0x8, 0x8, 0x2, 0x8, 0x1}, 0x0, 0x0}) syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x0, 0x20, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x7, 0x1, 0x3, 0x1c, "", {{{0x9, 0x5, 0x1, 0x2, 0x40, 0xf7, 0x80, 0x7}}, [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x20, 0xfe, 0xa}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000500)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_MM_EXE_FILE(0x50, 0xd, 0xffffffffffffffff) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, 0x0, 0x0) clock_getres(0x5, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f00000011c0), 0x0) sendto$inet(r8, &(0x7f0000000080)="d3", 0x1, 0x20000050, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r9, &(0x7f0000000f00)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000840}, 0x0) futex(&(0x7f000000cffc)=0x3, 0x3, 0x300, 0x0, &(0x7f00000000c0)=0x8000000, 0x1000004) syz_usb_control_io$printer(r4, 0x0, 0x0) unshare(0x10000) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000001"], 0x0) syz_emit_ethernet(0x19a, &(0x7f00000002c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd60eaff02000c2c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa00000c"], 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r10, 0xee00, 0xee01) 32.532241144s ago: executing program 0 (id=63): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x0) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r3 = socket$inet6(0x10, 0x2, 0x4) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x300000b, 0x20010, r3, 0x42799000) syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r5 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) sendfile(r5, r4, 0x0, 0x3a) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r6, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) r7 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7f, 0x2) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r10, 0x4138ae84, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f0000000000)={0xf0f01f}) sendto$inet6(r3, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x20000000, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r12, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) connect$inet6(r12, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) sendmmsg$inet6(r12, 0x0, 0x0, 0x40080) sendmmsg$inet6(r12, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000400)="15", 0x1}], 0x1}}], 0x2, 0x24040040) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, 0x0, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r11, 0x0, 0x48c, &(0x7f0000001040)={0x1, 'dvmrp0\x00', 0x3}, 0x18) close_range(r2, 0xffffffffffffffff, 0x0) 30.426653845s ago: executing program 0 (id=67): r0 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) cachestat(r0, &(0x7f0000000080)={0x8080008, 0xffffffffffffff5b}, &(0x7f0000000000), 0x0) socket$inet6(0xa, 0x5, 0x0) epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x40040}, 0x0) recvmmsg(r3, &(0x7f0000002e80)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000b40)=""/4113, 0x1011}, {&(0x7f0000000380)=""/201, 0xc9}, {&(0x7f00000001c0)=""/172, 0xac}, {&(0x7f0000000a40)=""/100, 0x64}, {&(0x7f0000004b00)=""/4098, 0x1002}, {&(0x7f0000004ac0)=""/41, 0x29}], 0x6}, 0x19}], 0x3, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x8040480) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f00000000c0)={0x10000000005af5, 0x72d8f6da}) socket(0x2b, 0x800, 0x7) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) futex(0x0, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x111, 0x3}}, 0x5c) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r5, &(0x7f0000000340)={0x15, 0x110, 0xfa00, {r6, 0x73c, 0x30, 0x30, 0x0, @in6={0x1b, 0x4e20, 0x5, @empty, 0xbff}, @ib={0x1b, 0xf, 0x6, {"50916300000000000000000700"}, 0x8000000000000001, 0x8, 0x3ff}}}, 0x118) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r6, 0x2000000a}}, 0x10) close_range(r5, r5, 0x0) syz_80211_inject_frame(&(0x7f0000000040)=@broadcast, &(0x7f0000001b80)=ANY=[@ANYBLOB="40980400080211000001080211000000cd857ada1ad62c000600004000060202020202020103849800030168dd0874049a3bfc38df15dd06b329efe66a59ddf68f02fb88d426663cdeab97c4f76d4aeaaa970ed5ce8cf146ee44b45303866610499c749eb7e5213d8e9ae31e4a577209c6c5d4c7584b04607fc3b9a0f2c70753354144aaf4c5cf7eb6c3aa3bfebbc19c674be8b2806be114956dc8584cfca076a0c2ee78f8c3494d5014857ee8dbdc0ae3f7b7e1a4b0215d73ebb0fee11c666ce841fe9d5640b335cad95cd494260cb85ee98c393c71b8c9b79d464be2a8096a28090dcab7f2afa18a44a3c73f020f0baae24ffea8348993f5cb719d3065b0bcd49551c9b88f97d488d04f4a18762bb2875df2dac523c708bc2535eaf72205fd11c0a4e3432cfd6e9d02059917ff6aa071e5ed76ea53dd1033adb2e0c9af764db1ea1b9928587cd6dd952dc313772b294ccd049b17e186baf678fa1ce162ed9d1e451ff70cf5300df69fed43350c88d25bf6bb4225caf530292154b831bb358130c6ca61105ad4616addb85937ba674989d8fa26b47150e08944d7c94f8d4e49b7b9400314b94e64e1a8c9896b454d114eacb5450d923bc274d406b81e1e525d70bbbbec1bcbd29dd46731c88d2ab9728eef22dd70d03e6c9d7d61f756e0d481a602d37be209c98f9656eddfcae7c8050c82cddfea9384b92c3d85da9038a0cdb68023ea854550a4d6855cf822979bbf94e185b035c4c16a2e1ae06789f6aaf393350024f4d6b37ee438821e7971f1383465c588d296b2f59ab2180ec889f90076492a9d19ddd34ad6f3de9c7568be4816acde5e608a6e65861af74ff15a04633ada07fd5a533a7bd69152f96795d28b5e2c82eed923da01f2efa29d26eef32df41597f49a7214394abaccc3c78f0ac7bd62d25dff6062931ce8a480b121b3f9245c1f8545324a03fd790bcdb5439fce9983674e396fa17043ada7b59dc01b1572890c66dd4023f498bf5911e65ab1a5fdff961090a11b8a2adc048be67a0ef53b0bafa379b152010b45b94353804a2169f04c73a65317e0aadc6cc7a5c4d2e80439af839bb5e22d17ed83bbac9e0db5f77fc141c6f8856eb0e2dd56a4531d7e6ebeeda27c8a21cc602c4a31ff141c9c43cadbe685540928dc4a5d7b81fce216b5c331062045ea6523b63e2d3ab6d50b9af456a81db73b1a253ef712a11b46a60987a38227932b8abc05ee72f6571623debed6f91642e94e13609f9c9384a19743a23e7d52277a10f418f910eb5028a0f47a23915e3997a06ccffb6ece7b5197a350d6c7ed9bf755039c126a1d1418ef87d8903645126c6ab420db5535075d3ef2c5efa78e6b17bad47596d2d87d5aeaff449ad887fbe0691621b9d9f470872d12cbeb460f89e8e5360cd6191d5ac9a1134a94df9a5fb7373d0cea00d694761aa17c8e2b0f1a0782c3"], 0x37e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 29.071508068s ago: executing program 1 (id=69): syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x1) syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x60e0c2) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) socket$kcm(0x29, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$kcm(0x21, 0x2, 0x2) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000240)=0x92) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) statx(0xffffffffffffffff, 0x0, 0x400, 0x7ff, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x30) syz_open_dev$vbi(0x0, 0x1, 0x2) socket$packet(0x11, 0x3, 0x300) r3 = socket(0xa, 0x1, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x39, {0x20009, 0xd, 0x2040000, 0x7, 0xfffffffd, 0xfffffffe}}) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x11, @loopback, 0x0, 0x0, 'lblcr\x00', 0x0, 0x0, 0xfffffffc}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f00000000c0)="010001000000000000000f00015b", 0xe, 0xfffffffffffffffd) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292", 0xc) 26.357331265s ago: executing program 0 (id=73): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) sendmsg$NFT_BATCH(r3, 0x0, 0x40) r5 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='%(,c\xbe\r\xcc:', 0x0) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) close(0x3) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000000203090000000000000000000200000008000440000000100800010000000100002c090002000000ec4101000000090002000000000802000000"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x200488cc) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), 0xffffffffffffffff) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) openat$cgroup_pressure(r8, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) 24.427993065s ago: executing program 32 (id=73): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) sendmsg$NFT_BATCH(r3, 0x0, 0x40) r5 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='%(,c\xbe\r\xcc:', 0x0) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) close(0x3) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000000203090000000000000000000200000008000440000000100800010000000100002c090002000000ec4101000000090002000000000802000000"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x200488cc) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), 0xffffffffffffffff) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) openat$cgroup_pressure(r8, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) 24.422186077s ago: executing program 1 (id=75): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'batadv0\x00', &(0x7f0000000240)=@ethtool_gstrings={0x1b, 0x2}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x3fe, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ioctl$DRM_IOCTL_MODE_RMFB(0xffffffffffffffff, 0xc00464af, &(0x7f0000000480)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) mknod(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000200)=@known='user.incfs.id\x00', 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, 0x0, 0x1) listxattr(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b80)={0x30, r5, 0x1, 0x70bd28, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) ioctl$TCSETAW(r4, 0x5407, &(0x7f0000000040)={0x6, 0x7, 0x9, 0x0, 0x1, "100056f200"}) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000000)=0x8001) openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x20040, 0x0) openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x30b001, 0x0) socket$kcm(0xa, 0x3, 0x87) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) syz_emit_ethernet(0x1de, &(0x7f0000001180)=ANY=[@ANYBLOB="aaaaaaaaaaaae130aeaaba3086dd606410a601a8000000000000000000000000ffffffffffffff020000000000000000000000000001223431d5c9a46b9fa14172170a013589317d2af31ba55431762f462a5abc3f46494ee91bfca594d52f8c3785143e92da5d2d81edc09f68f122fbf741257bf1319408347a17c89212dfe27a0fc65362487e5afe673f0954f60d9d08b61276ce0b3aa520b5f30a9f52c4aa53fc003f8570383ca63530d93b78a7875338b3d7645ef2c24ab05db63cfdcde7b3cac2248c9d1c73d0d4382b3f520ad6e9be698eaa9bf5b939ce09919c9485c4725690ee2483315829a196f85a5ae552ebe19a2d6768ce2a6bf60fbb53104c7919b7cf28fa555fc9460df11e72eddebb2fc4eb6f83b16e0d65307e4210dfc209f0c68df65b57f414dc215546b798af6b6ab7bfb2fe6bd6142f877852717370b1ca39d199c149c3ead97c4e16229ce4c08a111a0fc64651c21e9174dd72442a9ae2a42d9433c7b54c8dd4b59203f9a2e227e9b043"], 0x0) syz_usb_connect(0x0, 0x97, &(0x7f0000000100)=ANY=[@ANYBLOB="12011001000000401e04103000010000000109028500020100803209040000000101000009240100013f0001010c24020101020002030000000c240202030d0002030000000c24020305060002030000000924050803010203000924030901010008"], 0x0) 16.685973388s ago: executing program 1 (id=83): pipe(&(0x7f0000000040)={0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x80049367, &(0x7f0000000100)) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$VIDIOC_CROPCAP(r3, 0xc02c563a, &(0x7f00000000c0)={0xa, {0x4, 0x7, 0x1, 0x401}, {0x0, 0x2, 0x4, 0x1000}, {0xac7, 0x5}}) r4 = syz_open_procfs(0x0, 0x0) pread64(r4, &(0x7f0000001600)=""/4103, 0x1007, 0x97) r5 = add_key$keyring(&(0x7f0000000400), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) ioctl$FS_IOC_GETVERSION(r7, 0xc040ff0b, &(0x7f0000000180)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r8 = io_uring_setup(0xd71, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r8, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x2, &(0x7f0000003000/0x1000)=nil) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r8, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002700)=""/4096, 0x2500}], 0x0, 0xa}, 0x20) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000001140)=0x62a3) 15.607547854s ago: executing program 4 (id=85): syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x1) syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x60e0c2) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) socket$kcm(0x29, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$kcm(0x21, 0x2, 0x2) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000240)=0x92) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) statx(0xffffffffffffffff, 0x0, 0x400, 0x7ff, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x30) syz_open_dev$vbi(0x0, 0x1, 0x2) socket$packet(0x11, 0x3, 0x300) r3 = socket(0xa, 0x1, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, 0x0) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000100)={0x39, {0x20009, 0xd, 0x2040000, 0x7, 0xfffffffd, 0xfffffffe}}) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x11, @loopback, 0x0, 0x0, 'lblcr\x00', 0x0, 0x0, 0xfffffffc}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f00000000c0)="010001000000000000000f00015b", 0xe, 0xfffffffffffffffd) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292", 0xc) 15.293523862s ago: executing program 2 (id=86): r0 = add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="3082010c3081baa003020102020101300a06082a85030701010302300c310a30080603550403130141301e170d3230303130313030303030305a170d3330303130313030303030305a300c310a300806035504031301413068302106082a85030701010101301506092a850307010201010106082a85030701010202034300044001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101300a06082a8503070101030203410002020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202", 0x110, 0xfffffffffffffffd) r1 = request_key(&(0x7f0000000180)='encrypted\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000340)='-*.\x00', r0) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000040)={r1}, &(0x7f0000000080)={'enc=', 'raw', ' hash=', {'streebog256-generic\x00'}}, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x15}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @random="000300"}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x3004c047}, 0x4000050) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 14.695638017s ago: executing program 2 (id=87): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000200)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x8, 0x3a, '/proc/sys/fs/binfmt_misc/register\x00', 0x3a, '/proc/sys/fs/binfmt_misc/register\x00', 0x3a, './file0/../file0', 0x3a, [0x43]}, 0xfffffffffffffe8e) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000bc0), 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x103000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000004c0)={[0x8aba, 0x100d, 0x4, 0x804, 0x7ffd, 0xf, 0x120000, 0x9, 0x1, 0x5, 0x8000000000000000, 0x1, 0x1, 0xfe, 0x6, 0x1], 0x4000, 0x141200}) ioctl$KVM_CAP_HYPERV_SYNIC2(r6, 0x4068aea3, &(0x7f0000000280)) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c0000001900210027bd70000000000e8020100200eb380cd4000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4004040}, 0x8000) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000000)={0x800, 0xa, 0x4}) r8 = openat$dsp(0xffffff9c, &(0x7f0000000ac0), 0x22041, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(r8, 0xc0044dff, &(0x7f0000000b00)=0x88f) ioctl$VIDIOC_QBUF(r3, 0xc058565d, &(0x7f0000000140)=@multiplanar_userptr={0x0, 0x8, 0x4, 0x800000, 0x9, {0x0, 0x2710}, {0x3, 0x0, 0x1, 0x0, 0x3, 0x0, "dd4291c0"}, 0x0, 0x2, {0x0}, 0x0, 0x0, 0xffffffffffffffff}) getpid() r10 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r10, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}}) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="340000003e00010000000800000000000100000004000000100001800c00108004000b800400e30c0002000000000000000000"], 0x34}, 0x1, 0x0, 0x0, 0x4811}, 0x4000094) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000004d0400000000000006000000000000005504030001ed0a0025000000170000001c0080ff000000007b0a00fe000000006e04000000000000e5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379d00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a607c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a59234ed56bc83987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d06c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292cfbe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d700ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec52d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d105800f000000000000ef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f6845b6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aa"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r9}, 0x94) 13.236897206s ago: executing program 1 (id=88): connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ppoll(&(0x7f0000000400)=[{0xffffffffffffffff, 0x4000}], 0x1, &(0x7f0000000500)={0x0, 0x989680}, 0x0, 0x0) r0 = socket$kcm(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x23}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x64}}, 0x90) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90b24fc60", 0x8c0}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000000d40)=""/204, 0xcc}, {&(0x7f0000001280)=""/196, 0xc4}, {&(0x7f0000000680)=""/145, 0x91}, {&(0x7f0000000a80)=""/193, 0xc1}, {&(0x7f0000004480)=""/4080, 0xff0}, {&(0x7f00000002c0)=""/179, 0xb3}, {&(0x7f0000000240)=""/125, 0x7d}, {&(0x7f0000000100)=""/85, 0x55}, {&(0x7f0000003100)=""/4099, 0x1003}, {&(0x7f0000000580)=""/235, 0xeb}, {&(0x7f00000009c0)=""/121, 0x79}, {&(0x7f0000001380)=""/222, 0xde}, {&(0x7f0000000780)=""/242, 0xf2}, {&(0x7f00000001c0)=""/70, 0x46}, {&(0x7f0000000f00)=""/134, 0x86}], 0xf}, 0x140) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x16) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x1, 0x0, 0x40, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = memfd_secret(0x80000) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r2, 0x80089419, &(0x7f0000000380)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001700)={0xffffffffffffffff, 0x0, 0x0}, 0x10) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101041) write$sndseq(r3, &(0x7f0000000080), 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) sendto$packet(0xffffffffffffffff, &(0x7f0000000180)="22093a570703aaf245f93affabc7018af3f87edb6c5b265fe90e10923a87a53e235da88a6e4dc54b82261565704d747608889fbab76c6cd14084f743bb702200fecd851ef5f8eb430ed91503d4780e892544b5256e7840f94f5da63b6d2088926e2ab674199a95e008ea2eb647f45eb8e294b38ba43d49ffbfae05c5bcf26e8eeacda0b9", 0x84, 0x804, &(0x7f0000001740)={0x11, 0x4, 0x0, 0x1, 0x9, 0x6, @random="2b63595e94de"}, 0x14) ioctl$SNDCTL_SYNTH_ID(r2, 0xc08c5114, &(0x7f0000000440)={"e5dce0e854a0bfc36b84d247447f4cec84718ed28faa3c22151394e767e7", 0x8, 0x2, 0x0, 0x5, 0x0, 0xff800000, 0x80000000, 0x5, [0x9, 0x1, 0xa, 0x8, 0x7ff, 0x4, 0x7, 0x58f, 0x81, 0xfffffff7, 0x3, 0x4, 0x47eea20f, 0xffff, 0xfffffffc, 0x5, 0x0, 0x1ef4cbd1, 0x2]}) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) 13.231553386s ago: executing program 3 (id=97): syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000406307312040000102030109026e00030101c010080b000201013007090400000001013000"], 0x0) 11.737638114s ago: executing program 4 (id=89): socket$inet6(0xa, 0x1, 0x84) socket$nl_rdma(0x10, 0x3, 0x14) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x200, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pwritev(r2, &(0x7f0000000800)=[{&(0x7f0000000680)="aec4754e91f6", 0x6}, {0x0}], 0x2, 0x1000, 0x9) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x26) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x1) write$binfmt_aout(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB="03070000ba00000000000000feefffff"], 0xc8) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e62, @multicast1}, 0xffffffffffffffdb) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000005c0)={[0x7, 0x7, 0xa, 0x4000000000000e52, 0x800000000001, 0x5459, 0x1041, 0x200200000006, 0x8, 0x400000001, 0x4, 0x10000fffffffe, 0x3, 0x40000000006, 0x8000000000005, 0x800040069], 0x54000}) r6 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r6, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) listen(r6, 0x5) r7 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r7, &(0x7f0000000300)={0x2, 0x4e20, @loopback}, 0x10) shutdown(r7, 0x1) close(r6) r8 = socket$inet(0x2, 0x1, 0x0) utime(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x8, 0x6}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000080)={'erspan0\x00'}) 11.267443999s ago: executing program 3 (id=90): unshare(0x36000780) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000006c0), 0x1a0001) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0, 0x100000000}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000480)={{0x0, 0x0, 0x1, 0x3}}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000340)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3, 0x3}}) close(0x3) unshare(0x40000000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000003480), 0x81402, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x85, &(0x7f0000002380)=""/4107, &(0x7f00000000c0)=0x1012) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0x100, 0x1d0, 0xffffffff, 0xffffffff, 0x100, 0x1d0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@frag={{0x30}, {[0x0, 0x3f3], 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x3d0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r4, &(0x7f0000000540)='0', 0x1, 0x4000874, &(0x7f0000000580)={0xa, 0x4e21, 0xfff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x800000c0}, 0x1c) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r5, &(0x7f0000000400)=[{{&(0x7f0000000000)={0xa, 0x0, 0x1000000, @private0={0xfc, 0x0, '\x00', 0x5}, 0xffffffff}, 0x1c, &(0x7f0000000700)=[{&(0x7f0000000440)="87", 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, '\x00', 0xa}, 0x2000000b}, 0x1c, &(0x7f0000000280)=[{&(0x7f00000022c0)='t', 0x1}], 0x1}}], 0x2, 0x48081) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x4, 0x81, 0xffffffff, 0xffffffff}) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000012c0)=@ipv6_getaddr={0x18, 0x16, 0x1, 0x70bd29, 0x10080}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x4008880) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') shutdown(r5, 0x1) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f0000000200)={0x0, 0x1}, 0x8) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8, 0x3, {0x0, 0x0, 0x5}, 0x1}, 0x18) 10.889800492s ago: executing program 2 (id=91): socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r3, 0x6a98047402e98331}, 0x14}}, 0x40010) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f00000000c0)="0f01c80f205066b98200004066b80000000066ba000000000f3067660f5e00baf80c66b8e4844e8866efbafc0c66ed660f090f01d764660fdceff30f0966f3aa", 0x40}], 0x1, 0x72, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_clone3(&(0x7f0000000380)={0x4000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000400)=[0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0], 0xa}, 0x81) r6 = openat$dlm_monitor(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) mq_notify(r6, &(0x7f0000000540)={0x0, 0x1f, 0x2, @thr={&(0x7f00000002c0)="a49c54f9a3c2464e51636b15b4f98dead9246ecbeb0825d2b891ead03eddc214bd38b88fc32e1b8f4eb6f3b68e46527c882333529d0e4fa1ff59235f061e8083e719f34911fb336490d9453b69c00a99f0494968cf15f264c45eac8c8424f3e8509788fc0837f2315bca75a136f0d663c546b8bd40c336b106257f7735e2", &(0x7f0000000480)="3c94f9ce13962115d9ae82c085d2043ac5de0be0f9072f7926d6a11d60b4fbcd0fb8b2c8f6f8f2a980fe04947a4b0f17a2bc3279dba5464496f79cf442c77d5b94fa5ad22189d61c01af6afd715a8defe247ab142b86d67a940511e3d8ddb4837eaadbfcef9b041562ecf3e305f83f68abe2b448f4835f716e80f1935b48b2beea700294abd3382fab642af3c4cb0734319fc6530650331229a7d449"}}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000003c0)={[0x4, 0x1000000000, 0x0, 0x10043, 0x2000001, 0x3, 0x2004cb, 0x2, 0x3c00000000000000, 0x9, 0x9, 0x9, 0x403, 0x0, 0x7], 0x25000, 0x202}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f000000e540)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000bc0)=[@rights={{0xc}}, @rights={{0x14, 0x1, 0x1, [r8, r8]}}], 0x20, 0x810}}], 0x1, 0x4048050) ioctl$KVM_RUN(r7, 0xae80, 0x0) socket$inet6(0xa, 0x4, 0x200) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x5b, 0x0, &(0x7f0000000180)="e30080670000ec67838717bd86dde148f0630962bb87dd44fe42904bcee14db4241544716b9ea42231ed3373a3e29953e3bb017d9c1fd05dacf5bb80b4b7ee0fae7aea53492b38978defbb39a1ffa8a175e8257c3c5386795f7aaa", 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xc}, 0x50) r9 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x0) ioctl$FIBMAP(r9, 0x1, &(0x7f0000000040)=0x85) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 10.376552169s ago: executing program 4 (id=92): prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f00002b9000/0x3000)=nil, 0x3000, &(0x7f0000000040)=']]@\\+:)-#\x00') 9.820199529s ago: executing program 4 (id=93): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x7fff, 0x48b03) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x6, 0x2, 0xaa, 0xfa11, 0xfffffffb}, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d4e, 0x103) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) fchownat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xffffffffffffffff, 0x0, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff000000004e04010000000000d3400202010000004704000001ed00007b130000000000001d440200000000007a0a00fe00ffffffc3030000e1000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a6c3692e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5be14ecf7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e347a8ad880d2cd829b847400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c35b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af8612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5e69048ddff6da409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f50000e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc286463a2b1e992894269f478341d02d0f5ad4bcb524a5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39e415140200000020cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a22048516d6aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe0e669e5e20100005353193f82ade69d0540059fe6c7fe7cd8697502c7596566d6740300da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc02290beaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24c87afce829ba0f85da6d8a8f18ea40ab959f6074ab2a4009b9e5f07ab5138aa6e3d37fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e6b0b384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208160fb04c98375b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27feeb741680f6f2f9a6a8346962a350845ffa0d829e4f79ad7d87906943408e6df3adbfd03aac93df8866fb010aecfed9092ca4d0f3e1116a0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a530600d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe92c7719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b1dba94a6ea80c33ead5722c3293986e02c8e0a6dda1eca493f14795bd068826fe8df15efaaeea831555877f958a19e499666a38d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a8784d0899ed888141e2fae6691d1aee1da02ba516467df3e7d1daac19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa57d2c93f49c47944fec01a8aa7749f3187e9efb00000000e0884160b765b07ec9ba020362310223c81e48d6d3b6e5b50d45248efe43a409773e3ed01cd663f3aaab9e1c0000f43b64bb54e5b30be3399e3dd1eb1cfd1935a323023fe5792879833c7eb356b95cfb135045b1d8f7da2fa5bfedef411d0791523a9e64c884e9dfed9cd413afe66bd8ee831cdb34726fe0434fbf44c7b33a853330bcaf37ba4e36705807468b37d32087e599165f1bce015145444ef5967b443222f46173cc876015b2d1874be9846f7c1653c02d2ef9a75fdc45820c69bbe1cb575f9aa21aa9d3d58bd5e5fe026142a72e24049b8400c4a28b2d5db8d5f53cb354fba19975fb0b3739baae51cb4b034993ef1463dcdba2da419b320420efdd091d7f6e83c8ac2ccc6c9392a42a33907421ab847c9590c213eda9a7e1db598a23e75a3c0933fc803ca994a86476b995c37c445f68fd99fb4d335ff00d15bc4630c993fffffe000000000000a236a791bcb6eff8d488041db6b8f2c158c2c3f4baacd0c8cc7eb1fd7fba93237e598771cf6f281aa72139"], &(0x7f00000001c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4000005}, 0x10}, 0x94) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) fcntl$setstatus(r5, 0x4, 0x800) preadv(r5, &(0x7f0000000240)=[{&(0x7f0000000700)=""/73, 0x49}], 0x1, 0x5, 0xffe) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="fc0000001800010029bd7000ffdbdf25e0000002000000000000000000000000640101000000000000000000000000004e2100814e2400050200000073000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1f000000000000000000000000000001000804d32b000000fe8000000000000000000000000000aa01000000010000000300000000000000000000080000000005000000000000cf021eb6000000000007000000000000004909000000000000fbffffffffffffff0100000000000000be000000000000000100000000000000ff07000000000000050000000b0000000600053500000a00040308000000040000000c0015005a0735007c000000"], 0xfc}, 0x1, 0x0, 0x0, 0x880}, 0x40000) sendmmsg$inet6(r3, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x0, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c, &(0x7f0000000540)=[{&(0x7f0000000140)="b8", 0x1}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x4e24, 0xfffffff7, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0xffff}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000a00)}], 0x1}}], 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000100)={0x0, 0x3}, 0x8) close(r2) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x404000) ioctl$SNDRV_TIMER_IOCTL_INFO(r3, 0x80e85411, &(0x7f0000000980)) r7 = getpid() sched_setattr(r7, &(0x7f00000000c0)={0x34, 0x3, 0x1000002d, 0x12000, 0x299d4, 0x4, 0x395400000000000, 0x2, 0x3, 0x5507}, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2) syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) 7.305114163s ago: executing program 1 (id=94): openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8002) ioctl$SG_IO(r2, 0x2285, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0xd1, 0x0, 0x0, @loopback, @multicast1}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000240)={'tunl0\x00', r4, 0x700, 0x7800, 0xffff, 0x8001, {{0x5, 0x4, 0x0, 0x28, 0x14, 0x68, 0x0, 0x10, 0x4, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000005c0)={0xffffffffffffffff, &(0x7f0000000500)="7c7acf3c2e1a5fcd45ffb2d359d8ed352e88e0ef7843a6bc82096294a112176252598064f5d41bc714c022be5136a106a546bb335aee0e0d1aaa5e76654683303ecb65b61789d4104685c4d6bd58af296de4d2d16e81", &(0x7f0000000580)=""/10}, 0x1c) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'pim6reg1\x00', &(0x7f00000001c0)=@ethtool_pauseparam={0x1b, 0x4, 0x62, 0x5}}) r5 = socket$kcm(0x10, 0x2, 0x0) removexattr(&(0x7f0000000280)='./file2\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="73656308000000792e0600000000"]) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f0000000200)={@initdev={0xfe, 0x88, '\x00', 0xff, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa, 0x0, 0x6, 0x0, 0x4000000000000009, 0x10200}) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x9) sendmsg$kcm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="6a6f8e5e", 0x4}], 0x2}, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e80)=ANY=[@ANYBLOB="d80700002a00090029bd700000000000030000003d07db8009005c007369743000000000fdc5806afe0685e3a22471353f9c7f61d0c2958fe1771ed839e85e98eff9f1a0e53485f03c7731c3bd3f431ca0647c04fc0b42e7d16a446105b228f6c3196e4eb4bc79a3d30348467928ac1c08c722bf69260b24dc7eef220949869ca0a3a226029d829c4a117b86aae8212f90452a5164518083570d6b6244f31de6e4610218666fd3c35687343ab73f20edbaa39a8e1780524ac906fd356dd252a77b7d36bb72a78ec3ef233a60ae01082f99f6d4e36587f70ce12bf173af2030f3d0d8eccdcd4f9db0a2847516bef48a154b24460a50d65a19e4747f1a554d91c6fb9e36403725e548a59dc2910ccb20bbf97b6fc386e895ab555a6a9c05ea80080024000080000034012280bf0014805512e5573e3a5a740fd6f1abca53e104996146d2fd9bf5bcf29dd8b5b80d17efc0b2b25f20213343939e11b94f4e2356c59be91c61f2d6b0f3cee9ba427199643589c5800fe3ea3e7c42562296c0732cad9aefb1c3f3af3d233ec4b5e6a6163642117c976ec057cd47400bdbdfdd11486d93f9128c50f28ecce9aa9dbb43b5df9b65e53693bf230809f5036ef57541fbd40400518035b669d6f8dad6a6dd5c8959c4c00d00eb002f6465762f7367230000000004004f8004003780006e00d9800400c08045385e92f4ae0268293a2e3ef6d50ee4efdc59f6b5582512bfa840720c604c46fd3d4944fdecdc6dfd3b2f018ad852ba9a8a46948697d21f1176a8e79e14008b00fc000000000000000000000000000001e64a5bc0591115d3b87596444c08004f00", @ANYRES32=0x0, @ANYBLOB="000060020f80bef2050e3d838de6f2fa9694b667ce24d2afdf8812e088244fd4918baee259e668d9620a738ba7a092b8d4659b6c05918deca588a81741e1971615b462d39d2241c6cd19541d661cd9146f9d4634401fb2fc7be2578efd14fd82f5f9fb49f2801c45c7ab30eff85a0dec4926929d255202b71256cb12f4c969b66216cc265a46a325cdf4710149b8b87d12163d51dbfe6524a7c38051812c6bae86ca7e29de9c348c3359f4aa597431443da9d6a36463e329d99c242bcf780be523e1b86745828a9c29a55b644edba651875946624a01b605d828e074386a6a18cdd50614fa10bc2f3ea89a93201fc40a7276992eecd9f2dd7e5e606a33b9adc3d532b001bebdd201167d8eb4549ec763bd9748a549334b0f94d950ae949eb2ebb89bfcd82395f4f2562fe9a1141c9ba4f7a06a8a9518df17a75a33c60ac952678d0d16e1619f75a79046c6363c9a196f03e5741f88e2913d14053bd6efdcb462217f535e976b3568de5a355b78b551a8f9909b52e28e02ee7f002dd7651c54e7300d2b13285c11313cd5478896e40400d58010ea8ab130fec9447b4eecc04131406e6f0dfd3df5cbe9e83eebc7c039dc2be6661f087528a661091ec49ef7d4389e3c337d0b7f55045ac7209e3dc1b20848430945025bb6f3889412000c5d8ec2a2f4023ceae1a540f180f78fbcd94181e38c06244e961363469ddd01512b4861bea7228c230609293168038914d05bb4c2069849c1d25692c270f3f3e1adc4a356ad61a77ca32ec27c6e6eaa43cf043a5b5096697a80a198cf26d36020e76ca6beed1e326f31d61df54ec1947a35efef5fe46764a4cca304004e8004004680aa09edf901048008003600", @ANYRES32=0x0, @ANYBLOB="ceec0b442ba9642c7aac9b094b01bec426396ab9007e5a3b9394192de421ce2626527804455b77dfb8009c000859d851237bd14e3822e7f5792f1a5f815a2001c0da9b4b15638238c93c496c732c1b861631734a75a2e9300a86be8d63aa88b27a3d3ce3c108d0ca362e849f6089d1a590a553d6c367d7ef76e087815820a30735a1937875cb1cc222fd0dc1c62e7c82b728d3399dac52dd63255a1f5b08e013ae8d71c20452bf81519f5f6cb1f365203395dbc850d71109ea438e274825fcec72ed9a70a6b4ef1ba98cd4206f4bb82c1e76993211d444d9a5be2589a85bd36b04007c800d006600294a2e7d2d2c5c2e000000000400398079000b8008005200ac1e00010c0040000900000000000000b3be003a36c7ebeee6ef9be407dc55a34913000fbcf322db750439b661f5248f546fa48bce31a277a521974c78c2d3cc5d29b48d601d5e17587615a7fcce3c42761a6ed5979f7e721782451a16c4047d0e8a4a3addabe34243118629cb2319b8c10000002000a680e351d4278fb8fcee6aed32c221691bb246d47a507fa33c16a8fc8da208002000", @ANYRES32=0x0, @ANYBLOB="ff8a1f169a0224c36909abb959716a1052ff1ab2363c62230d366c25ad6c1fb058db465ba75fffa503d46ab71c6b0927aaeb6c7474002989f8bf2391c65b7b5afabd35a6798229ab85c4f20ffdb01022c30000000400ca004bce0acef8a8c2a5ebabad4bc3dd572a2246b4e08052a85df5b77c00298059009d00c3c7a2a41c5701332eb451e6146a444f617dc4480a1849bd11a42c3f7c0c34ce8b2678117e02f1a01050d4b3d01ee82f8555a58404baa011d6fc461bc423c0e7d5ba15c745c4da4b123fe46fb98487cc37477a325b000000040003800900ad0073697430000000000c007c000000008000000000000000840009007f1f00000000000000000000000042b7654c892806d2718da73b700c2322b4017076b4707d7936ba1fe603e2889042010000000100000034e01b5e30493388e52af2c7968f11931a8c60c760319da77211f4bd2ca27c39a5965cf6a3b9121ea5ece75c3c3596084a0afcbaf2e8ce31653c1937265437f31e6db28a901a1dd416"], 0x7d8}, 0x1, 0x0, 0x0, 0x4}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0xc17a) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x0) 6.577885033s ago: executing program 2 (id=95): add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="3082010c3081baa003020102020101300a06082a85030701010302300c310a30080603550403130141301e170d3230303130313030303030305a170d3330303130313030303030305a300c310a300806035504031301413068302106082a85030701010101301506092a850307010201010106082a85030701010202034300044001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101300a06082a8503070101030203410002020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202", 0x110, 0xfffffffffffffffd) 5.675722278s ago: executing program 2 (id=96): syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000020000402505a3a440000000010109023b000101010000090400001202eb0000052406000005240000000d240f010000000000001e00000905820200020000000905", @ANYRES16], 0x0) 4.552156113s ago: executing program 4 (id=98): pipe(&(0x7f0000000040)={0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x80049367, &(0x7f0000000100)) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$VIDIOC_CROPCAP(r3, 0xc02c563a, &(0x7f00000000c0)={0xa, {0x4, 0x7, 0x1, 0x401}, {0x0, 0x2, 0x4, 0x1000}, {0xac7, 0x5}}) r4 = syz_open_procfs(0x0, 0x0) pread64(r4, &(0x7f0000001600)=""/4103, 0x1007, 0x97) r5 = add_key$keyring(&(0x7f0000000400), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) ioctl$FS_IOC_GETVERSION(r7, 0xc040ff0b, &(0x7f0000000180)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r8 = io_uring_setup(0xd71, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r8, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x2, &(0x7f0000003000/0x1000)=nil) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r8, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002700)=""/4096, 0x2500}], 0x0, 0xa}, 0x20) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000001140)=0x62a3) 3.606721352s ago: executing program 2 (id=99): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable', 0x8) r1 = syz_usb_connect(0x2, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040480b03100001000000010902390002010080fa0904000000ff0000000904010000ff00000009040101"], 0x0) r2 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000000)='1', 0x1}, {&(0x7f0000000080)="b9", 0x1}], 0x2, 0x8, 0xa) syz_usb_control_io(r1, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000240)="c9", 0x1, 0x4044880, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0x3454, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xffffffff}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r4 = userfaultfd(0x80001) mremap(&(0x7f00002f9000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000162000/0x2000)=nil) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x1a5}) syz_emit_ethernet(0x5e, &(0x7f00000000c0)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xe}, @void, {@ipv6={0x86dd, @icmpv6={0x3, 0x6, '\x00', 0x28, 0x3a, 0x0, @local, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @private1, @mcast2}}}}}}, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000340)={{0xa, 0x4e20, 0x8, @private0={0xfc, 0x0, '\x00', 0x1}, 0x40}, {0xa, 0x4e24, 0xe, @mcast1, 0x9}, 0x0, {[0x80, 0x4, 0x6, 0x10001, 0x7, 0x40, 0x5, 0xb2]}}, 0x5c) r5 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003d37d840890457e00000000000010902240003000000000904"], 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000280)={'wg2\x00'}) socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000003d80)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4040814) syz_usb_control_io$hid(r5, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) 3.531757198s ago: executing program 3 (id=100): syz_usb_connect(0x3, 0x63, &(0x7f0000000740)={{0x12, 0x1, 0x310, 0x78, 0xe8, 0x72, 0x20, 0x1f71, 0x3306, 0x2ac0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x51, 0x2, 0x3, 0x1, 0x80, 0x5, "", [{{0x9, 0x4, 0xdf, 0x0, 0x0, 0x46, 0x35, 0x34, 0xf}}, {{0x9, 0x4, 0x19, 0x6, 0x5, 0xfb, 0xdc, 0x42, 0x0, [], [{{0x9, 0x5, 0x80, 0x10, 0x200, 0x6, 0x6, 0x4, [@generic={0x9, 0x4, "df9b52d017dc73"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x200, 0xaf, 0x2, 0x83}}, {{0x9, 0x5, 0x8b, 0x0, 0x20, 0x1, 0x8, 0x8}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0x8, 0x1b, 0x6}}, {{0x9, 0x5, 0xe, 0x1, 0x200, 0x3, 0x9, 0x40}}]}}]}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) 1.873942029s ago: executing program 1 (id=101): r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) r1 = syz_open_dev$ptys(0xc, 0x3, 0x1) r2 = dup3(r1, r0, 0x80000) ioctl$FS_IOC_SETFLAGS(r2, 0x40046602, &(0x7f0000000040)=0x40) r3 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000180)=0x1, 0xffffffffffffff61) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x213a, 0x13580, 0x0, 0x387}, 0x0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x0, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xd, 0xf, 0x4, 0x80010000, 0x2, 0x3, 0x10007f, 0x20000026, 0x4d, 0x9, 0x3, 0x9, 0x2, 0x100, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000000, 0x24, 0xd, 0x1, 0x0, 0x40, 0xe661, 0xffffffa8, 0x7, 0x2, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x14, 0x1, 0x7, 0x201, 0x3e, 0x2, 0x6, 0x6, 0x9, 0x5, 0x4, 0x8, 0xe, 0x80, 0x1, 0xd, 0x6, 0x8, 0x4, 0x1, 0x2], [0x10000007, 0x7, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e4, 0x1, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x1b4858bd, 0x2b, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x2, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x4, 0x1, 0xff, 0x7fff, 0x1000005, 0x5f31, 0xd, 0x1000, 0x0, 0x4, 0xb, 0x4001, 0x9, 0x8, 0xb, 0x6, 0x47, 0x8020, 0x1, 0x3ff, 0xffff, 0x46, 0x4, 0x9, 0xb, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93693, 0x6, 0x103], [0x3, 0xa, 0x6, 0x5, 0xffffffff, 0x100, 0x8d2, 0x9, 0x7, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3ea, 0xb, 0x203, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x800006, 0x38, 0x800003, 0x6000, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0x9, 0x7, 0xa9, 0xffff7fff, 0x3, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x7, 0x5, 0x1c, 0x120000, 0x80000000, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0xff, 0x4, 0x2, 0x101, 0x10000, 0x40004, 0x7fff, 0x10000, 0xfffffff7, 0x2, 0x5, 0x1, 0xfffff800, 0x7, 0xe0a7, 0x2, 0xfffffff8, 0x381f, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0x6, 0x10080, 0x13, 0x80, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d693, 0xa1f, 0x3, 0x7, 0x400001, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = eventfd(0x5f0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000300)={0x0, 0x3000, 0x8}) ioctl$KVM_IOEVENTFD(r5, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0x0, 0x0, r6}) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @dev={0xfe, 0x80, '\x00', 0x38}, 0x80000001}, 0x1c) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) sendfile(r7, r8, 0x0, 0x20000023896) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x1c) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0x400000000010, 0x800, 0x5) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r13, {0x6, 0xc}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0xe38, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}, @TCA_EM_IPT_MATCH_NAME={0xfffffe5e}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x84}, 0x40010) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x40) 1.55186978s ago: executing program 3 (id=102): bpf$MAP_CREATE_TAIL_CALL(0x9, &(0x7f0000000380)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x50) 1.292614611s ago: executing program 3 (id=103): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x3da}}, &(0x7f0000000000)='syzkaller\x00', 0x8, 0x1009, &(0x7f0000004180)=""/4105, 0x40f00}, 0x94) 773.332474ms ago: executing program 3 (id=104): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000200)=0x15) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000240)='net/kcm\x00') read$qrtrtun(r5, &(0x7f0000000100)=""/139, 0x8b) sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, &(0x7f0000000340)="0000000000000002ff69000000000001000000c000000006000200861f", 0x1d, 0xffffffffffffffff) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001080900"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004004400000008001b0000000000"], 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f00000003c0)='net/kcm\x00', &(0x7f0000000400)='GPL\x00', 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000180)=0x4) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) write(r2, &(0x7f0000000900)="5b026c7c84c906313302b74cffc27a06877c09dc61343ab65276f8fec7d70d600a4e16599c827105ac95a27e5d69965d6efcf10b548be2c2652136869bf33ebba0c83ceb383ae23d8de5c6a723a02371626ed111780e5753699f245bdaf68f90deb799a63358aaf3477cbdc040bbc446c98091e167", 0x75) socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000500)={{{@in=@remote, @in6=@mcast2}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f0000000440)=0xe4) r8 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r8, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$inet6(r8, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 0s ago: executing program 4 (id=105): socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r3, 0x6a98047402e98331}, 0x14}}, 0x40010) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f00000000c0)="0f01c80f205066b98200004066b80000000066ba000000000f3067660f5e00baf80c66b8e4844e8866efbafc0c66ed660f090f01d764660fdceff30f0966f3aa", 0x40}], 0x1, 0x72, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_clone3(&(0x7f0000000380)={0x4000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000400)=[0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0], 0xa}, 0x81) r6 = openat$dlm_monitor(0xffffff9c, &(0x7f0000000100), 0x2000, 0x0) mq_notify(r6, &(0x7f0000000540)={0x0, 0x1f, 0x2, @thr={&(0x7f00000002c0)="a49c54f9a3c2464e51636b15b4f98dead9246ecbeb0825d2b891ead03eddc214bd38b88fc32e1b8f4eb6f3b68e46527c882333529d0e4fa1ff59235f061e8083e719f34911fb336490d9453b69c00a99f0494968cf15f264c45eac8c8424f3e8509788fc0837f2315bca75a136f0d663c546b8bd40c336b106257f7735e2", &(0x7f0000000480)="3c94f9ce13962115d9ae82c085d2043ac5de0be0f9072f7926d6a11d60b4fbcd0fb8b2c8f6f8f2a980fe04947a4b0f17a2bc3279dba5464496f79cf442c77d5b94fa5ad22189d61c01af6afd715a8defe247ab142b86d67a940511e3d8ddb4837eaadbfcef9b041562ecf3e305f83f68abe2b448f4835f716e80f1935b48b2beea700294abd3382fab642af3c4cb0734319fc6530650331229a7d449"}}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000003c0)={[0x4, 0x1000000000, 0x0, 0x10043, 0x2000001, 0x3, 0x2004cb, 0x2, 0x3c00000000000000, 0x9, 0x9, 0x9, 0x403, 0x0, 0x7], 0x25000, 0x202}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f000000e540)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000bc0)=[@rights={{0x10, 0x1, 0x1, [r8]}}, @rights={{0x14, 0x1, 0x1, [r8, r8]}}], 0x24, 0x810}}], 0x1, 0x4048050) ioctl$KVM_RUN(r7, 0xae80, 0x0) socket$inet6(0xa, 0x4, 0x200) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r9 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x0) ioctl$FIBMAP(r9, 0x1, &(0x7f0000000040)=0x85) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.239' (ED25519) to the list of known hosts. [ 78.230319][ T5608] cgroup: Unknown subsys name 'net' [ 78.327715][ T5608] cgroup: Unknown subsys name 'cpuset' [ 78.331305][ T5608] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.933077][ T5608] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 83.549734][ T5622] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.550986][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 83.562865][ T5618] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.570586][ T5618] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 83.578350][ T5618] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.578801][ T5623] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 83.579442][ T5618] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 83.596668][ T5623] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.596857][ T5623] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 83.600548][ T5618] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 83.606162][ T4936] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 83.611619][ T4936] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 83.615448][ T4936] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 83.661461][ T5622] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 83.672625][ T5622] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 83.698628][ T5618] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 83.712730][ T5618] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 83.722740][ T5618] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 83.739385][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 83.751151][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 83.788364][ T4936] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 83.789755][ T4936] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 83.792030][ T4936] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 83.800554][ T4936] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 83.825678][ T4936] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 84.899407][ T5635] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.900161][ T5635] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.900311][ T5635] bridge_slave_0: entered allmulticast mode [ 84.901882][ T5635] bridge_slave_0: entered promiscuous mode [ 84.910232][ T5635] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.910512][ T5635] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.910716][ T5635] bridge_slave_1: entered allmulticast mode [ 84.912497][ T5635] bridge_slave_1: entered promiscuous mode [ 84.997567][ T5629] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.997692][ T5629] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.997793][ T5629] bridge_slave_0: entered allmulticast mode [ 84.999201][ T5629] bridge_slave_0: entered promiscuous mode [ 85.081641][ T5629] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.081742][ T5629] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.081915][ T5629] bridge_slave_1: entered allmulticast mode [ 85.084503][ T5629] bridge_slave_1: entered promiscuous mode [ 85.133927][ T5634] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.134020][ T5634] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.134354][ T5634] bridge_slave_0: entered allmulticast mode [ 85.135915][ T5634] bridge_slave_0: entered promiscuous mode [ 85.192083][ T5635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.213016][ T5634] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.213107][ T5634] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.213221][ T5634] bridge_slave_1: entered allmulticast mode [ 85.219915][ T5634] bridge_slave_1: entered promiscuous mode [ 85.224021][ T5628] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.224282][ T5628] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.227573][ T5628] bridge_slave_0: entered allmulticast mode [ 85.233707][ T5628] bridge_slave_0: entered promiscuous mode [ 85.241555][ T5628] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.241891][ T5628] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.242243][ T5628] bridge_slave_1: entered allmulticast mode [ 85.248613][ T5628] bridge_slave_1: entered promiscuous mode [ 85.266417][ T5629] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.280279][ T5635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.343876][ T5629] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.421284][ T5634] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.421528][ T5633] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.421704][ T5633] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.421839][ T5633] bridge_slave_0: entered allmulticast mode [ 85.425271][ T5633] bridge_slave_0: entered promiscuous mode [ 85.450420][ T5628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.480193][ T5635] team0: Port device team_slave_0 added [ 85.480569][ T5633] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.480676][ T5633] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.480821][ T5633] bridge_slave_1: entered allmulticast mode [ 85.482504][ T5633] bridge_slave_1: entered promiscuous mode [ 85.500242][ T5634] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.509581][ T5628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.517534][ T5629] team0: Port device team_slave_0 added [ 85.533816][ T5635] team0: Port device team_slave_1 added [ 85.587602][ T5629] team0: Port device team_slave_1 added [ 85.651394][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.651411][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.651439][ T5635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.669274][ T5633] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.680755][ T5634] team0: Port device team_slave_0 added [ 85.688043][ T52] Bluetooth: hci2: command tx timeout [ 85.689343][ T5628] team0: Port device team_slave_0 added [ 85.730548][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.730564][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.730587][ T5635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.737257][ T5633] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.767129][ T4936] Bluetooth: hci0: command tx timeout [ 85.767420][ T52] Bluetooth: hci1: command tx timeout [ 85.790407][ T5634] team0: Port device team_slave_1 added [ 85.798202][ T5628] team0: Port device team_slave_1 added [ 85.801346][ T5629] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.801380][ T5629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.801455][ T5629] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.837259][ T52] Bluetooth: hci3: command tx timeout [ 85.895636][ T5629] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.895654][ T5629] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.895677][ T5629] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.936631][ T52] Bluetooth: hci4: command tx timeout [ 85.953353][ T5633] team0: Port device team_slave_0 added [ 85.979342][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.979358][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.979380][ T5628] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.988844][ T5633] team0: Port device team_slave_1 added [ 85.991726][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.991770][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.991846][ T5634] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.001424][ T5634] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.001467][ T5634] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.001542][ T5634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.107906][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.107960][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.108029][ T5628] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.214215][ T5629] hsr_slave_0: entered promiscuous mode [ 86.215149][ T5629] hsr_slave_1: entered promiscuous mode [ 86.248986][ T5633] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.249003][ T5633] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.249026][ T5633] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.322582][ T5635] hsr_slave_0: entered promiscuous mode [ 86.325548][ T5635] hsr_slave_1: entered promiscuous mode [ 86.327819][ T5635] debugfs: 'hsr0' already exists in 'hsr' [ 86.328084][ T5635] Cannot create hsr debugfs directory [ 86.337231][ T5633] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.337275][ T5633] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.337372][ T5633] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.366123][ T5634] hsr_slave_0: entered promiscuous mode [ 86.369295][ T5634] hsr_slave_1: entered promiscuous mode [ 86.371447][ T5634] debugfs: 'hsr0' already exists in 'hsr' [ 86.371500][ T5634] Cannot create hsr debugfs directory [ 86.425727][ T5628] hsr_slave_0: entered promiscuous mode [ 86.426509][ T5628] hsr_slave_1: entered promiscuous mode [ 86.427105][ T5628] debugfs: 'hsr0' already exists in 'hsr' [ 86.427129][ T5628] Cannot create hsr debugfs directory [ 86.650332][ T5633] hsr_slave_0: entered promiscuous mode [ 86.651142][ T5633] hsr_slave_1: entered promiscuous mode [ 86.651889][ T5633] debugfs: 'hsr0' already exists in 'hsr' [ 86.651909][ T5633] Cannot create hsr debugfs directory [ 87.223049][ T5629] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.238200][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.239570][ T5629] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.244667][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.251500][ T5629] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.267326][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.272591][ T5629] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.292542][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.371243][ T5628] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.382636][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.391331][ T5628] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.405366][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.406142][ T5628] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.409768][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.411211][ T5628] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 87.421426][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.577054][ T5635] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 87.580739][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.588403][ T5629] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.611794][ T5635] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 87.622165][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.638215][ T5635] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 87.641965][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.642938][ T5635] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.659077][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.737395][ T5629] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.754342][ T52] Bluetooth: hci2: command tx timeout [ 87.780133][ T5634] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 87.791001][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.800994][ T1173] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.801152][ T1173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.821789][ T5634] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.831662][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.832547][ T5634] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.838792][ T4936] Bluetooth: hci0: command tx timeout [ 87.839250][ T52] Bluetooth: hci1: command tx timeout [ 87.850645][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.886844][ T5634] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.890808][ T5634] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.901669][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.901955][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.917024][ T52] Bluetooth: hci3: command tx timeout [ 87.994106][ T52] Bluetooth: hci4: command tx timeout [ 88.066421][ T5628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.086547][ T5633] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 88.090411][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.118742][ T5633] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 88.122658][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.147267][ T5633] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 88.151617][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.152339][ T5633] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 88.172628][ T5633] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.227763][ T5628] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.277675][ T1153] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.277756][ T1153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.315970][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.316154][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.340997][ T5635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.436583][ T5629] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.438500][ T5635] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.476392][ T5634] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.481333][ T1153] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.481408][ T1153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.529500][ T1153] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.529575][ T1153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.582109][ T5634] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.615401][ T5633] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.622806][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.622882][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.685715][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.685817][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.729525][ T5633] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.751183][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.751257][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.779971][ T5628] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.796617][ T5629] veth0_vlan: entered promiscuous mode [ 88.815490][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.815565][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.868438][ T5635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.869897][ T5629] veth1_vlan: entered promiscuous mode [ 88.993074][ T5628] veth0_vlan: entered promiscuous mode [ 89.031348][ T5629] veth0_macvtap: entered promiscuous mode [ 89.048350][ T5628] veth1_vlan: entered promiscuous mode [ 89.084513][ T5629] veth1_macvtap: entered promiscuous mode [ 89.100335][ T5633] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.100636][ T5635] veth0_vlan: entered promiscuous mode [ 89.141055][ T5634] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.165344][ T5635] veth1_vlan: entered promiscuous mode [ 89.169117][ T5629] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.210853][ T5629] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.239820][ T5628] veth0_macvtap: entered promiscuous mode [ 89.279691][ T5628] veth1_macvtap: entered promiscuous mode [ 89.336634][ T5633] veth0_vlan: entered promiscuous mode [ 89.383259][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.384128][ T60] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.386257][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.386369][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.386470][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.429429][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.442381][ T5635] veth0_macvtap: entered promiscuous mode [ 89.479658][ T5634] veth0_vlan: entered promiscuous mode [ 89.492476][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.492499][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.530605][ T5633] veth1_vlan: entered promiscuous mode [ 89.552790][ T5635] veth1_macvtap: entered promiscuous mode [ 89.588818][ T5634] veth1_vlan: entered promiscuous mode [ 89.600875][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.600894][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.634932][ T59] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.635129][ T59] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.635171][ T59] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.635210][ T59] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.728968][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.732499][ T5633] veth0_macvtap: entered promiscuous mode [ 89.781681][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.791974][ T5633] veth1_macvtap: entered promiscuous mode [ 89.810568][ T5629] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 89.833741][ T52] Bluetooth: hci2: command tx timeout [ 89.865919][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.865942][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.871210][ T5629] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 89.871963][ T5629] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 89.887448][ T5629] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 89.889044][ T5629] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 89.923576][ T4936] Bluetooth: hci0: command tx timeout [ 89.923717][ T52] Bluetooth: hci1: command tx timeout [ 89.949244][ T59] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.949326][ T59] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.993671][ T52] Bluetooth: hci3: command tx timeout [ 90.054453][ T5714] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 90.058822][ T5633] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.078067][ T52] Bluetooth: hci4: command tx timeout [ 90.101336][ T1173] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.101357][ T1173] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.121704][ T5634] veth0_macvtap: entered promiscuous mode [ 90.149265][ T5714] veth3: entered allmulticast mode [ 90.171093][ T5633] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.191795][ T5634] veth1_macvtap: entered promiscuous mode [ 90.263709][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.263787][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.263828][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.263865][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.263904][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.263942][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.389823][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.476796][ T5634] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.485492][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.485554][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.658831][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.658854][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.706202][ T1153] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.706352][ T1153] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.706455][ T1153] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.706555][ T1153] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.871999][ T1153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.872019][ T1153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.983164][ T1173] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.983186][ T1173] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.234975][ T1173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.234998][ T1173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.438869][ T1173] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.438894][ T1173] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.914092][ T52] Bluetooth: hci2: command tx timeout [ 91.935645][ T190] cfg80211: failed to load regulatory.db [ 91.994587][ T4936] Bluetooth: hci0: command tx timeout [ 91.994644][ T52] Bluetooth: hci1: command tx timeout [ 92.016951][ T44] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 92.073921][ T52] Bluetooth: hci3: command tx timeout [ 92.154107][ T52] Bluetooth: hci4: command tx timeout [ 92.193785][ T44] usb 1-1: not running at top speed; connect to a high speed hub [ 92.193865][ T44] usb 1-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=b1.4d [ 92.199151][ T44] usb 1-1: config 11 has an invalid interface number: 95 but max is 0 [ 92.199173][ T44] usb 1-1: config 11 has an invalid descriptor of length 0, skipping remainder of the config [ 92.199187][ T44] usb 1-1: config 11 has no interface number 0 [ 92.199217][ T44] usb 1-1: config 11 interface 95 altsetting 64 has an endpoint descriptor with address 0xC6, changing to 0x86 [ 92.199236][ T44] usb 1-1: config 11 interface 95 altsetting 64 endpoint 0x86 has invalid maxpacket 65535, setting to 64 [ 92.199256][ T44] usb 1-1: config 11 interface 95 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 92.199275][ T44] usb 1-1: config 11 interface 95 has no altsetting 0 [ 92.201085][ T44] usb 1-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 92.201104][ T44] usb 1-1: Manufacturer: syz [ 92.245520][ T992] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 92.379490][ T5737] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 92.438149][ T992] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 92.441859][ T992] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 92.441893][ T992] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 92.441915][ T992] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 92.441979][ T992] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.529680][ T992] usb 4-1: config 0 descriptor?? [ 92.616852][ T992] hub 4-1:0.0: USB hub found [ 92.769294][ T5745] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.7'. [ 92.769454][ T5745] openvswitch: netlink: Message has 512 unknown bytes. [ 92.848092][ T5692] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 92.928690][ T5692] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 93.269498][ T992] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 93.411056][ T992] usb 4-1: USB disconnect, device number 2 [ 94.607654][ T5737] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6'. [ 95.193738][ T0] NOHZ tick-stop error: local softirq work is pending, handler #242!!! [ 95.333420][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 95.366771][ T44] usb 1-1: USB disconnect, device number 2 [ 95.403638][ T2250] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 95.462435][ T5762] netlink: 4152 bytes leftover after parsing attributes in process `syz.3.11'. [ 95.476191][ T5762] netlink: 14544 bytes leftover after parsing attributes in process `syz.3.11'. [ 95.553549][ T2250] usb 2-1: Using ep0 maxpacket: 8 [ 95.554483][ T2250] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 95.556226][ T2250] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 95.556279][ T2250] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 95.556304][ T2250] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 95.556329][ T2250] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 95.556361][ T2250] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 95.556402][ T2250] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.865184][ T2250] usb 2-1: GET_CAPABILITIES returned 0 [ 95.865235][ T2250] usbtmc 2-1:16.0: can't read capabilities [ 96.065176][ T5753] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 96.456953][ T59] IPVS: starting estimator thread 0... [ 96.483401][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 96.543573][ T5773] IPVS: using max 30 ests per chain, 72000 per kthread [ 97.432259][ T5778] netlink: 'syz.0.13': attribute type 10 has an invalid length. [ 97.534843][ T5781] netlink: 'syz.0.13': attribute type 10 has an invalid length. [ 97.633971][ T5780] ksmbd: Unknown IPC event: 3, ignore. [ 97.778638][ T5778] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.826533][ T5778] team0: Port device netdevsim1 added [ 97.952092][ T5781] team0: Port device netdevsim1 removed [ 98.094660][ T5781] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 98.126177][ T5781] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 98.143558][ T5709] usb 2-1: USB disconnect, device number 2 [ 98.841471][ T5786] netlink: 'syz.2.15': attribute type 11 has an invalid length. [ 98.855700][ T5783] fuse: Unknown parameter '0x0000000000000009 ' [ 99.193414][ T0] NOHZ tick-stop error: local softirq work is pending, handler #206!!! [ 99.473585][ T5709] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 99.593785][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 99.643461][ T5709] usb 4-1: Using ep0 maxpacket: 8 [ 99.649100][ T5709] usb 4-1: New USB device found, idVendor=0c45, idProduct=614a, bcdDevice=c4.6d [ 99.706267][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.706298][ T5709] usb 4-1: Product: syz [ 99.706314][ T5709] usb 4-1: Manufacturer: syz [ 99.706331][ T5709] usb 4-1: SerialNumber: syz [ 99.755761][ T5709] usb 4-1: config 0 descriptor?? [ 99.817503][ T5709] gspca_main: sonixj-2.14.0 probing 0c45:614a [ 99.873416][ T0] NOHZ tick-stop error: local softirq work is pending, handler #204!!! [ 100.056580][ T59] IPVS: starting estimator thread 0... [ 100.159570][ T5801] IPVS: using max 27 ests per chain, 64800 per kthread [ 101.455531][ T5709] gspca_sonixj: reg_w1 err -110 [ 101.455625][ T5709] sonixj 4-1:0.0: probe with driver sonixj failed with error -110 [ 101.477126][ T0] NOHZ tick-stop error: local softirq work is pending, handler #04!!! [ 102.431863][ T5827] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.21'. [ 102.431893][ T5827] openvswitch: netlink: Message has 512 unknown bytes. [ 103.142278][ T5709] usb 4-1: USB disconnect, device number 3 [ 103.513390][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 103.793738][ T5829] fuse: Bad value for 'fd' [ 103.898305][ T5833] openvswitch: netlink: nsh attr 109 is out of range max 3 [ 104.284255][ T2250] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 104.502151][ T2250] usb 4-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 105.000671][ T2250] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 105.000710][ T2250] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 105.000738][ T2250] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 105.213387][ T0] NOHZ tick-stop error: local softirq work is pending, handler #04!!! [ 105.594225][ T2250] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.594258][ T2250] usb 4-1: Product: syz [ 105.594274][ T2250] usb 4-1: Manufacturer: syz [ 105.594289][ T2250] usb 4-1: SerialNumber: syz [ 105.666487][ T2250] usb 4-1: config 0 descriptor?? [ 105.719555][ T5838] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 105.923800][ T2250] rc_core: IR keymap rc-streamzap not found [ 105.923821][ T2250] Registered IR keymap rc-empty [ 105.967938][ T2250] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 106.001118][ T2250] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input7 [ 106.600912][ T5710] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 106.763635][ T5710] usb 3-1: Using ep0 maxpacket: 32 [ 106.768771][ T5710] usb 3-1: unable to get BOS descriptor or descriptor too short [ 106.768912][ T5710] usb 3-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 106.771137][ T5710] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 106.771221][ T5710] usb 3-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 106.829651][ T5710] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.829681][ T5710] usb 3-1: Product: syz [ 106.829696][ T5710] usb 3-1: Manufacturer: syz [ 106.829712][ T5710] usb 3-1: SerialNumber: syz [ 107.459216][ T5858] usb usb7: usbfs: interface 0 claimed by hub while 'syz.2.25' resets device [ 108.500373][ T5869] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 108.518855][ T5869] bond1 (unregistering): Released all slaves [ 108.604196][ T5871] overlayfs: missing 'lowerdir' [ 108.900765][ T5871] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 108.961264][ T5871] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.968395][ T5871] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.335749][ T5710] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 109.447743][ T5710] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 110.338794][ T5710] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 110.383768][ T5710] usb 3-1: USB disconnect, device number 2 [ 110.651990][ T5621] udevd[5621]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 110.876220][ T5710] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 111.023934][ T5710] usb 3-1: Using ep0 maxpacket: 8 [ 111.027613][ T5710] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 111.050462][ T5710] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.050594][ T5710] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 111.050626][ T5710] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 111.050656][ T5710] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 111.050765][ T5710] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 111.174801][ T5710] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 111.174911][ T5710] usb 3-1: Product: syz [ 111.174928][ T5710] usb 3-1: Manufacturer: syz [ 111.174945][ T5710] usb 3-1: SerialNumber: syz [ 111.217015][ T5710] usb 3-1: config 0 descriptor?? [ 111.309455][ T5879] netlink: 'syz.4.30': attribute type 10 has an invalid length. [ 111.452921][ T5881] netlink: 'syz.4.30': attribute type 10 has an invalid length. [ 111.565592][ T5880] ksmbd: Unknown IPC event: 3, ignore. [ 111.694630][ T5879] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.761645][ T5746] usb 4-1: USB disconnect, device number 4 [ 111.778563][ T5879] team0: Port device netdevsim1 added [ 111.797445][ T5710] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 111.797780][ T5710] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -5 [ 112.037583][ T5881] team0: Port device netdevsim1 removed [ 112.156743][ T5881] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 112.350572][ T5889] netlink: 68 bytes leftover after parsing attributes in process `syz.2.29'. [ 112.352670][ T5881] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 112.944401][ T5709] usb 3-1: USB disconnect, device number 3 [ 114.655428][ T5746] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 114.818159][ T5746] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 114.836867][ T5746] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 114.836906][ T5746] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 114.836937][ T5746] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 97, changing to 10 [ 114.836969][ T5746] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 24929, setting to 1024 [ 114.903930][ T5746] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.903979][ T5746] usb 3-1: Product: syz [ 114.903990][ T5746] usb 3-1: Manufacturer: syz [ 114.904016][ T5746] usb 3-1: SerialNumber: syz [ 114.950043][ T5746] usb 3-1: config 0 descriptor?? [ 115.244476][ T5746] adutux 3-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 116.497675][ T5918] program syz.0.37 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 117.359915][ T992] usb 3-1: USB disconnect, device number 4 [ 119.013378][ T0] NOHZ tick-stop error: local softirq work is pending, handler #84!!! [ 119.037205][ T5928] Zero length message leads to an empty skb [ 119.636058][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.639865][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.642280][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.691869][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.712628][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.757178][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.779723][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.800573][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.823825][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 119.835044][ T5928] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 120.346587][ T5941] loop8: detected capacity change from 0 to 7 [ 120.353521][ T5709] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 120.457956][ T5941] Dev loop8: unable to read RDB block 7 [ 120.458021][ T5941] loop8: unable to read partition table [ 120.458284][ T5941] loop8: partition table beyond EOD, truncated [ 120.458362][ T5941] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 120.514521][ T5709] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 120.516322][ T5709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 120.516354][ T5709] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 120.516383][ T5709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 120.516409][ T5709] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 120.516486][ T5709] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.536667][ T5709] usb 2-1: config 0 descriptor?? [ 120.960794][ T5942] fuse: Unknown parameter 'rB' [ 121.068462][ T5937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.082559][ T5937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.181090][ T5937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.206469][ T5937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.212881][ T5947] tipc: Started in network mode [ 121.212914][ T5947] tipc: Node identity 4, cluster identity 4711 [ 121.212928][ T5947] tipc: Node number set to 4 [ 121.292455][ T5709] hdpvr 2-1:0.0: unexpected answer of status request, len -32 [ 121.292492][ T5709] hdpvr 2-1:0.0: device init failed [ 121.292580][ T5709] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12 [ 121.633810][ T2250] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 121.783467][ T2250] usb 4-1: Using ep0 maxpacket: 32 [ 121.784467][ T2250] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 121.787669][ T2250] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 121.787694][ T2250] usb 4-1: config 0 has no interface number 0 [ 121.787751][ T2250] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 121.787779][ T2250] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 121.809524][ T2250] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.809552][ T2250] usb 4-1: Product: syz [ 121.809568][ T2250] usb 4-1: Manufacturer: syz [ 121.809624][ T2250] usb 4-1: SerialNumber: syz [ 121.882437][ T2250] usb 4-1: config 0 descriptor?? [ 122.131344][ T2250] radio-si470x 4-1:0.35: this is not a si470x device. [ 122.206346][ T5960] faux_driver vgem: [drm] Unknown color mode 1024; guessing buffer size. [ 122.343765][ T2250] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 122.365964][ T2250] usb 4-1: USB disconnect, device number 5 [ 122.394356][ T5709] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 122.546088][ T5709] usb 3-1: Using ep0 maxpacket: 8 [ 122.588919][ T5709] usb 3-1: unable to get BOS descriptor or descriptor too short [ 122.588976][ T5709] usb 3-1: New USB device found, idVendor=2b73, idProduct=0013, bcdDevice= 1.40 [ 122.645939][ T5709] usb 3-1: config 1 has an invalid descriptor of length 145, skipping remainder of the config [ 122.645970][ T5709] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 122.689491][ T5709] usb 3-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 122.689521][ T5709] usb 3-1: Manufacturer: syz [ 123.379451][ T5709] usb 3-1: 0:1 : does not exist [ 123.422051][ T2250] usb 2-1: USB disconnect, device number 3 [ 123.920690][ T5977] openvswitch: netlink: nsh attr 109 is out of range max 3 [ 124.020016][ T5709] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 124.051812][ T5709] usb 3-1: USB disconnect, device number 5 [ 124.213115][ T5627] udevd[5627]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 126.224509][ T5997] program syz.1.50 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 126.883453][ T2250] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 126.940147][ T992] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 127.035002][ T2250] usb 3-1: Using ep0 maxpacket: 8 [ 127.035971][ T2250] usb 3-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 127.037699][ T2250] usb 3-1: config 0 has an invalid interface number: 143 but max is 0 [ 127.037726][ T2250] usb 3-1: config 0 has no interface number 0 [ 127.037771][ T2250] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.089852][ T2250] usb 3-1: config 0 descriptor?? [ 127.124977][ T992] usb 1-1: Using ep0 maxpacket: 32 [ 127.214084][ T2250] viperboard 3-1:0.143: version 0.00 found at bus 003 address 006 [ 127.237254][ T992] usb 1-1: unable to get BOS descriptor or descriptor too short [ 127.237322][ T992] usb 1-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 127.285328][ T992] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 127.285451][ T992] usb 1-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 127.338037][ T2250] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 127.338072][ T2250] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 127.343465][ T992] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.359134][ T992] usb 1-1: Product: syz [ 127.359195][ T992] usb 1-1: Manufacturer: syz [ 127.359238][ T992] usb 1-1: SerialNumber: syz [ 127.896113][ T6008] usb usb7: usbfs: interface 0 claimed by hub while 'syz.0.52' resets device [ 128.932751][ T6014] random: crng reseeded on system resumption [ 129.797193][ T992] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 129.885937][ T992] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 130.511300][ T992] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 130.552825][ T992] usb 1-1: USB disconnect, device number 3 [ 130.735550][ T5621] udevd[5621]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 131.063655][ T992] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 131.185477][ T6030] syz_tun: entered allmulticast mode [ 131.226796][ T992] usb 1-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 131.230327][ T992] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 131.230367][ T992] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 131.230402][ T992] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 131.230435][ T992] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 131.230501][ T992] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.323146][ T992] usb 1-1: config 0 descriptor?? [ 131.734296][ T5709] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 131.888216][ T5709] usb 5-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 131.889498][ T5709] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 131.889555][ T5709] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.935556][ T5709] usb 5-1: config 0 descriptor?? [ 131.983742][ T6043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.984252][ T6043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.034930][ T6022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.042692][ T6022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.081718][ T992] hdpvr 1-1:0.0: unexpected answer of status request, len -32 [ 132.081783][ T992] hdpvr 1-1:0.0: device init failed [ 132.081987][ T992] hdpvr 1-1:0.0: probe with driver hdpvr failed with error -12 [ 132.150841][ T992] usb 3-1: USB disconnect, device number 6 [ 132.535152][ T5709] input: HID 0458:5005 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5005.0002/input/input10 [ 132.795270][ T6027] syz_tun: left allmulticast mode [ 132.810903][ T5709] input: HID 0458:5005 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5005.0002/input/input11 [ 132.881027][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.881127][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.142945][ T5709] kye 0003:0458:5005.0002: input,hiddev0,hidraw0: USB HID v7f.fd Device [HID 0458:5005] on usb-dummy_hcd.4-1/input0 [ 133.211701][ T6034] input: syz0 as /devices/virtual/input/input12 [ 134.081618][ T5709] usb 1-1: USB disconnect, device number 4 [ 134.959873][ T5746] usb 5-1: USB disconnect, device number 2 [ 135.664962][ T1153] IPVS: starting estimator thread 0... [ 135.702960][ T6072] program syz.3.65 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 135.749778][ T44] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 135.793620][ T6076] IPVS: using max 29 ests per chain, 69600 per kthread [ 135.946441][ T44] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 135.963995][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 135.964021][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 135.964049][ T44] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.027711][ T44] usb 2-1: config 0 descriptor?? [ 136.782003][ T44] usbhid 2-1:0.0: can't add hid device: -71 [ 136.782293][ T44] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 136.834239][ T44] usb 2-1: USB disconnect, device number 4 [ 137.101162][ T6081] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.827679][ T6083] CUSE: unknown device info "n|zQC*" [ 138.827700][ T6083] CUSE: unknown device info ">2a" V|#ySioL89IܥѮÇ[<^Q>nHw'0KV,${\d+" [ 138.827715][ T6083] CUSE: unknown device info "" [ 138.827726][ T6083] CUSE: unknown device info "LPt|%IOKu GǪ|QU˜DvF,*p(o9{u[赨gIPYV" [ 138.827739][ T6083] CUSE: DEVNAME unspecified [ 139.736101][ T1153] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.204165][ T1153] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.520051][ T1153] bond0: (slave netdevsim1): Releasing backup interface [ 140.554968][ T1153] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.838928][ T1153] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.978763][ T6101] tipc: Enabling of bearer rejected, failed to enable media [ 141.526519][ T6101] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 141.544215][ T6101] tipc: Enabled bearer , priority 10 [ 141.961387][ T1153] bridge_slave_1: left allmulticast mode [ 141.962667][ T1153] bridge_slave_1: left promiscuous mode [ 142.001456][ T1153] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.129934][ T1153] bridge_slave_0: left allmulticast mode [ 142.130000][ T1153] bridge_slave_0: left promiscuous mode [ 142.131035][ T1153] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.617493][ T4936] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 142.624614][ T4936] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 142.643818][ T4936] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 142.656000][ T4936] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 142.661738][ T4936] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 143.435486][ T5709] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 143.602263][ T5709] usb 2-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 143.647122][ T5709] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 143.647152][ T5709] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 143.647205][ T5709] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.768823][ T5709] usb 2-1: 0:1 : does not exist [ 144.455839][ T1153] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 144.499090][ T1153] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 144.529622][ T1153] bond0 (unregistering): Released all slaves [ 144.716266][ T4936] Bluetooth: hci0: command tx timeout [ 144.902103][ T5282] 8021q: adding VLAN 0 to HW filter on device eth1 [ 146.595326][ T1153] hsr_slave_0: left promiscuous mode [ 146.597461][ T1153] hsr_slave_1: left promiscuous mode [ 146.599897][ T1153] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 146.599933][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 146.604212][ T5706] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 146.653758][ T1153] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 146.653784][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 146.701166][ T2250] usb 2-1: USB disconnect, device number 5 [ 146.793514][ T4936] Bluetooth: hci0: command tx timeout [ 146.848265][ T5706] usb 5-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 146.851799][ T5706] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 146.882118][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.882220][ T5706] usb 5-1: Product: syz [ 146.882271][ T5706] usb 5-1: Manufacturer: syz [ 146.882282][ T5706] usb 5-1: SerialNumber: syz [ 147.011231][ T5706] usb 5-1: config 0 descriptor?? [ 147.055545][ T5706] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 147.129884][ T1153] veth1_macvtap: left promiscuous mode [ 147.146185][ T1153] veth0_macvtap: left promiscuous mode [ 147.146446][ T1153] veth1_vlan: left promiscuous mode [ 147.147430][ T1153] veth0_vlan: left promiscuous mode [ 147.255971][ T6152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.276454][ T6152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.460972][ T6166] netlink: 'syz.2.79': attribute type 10 has an invalid length. [ 147.569161][ T5706] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 147.569285][ T5706] gspca_pac7302 5-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 147.649881][ T6171] netlink: 'syz.2.79': attribute type 10 has an invalid length. [ 147.779415][ T6174] ksmbd: Unknown IPC event: 3, ignore. [ 148.874206][ T4936] Bluetooth: hci0: command tx timeout [ 149.091932][ T1153] team0 (unregistering): Port device team_slave_1 removed [ 149.238542][ T1153] team0 (unregistering): Port device team_slave_0 removed [ 149.449324][ T5746] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 149.617806][ T5746] usb 4-1: Using ep0 maxpacket: 16 [ 149.619384][ T5746] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 149.624400][ T5746] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 149.624478][ T5746] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 149.624537][ T5746] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 149.624646][ T5746] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.711918][ T5746] usb 4-1: config 0 descriptor?? [ 150.113212][ T6166] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 150.127654][ T6166] team0: Port device netdevsim1 added [ 150.266005][ T6171] team0: Port device netdevsim1 removed [ 150.310265][ T6171] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 150.340722][ T6171] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 150.356667][ T5282] 8021q: adding VLAN 0 to HW filter on device eth2 [ 150.535069][ T30] audit: type=1326 audit(1790204831.493:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6185 comm="syz.3.82" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf708f0ec code=0x0 [ 150.953619][ T4936] Bluetooth: hci0: command tx timeout [ 150.973756][ T2250] usb 5-1: USB disconnect, device number 3 [ 152.474996][ T6217] netlink: 16 bytes leftover after parsing attributes in process `syz.2.87'. [ 152.988495][ T5746] usbhid 4-1:0.0: can't add hid device: -71 [ 152.988762][ T5746] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 153.060883][ T5746] usb 4-1: USB disconnect, device number 6 [ 153.925932][ T6140] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.926079][ T6140] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.926298][ T6140] bridge_slave_0: entered allmulticast mode [ 153.940538][ T5746] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 153.944611][ T6140] bridge_slave_0: entered promiscuous mode [ 154.012978][ T6140] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.013113][ T6140] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.035933][ T6140] bridge_slave_1: entered allmulticast mode [ 154.062077][ T6140] bridge_slave_1: entered promiscuous mode [ 154.114411][ T5746] usb 4-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice= 0.40 [ 154.121251][ T5746] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 154.121285][ T5746] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 154.171048][ T5746] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.171101][ T5746] usb 4-1: Product: syz [ 154.171129][ T5746] usb 4-1: Manufacturer: syz [ 154.171142][ T5746] usb 4-1: SerialNumber: syz [ 154.576945][ T6140] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 154.595507][ T5746] usb 4-1: 0:1 : does not exist [ 154.622126][ T6140] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 154.785979][ T5282] 8021q: adding VLAN 0 to HW filter on device eth4 [ 154.909456][ T6140] team0: Port device team_slave_0 added [ 154.941905][ T6140] team0: Port device team_slave_1 added [ 155.051534][ T6140] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 155.051554][ T6140] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 155.051582][ T6140] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 155.100682][ T6140] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 155.100700][ T6140] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 155.100728][ T6140] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 155.469277][ T6140] hsr_slave_0: entered promiscuous mode [ 155.482603][ T6140] hsr_slave_1: entered promiscuous mode [ 155.703282][ T5746] usb 4-1: USB disconnect, device number 7 [ 156.538751][ T5627] udevd[5627]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 156.603528][ T6250] program syz.2.91 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 157.848043][ T992] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 158.095334][ T992] usb 5-1: Using ep0 maxpacket: 8 [ 158.098898][ T992] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 158.125249][ T6140] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 158.217210][ T6140] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 158.236491][ T992] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 158.236581][ T992] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.254017][ T6140] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 158.320016][ T992] usb 5-1: config 0 descriptor?? [ 158.354051][ T6140] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 158.391680][ T6140] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 158.484779][ T6140] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 158.508010][ T6140] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 158.624387][ T6140] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 158.645555][ T992] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 159.002879][ T6264] netlink: 12 bytes leftover after parsing attributes in process `syz.4.93'. [ 159.653676][ T5282] 8021q: adding VLAN 0 to HW filter on device eth3 [ 160.469170][ T6284] netlink: 'syz.1.94': attribute type 10 has an invalid length. [ 160.592931][ T6286] netlink: 'syz.1.94': attribute type 10 has an invalid length. [ 160.761252][ T6282] ksmbd: Unknown IPC event: 3, ignore. [ 160.937982][ T6284] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 160.962532][ T6284] team0: Port device netdevsim1 added [ 161.160915][ T6286] team0: Port device netdevsim1 removed [ 161.192249][ T6286] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 161.245407][ T6286] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 161.640209][ T5710] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 161.731310][ T6140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 161.815685][ T5710] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 161.817496][ T5710] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 161.817556][ T5710] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 161.817583][ T5710] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 161.817614][ T5710] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 161.820081][ T5710] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 161.820106][ T5710] usb 3-1: SerialNumber: syz [ 162.014014][ T2250] usb 5-1: USB disconnect, device number 4 [ 162.016017][ T6140] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.162055][ T1173] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.162171][ T1173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.205129][ T5710] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 162.205217][ T5710] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 162.239169][ T5710] usb 3-1: USB disconnect, device number 7 [ 162.289689][ T5627] udevd[5627]: setting mode of /dev/bus/usb/003/007 to 020664 failed: No such file or directory [ 162.290015][ T5627] udevd[5627]: setting owner of /dev/bus/usb/003/007 to uid=0, gid=0 failed: No such file or directory [ 162.390553][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.390759][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.017002][ T6140] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.456828][ T190] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 163.538758][ T6140] veth0_vlan: entered promiscuous mode [ 163.604081][ T2250] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 163.624670][ T190] usb 3-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 163.625837][ T190] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 163.625901][ T190] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.716192][ T6140] veth1_vlan: entered promiscuous mode [ 163.755835][ T2250] usb 4-1: Using ep0 maxpacket: 32 [ 163.758653][ T2250] usb 4-1: unable to get BOS descriptor or descriptor too short [ 163.758706][ T2250] usb 4-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0 [ 163.762086][ T2250] usb 4-1: config 3 has an invalid interface number: 223 but max is 1 [ 163.762112][ T2250] usb 4-1: config 3 has an invalid interface number: 25 but max is 1 [ 163.762133][ T2250] usb 4-1: config 3 has an invalid interface number: 223 but max is 1 [ 163.762183][ T2250] usb 4-1: config 3 has no interface number 0 [ 163.762200][ T2250] usb 4-1: config 3 has no interface number 1 [ 163.762253][ T2250] usb 4-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 163.762276][ T2250] usb 4-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 163.762330][ T2250] usb 4-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30 [ 163.762408][ T2250] usb 4-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64 [ 163.762438][ T2250] usb 4-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 163.762495][ T2250] usb 4-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82 [ 163.762531][ T2250] usb 4-1: config 3 interface 223 has no altsetting 1 [ 163.762551][ T2250] usb 4-1: config 3 interface 25 has no altsetting 0 [ 163.925967][ T2250] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.926025][ T2250] usb 4-1: Product: syz [ 163.926041][ T2250] usb 4-1: Manufacturer: syz [ 163.926055][ T2250] usb 4-1: SerialNumber: syz [ 164.075534][ T190] dvb_ttusb_budget: ttusb_init_controller: error [ 164.075672][ T190] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 164.407730][ T6140] veth0_macvtap: entered promiscuous mode [ 164.482598][ T6140] veth1_macvtap: entered promiscuous mode [ 164.579749][ T6302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 164.580247][ T6302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.837690][ T190] DVB: Unable to find symbol stv0299_attach() [ 164.860121][ T6140] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 164.910448][ T6140] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 165.114809][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.114911][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.114952][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.114992][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.181697][ T190] DVB: Unable to find symbol tda8083_attach() [ 165.181714][ T190] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 165.325892][ T2250] usbtv 4-1:3.223: Fushicai USBTV007 Audio-Video Grabber [ 165.449931][ T2250] usb 4-1: USB disconnect, device number 8 [ 165.896798][ T5632] udevd[5632]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 165.927664][ T5746] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 166.043427][ T190] usb 3-1: USB disconnect, device number 8 [ 166.085163][ T5746] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 166.110039][ T5746] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.110100][ T5746] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.110162][ T5746] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 166.110266][ T5746] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.264688][ T1173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 166.264729][ T1173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 166.323212][ T5746] usb 2-1: config 0 descriptor?? [ 166.613707][ T1265] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 166.613731][ T1265] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 166.707522][ T2250] [ 166.709917][ T2250] ========================= [ 166.714436][ T2250] WARNING: held lock freed! [ 166.718993][ T2250] syzkaller #0 Not tainted [ 166.723427][ T2250] ------------------------- [ 166.727946][ T2250] kworker/0:3/2250 is freeing memory ffff8880680ce000-ffff8880680ce7ff, with a lock still held there! [ 166.738904][ T2250] ffff8880680ce1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 166.749070][ T2250] locks held by kworker/0:3/2250: 5, last CPU#0: [ 166.755417][ T2250] #0: ffff888020aa1d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 166.766788][ T2250] #1: ffffc9000745fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 166.778678][ T2250] #2: ffff888029c301d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 166.787621][ T2250] #3: ffff888029d2a1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 [ 166.796813][ T2250] #4: ffff8880680ce1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 166.807396][ T2250] [ 166.807396][ T2250] stack backtrace: [ 166.813357][ T2250] CPU: 0 UID: 0 PID: 2250 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 166.822757][ T2250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 166.832936][ T2250] Workqueue: usb_hub_wq hub_event [ 166.838034][ T2250] Call Trace: [ 166.841346][ T2250] [ 166.844339][ T2250] dump_stack_lvl+0xe8/0x150 [ 166.848981][ T2250] debug_check_no_locks_freed+0x149/0x170 [ 166.854742][ T2250] kfree+0x12b/0x650 [ 166.858696][ T2250] ? device_release+0xc4/0x1f0 [ 166.863515][ T2250] ? __pfx_usb_release_interface+0x10/0x10 [ 166.869359][ T2250] device_release+0xc4/0x1f0 [ 166.873987][ T2250] kobject_put+0x222/0x550 [ 166.878448][ T2250] v4l2_device_disconnect+0x79/0xd0 [ 166.883698][ T2250] usbtv_video_free+0x25/0x30 [ 166.888537][ T2250] usbtv_disconnect+0x5c/0xa0 [ 166.893256][ T2250] usb_unbind_interface+0x295/0x9f0 [ 166.898493][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 166.904255][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 166.910011][ T2250] ? __pfx_usb_unbind_interface+0x10/0x10 [ 166.915767][ T2250] device_release_driver_internal+0x4f5/0x880 [ 166.921880][ T2250] bus_remove_device+0x444/0x560 [ 166.926867][ T2250] ? __pfx_bus_remove_device+0x10/0x10 [ 166.932370][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 166.938133][ T2250] device_del+0x524/0x8f0 [ 166.942512][ T2250] ? __pfx_device_del+0x10/0x10 [ 166.947400][ T2250] ? __pfx___mutex_lock+0x10/0x10 [ 166.952480][ T2250] usb_disable_device+0x3d4/0x8d0 [ 166.957604][ T2250] usb_disconnect+0x346/0x9a0 [ 166.962335][ T2250] hub_event+0x1bbb/0x4d30 [ 166.967058][ T2250] ? register_lock_class+0x31/0x2e0 [ 166.972417][ T2250] ? __pfx_hub_event+0x10/0x10 [ 166.977254][ T2250] ? rcu_is_watching+0x16/0xb0 [ 166.982055][ T2250] ? process_scheduled_works+0x97a/0x1630 [ 166.987817][ T2250] process_scheduled_works+0xc3d/0x1630 [ 166.993422][ T2250] ? __pfx_process_scheduled_works+0x10/0x10 [ 166.999448][ T2250] ? assign_work+0x3cf/0x5d0 [ 167.004079][ T2250] worker_thread+0xa47/0xfb0 [ 167.008720][ T2250] ? __kthread_parkme+0x71/0x1f0 [ 167.013712][ T2250] kthread+0x38b/0x480 [ 167.017819][ T2250] ? __pfx_worker_thread+0x10/0x10 [ 167.022967][ T2250] ? __pfx_kthread+0x10/0x10 [ 167.027601][ T2250] ret_from_fork+0x514/0xb70 [ 167.032235][ T2250] ? __pfx_ret_from_fork+0x10/0x10 [ 167.037376][ T2250] ? __switch_to+0xc89/0x1420 [ 167.042118][ T2250] ? __pfx_kthread+0x10/0x10 [ 167.046781][ T2250] ret_from_fork_asm+0x1a/0x30 [ 167.051619][ T2250] SYZFAIL: failed to send rpc fd=3 want=56 sent=0 n=-1 (errno 32: Broken pipe) [ 167.514009][ T2250] ================================================================== [ 167.514030][ T2250] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0 [ 167.514072][ T2250] Read of size 8 at addr ffff8880680ce008 by task kworker/0:3/2250 [ 167.514092][ T2250] [ 167.514104][ T2250] CPU: 0 UID: 0 PID: 2250 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 167.514129][ T2250] Hardware ** replaying previous printk message ** [ 167.514129][ T2250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 167.514148][ T2250] Workqueue: usb_hub_wq hub_event [ 167.514179][ T2250] Call Trace: [ 167.514187][ T2250] [ 167.514197][ T2250] dump_stack_lvl+0xe8/0x150 [ 167.514231][ T2250] print_address_description+0x55/0x1e0 [ 167.514263][ T2250] ? usb_unbind_interface+0x2c2/0x9f0 [ 167.514291][ T2250] print_report+0x58/0x70 [ 167.514319][ T2250] kasan_report+0x117/0x150 [ 167.514349][ T2250] ? usb_unbind_interface+0x2c2/0x9f0 [ 167.514382][ T2250] usb_unbind_interface+0x2c2/0x9f0 [ 167.514412][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 167.514444][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 167.514471][ T2250] ? __pfx_usb_unbind_interface+0x10/0x10 [ 167.514501][ T2250] device_release_driver_internal+0x4f5/0x880 [ 167.514533][ T2250] bus_remove_device+0x444/0x560 [ 167.514572][ T2250] ? __pfx_bus_remove_device+0x10/0x10 [ 167.514609][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 167.514637][ T2250] device_del+0x524/0x8f0 [ 167.514666][ T2250] ? __pfx_device_del+0x10/0x10 [ 167.514689][ T2250] ? __pfx___mutex_lock+0x10/0x10 [ 167.514723][ T2250] usb_disable_device+0x3d4/0x8d0 [ 167.514755][ T2250] usb_disconnect+0x346/0x9a0 [ 167.514782][ T2250] hub_event+0x1bbb/0x4d30 [ 167.514815][ T2250] ? register_lock_class+0x31/0x2e0 [ 167.514855][ T2250] ? __pfx_hub_event+0x10/0x10 [ 167.514885][ T2250] ? rcu_is_watching+0x16/0xb0 [ 167.514913][ T2250] ? process_scheduled_works+0x97a/0x1630 [ 167.514944][ T2250] process_scheduled_works+0xc3d/0x1630 [ 167.514997][ T2250] ? __pfx_process_scheduled_works+0x10/0x10 [ 167.515030][ T2250] ? assign_work+0x3cf/0x5d0 [ 167.515061][ T2250] worker_thread+0xa47/0xfb0 [ 167.515099][ T2250] ? __kthread_parkme+0x71/0x1f0 [ 167.515136][ T2250] kthread+0x38b/0x480 [ 167.515158][ T2250] ? __pfx_worker_thread+0x10/0x10 [ 167.515189][ T2250] ? __pfx_kthread+0x10/0x10 [ 167.515211][ T2250] ret_from_fork+0x514/0xb70 [ 167.515234][ T2250] ? __pfx_ret_from_fork+0x10/0x10 [ 167.515255][ T2250] ? __switch_to+0xc89/0x1420 [ 167.515287][ T2250] ? __pfx_kthread+0x10/0x10 [ 167.515309][ T2250] ret_from_fork_asm+0x1a/0x30 [ 167.515351][ T2250] [ 167.515360][ T2250] [ 167.515365][ T2250] Allocated by task 2250: [ 167.515376][ T2250] kasan_save_track+0x3e/0x80 [ 167.515398][ T2250] __kasan_kmalloc+0x93/0xb0 [ 167.515421][ T2250] __kmalloc_cache_noprof+0x321/0x600 [ 167.515441][ T2250] usb_set_configuration+0x3cc/0x2180 [ 167.515467][ T2250] usb_generic_driver_probe+0x8d/0x150 [ 167.515493][ T2250] usb_probe_device+0x1c3/0x3b0 [ 167.515520][ T2250] really_probe+0x254/0xae0 [ 167.515545][ T2250] __driver_probe_device+0x1e8/0x360 [ 167.515569][ T2250] driver_probe_device+0x4f/0x240 [ 167.515593][ T2250] __device_attach_driver+0x270/0x410 [ 167.515619][ T2250] bus_for_each_drv+0x258/0x2f0 [ 167.515650][ T2250] __device_attach+0x2c4/0x450 [ 167.515672][ T2250] device_initial_probe+0xa1/0xd0 [ 167.515696][ T2250] bus_probe_device+0x12a/0x220 [ 167.515727][ T2250] device_add+0x7d7/0xb80 [ 167.515746][ T2250] usb_new_device+0x9aa/0x1690 [ 167.515766][ T2250] hub_event+0x28e8/0x4d30 [ 167.515790][ T2250] process_scheduled_works+0xc3d/0x1630 [ 167.515818][ T2250] worker_thread+0xa47/0xfb0 [ 167.515844][ T2250] kthread+0x38b/0x480 [ 167.515862][ T2250] ret_from_fork+0x514/0xb70 [ 167.515879][ T2250] ret_from_fork_asm+0x1a/0x30 [ 167.515911][ T2250] [ 167.515916][ T2250] Freed by task 2250: [ 167.515924][ T2250] kasan_save_track+0x3e/0x80 [ 167.515961][ T2250] kasan_save_free_info+0x40/0x50 [ 167.515999][ T2250] __kasan_slab_free+0x5c/0x80 [ 167.516022][ T2250] kfree+0x1c5/0x650 [ 167.516051][ T2250] device_release+0xc4/0x1f0 [ 167.516078][ T2250] kobject_put+0x222/0x550 [ 167.516108][ T2250] v4l2_device_disconnect+0x79/0xd0 [ 167.516138][ T2250] usbtv_video_free+0x25/0x30 [ 167.516167][ T2250] usbtv_disconnect+0x5c/0xa0 [ 167.516193][ T2250] usb_unbind_interface+0x295/0x9f0 [ 167.516220][ T2250] device_release_driver_internal+0x4f5/0x880 [ 167.516246][ T2250] bus_remove_device+0x444/0x560 [ 167.516277][ T2250] device_del+0x524/0x8f0 [ 167.516298][ T2250] usb_disable_device+0x3d4/0x8d0 [ 167.516322][ T2250] usb_disconnect+0x346/0x9a0 [ 167.516341][ T2250] hub_event+0x1bbb/0x4d30 [ 167.516365][ T2250] process_scheduled_works+0xc3d/0x1630 [ 167.516392][ T2250] worker_thread+0xa47/0xfb0 [ 167.516420][ T2250] kthread+0x38b/0x480 [ 167.516439][ T2250] ret_from_fork+0x514/0xb70 [ 167.516456][ T2250] ret_from_fork_asm+0x1a/0x30 [ 167.516487][ T2250] [ 167.516493][ T2250] The buggy address belongs to the object at ffff8880680ce000 [ 167.516493][ T2250] which belongs to the cache kmalloc-2k of size 2048 [ 167.516510][ T2250] The buggy address is located 8 bytes inside of [ 167.516510][ T2250] freed 2048-byte region [ffff8880680ce000, ffff8880680ce800) [ 167.516531][ T2250] [ 167.516536][ T2250] The buggy address belongs to the physical page: [ 167.516558][ T2250] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x680c8 [ 167.516578][ T2250] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 167.516596][ T2250] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 167.516625][ T2250] page_type: f5(slab) [ 167.516646][ T2250] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 167.516665][ T2250] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 167.516686][ T2250] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 167.516704][ T2250] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 167.516723][ T2250] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 167.516742][ T2250] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 167.516754][ T2250] page dumped because: kasan: bad access detected [ 167.516769][ T2250] page_owner tracks the page as allocated [ 167.516778][ T2250] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5718, tgid 5716 (syz.2.3), ts 90509878254 [ 167.516814][ T2250] post_alloc_hook+0x1f9/0x250 [ 167.516847][ T2250] get_page_from_freelist+0x2209/0x2280 [ 167.516870][ T2250] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 167.516893][ T2250] allocate_slab+0x7d/0x620 [ 167.516920][ T2250] refill_objects+0x2d5/0x350 [ 167.516948][ T2250] __pcs_replace_empty_main+0x2c8/0x6c0 [ 167.516984][ T2250] __kmalloc_cache_noprof+0x39b/0x600 [ 167.517004][ T2250] nft_flow_rule_create+0x2c2/0xac0 [ 167.517038][ T2250] nf_tables_newrule+0x199b/0x28a0 [ 167.517066][ T2250] nfnetlink_rcv+0x1288/0x28c0 [ 167.517096][ T2250] netlink_unicast+0x7bd/0x940 [ 167.517125][ T2250] netlink_sendmsg+0x813/0xb40 [ 167.517144][ T2250] sock_sendmsg_nosec+0x13a/0x180 [ 167.517165][ T2250] ____sys_sendmsg+0x54e/0x850 [ 167.517193][ T2250] ___sys_sendmsg+0x2a5/0x360 [ 167.517220][ T2250] __sys_sendmsg+0x177/0x240 [ 167.517248][ T2250] page last free pid 5608 tgid 5608 ts 80468989363 stack trace: [ 167.517264][ T2250] free_unref_folios+0xdc2/0x14e0 [ 167.517296][ T2250] folios_put_refs+0x9e9/0xb30 [ 167.517328][ T2250] free_pages_and_swap_cache+0x2ba/0x490 [ 167.517360][ T2250] tlb_flush_mmu+0x6d3/0xa30 [ 167.517379][ T2250] tlb_finish_mmu+0xf4/0x220 [ 167.517398][ T2250] unmap_region+0x2a5/0x330 [ 167.517419][ T2250] vms_complete_munmap_vmas+0x427/0xbe0 [ 167.517443][ T2250] do_vmi_align_munmap+0x3b7/0x4b0 [ 167.517465][ T2250] do_vmi_munmap+0x252/0x2d0 [ 167.517487][ T2250] __vm_munmap+0x241/0x3e0 [ 167.517512][ T2250] __ia32_sys_munmap+0x5f/0x70 [ 167.517541][ T2250] __do_fast_syscall_32+0x27a/0x6a0 [ 167.517570][ T2250] do_fast_syscall_32+0x33/0x70 [ 167.517598][ T2250] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 167.517624][ T2250] [ 167.517630][ T2250] Memory state around the buggy address: [ 167.517642][ T2250] ffff8880680cdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 167.517658][ T2250] ffff8880680cdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 167.517673][ T2250] >ffff8880680ce000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 167.517685][ T2250] ^ [ 167.517696][ T2250] ffff8880680ce080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 167.517711][ T2250] ffff8880680ce100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 167.517722][ T2250] ================================================================== [ 167.560449][ T2250] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 168.372461][ T2250] CPU: 0 UID: 0 PID: 2250 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 168.381832][ T2250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 168.391894][ T2250] Workqueue: usb_hub_wq hub_event [ 168.396958][ T2250] Call Trace: [ 168.400240][ T2250] [ 168.403177][ T2250] vpanic+0x56d/0xa60 [ 168.407214][ T2250] ? __pfx_vpanic+0x10/0x10 [ 168.411734][ T2250] ? __pfx___schedule+0x10/0x10 [ 168.416615][ T2250] panic+0xc5/0xd0 [ 168.420349][ T2250] ? __pfx_panic+0x10/0x10 [ 168.424778][ T2250] ? preempt_schedule_thunk+0x16/0x40 [ 168.430164][ T2250] ? usb_unbind_interface+0x2c2/0x9f0 [ 168.435548][ T2250] check_panic_on_warn+0x89/0xb0 [ 168.440523][ T2250] ? usb_unbind_interface+0x2c2/0x9f0 [ 168.445930][ T2250] end_report+0x73/0x170 [ 168.450189][ T2250] ? usb_unbind_interface+0x2c2/0x9f0 [ 168.455592][ T2250] kasan_report+0x128/0x150 [ 168.460115][ T2250] ? usb_unbind_interface+0x2c2/0x9f0 [ 168.465534][ T2250] usb_unbind_interface+0x2c2/0x9f0 [ 168.470780][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 168.476536][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 168.482303][ T2250] ? __pfx_usb_unbind_interface+0x10/0x10 [ 168.488063][ T2250] device_release_driver_internal+0x4f5/0x880 [ 168.494176][ T2250] bus_remove_device+0x444/0x560 [ 168.499163][ T2250] ? __pfx_bus_remove_device+0x10/0x10 [ 168.504659][ T2250] ? kernfs_remove_by_name_ns+0x101/0x140 [ 168.510387][ T2250] device_del+0x524/0x8f0 [ 168.514748][ T2250] ? __pfx_device_del+0x10/0x10 [ 168.519606][ T2250] ? __pfx___mutex_lock+0x10/0x10 [ 168.524700][ T2250] usb_disable_device+0x3d4/0x8d0 [ 168.529733][ T2250] usb_disconnect+0x346/0x9a0 [ 168.534416][ T2250] hub_event+0x1bbb/0x4d30 [ 168.538849][ T2250] ? register_lock_class+0x31/0x2e0 [ 168.544064][ T2250] ? __pfx_hub_event+0x10/0x10 [ 168.548840][ T2250] ? rcu_is_watching+0x16/0xb0 [ 168.553613][ T2250] ? process_scheduled_works+0x97a/0x1630 [ 168.559347][ T2250] process_scheduled_works+0xc3d/0x1630 [ 168.564935][ T2250] ? __pfx_process_scheduled_works+0x10/0x10 [ 168.570942][ T2250] ? assign_work+0x3cf/0x5d0 [ 168.575546][ T2250] worker_thread+0xa47/0xfb0 [ 168.580155][ T2250] ? __kthread_parkme+0x71/0x1f0 [ 168.585110][ T2250] kthread+0x38b/0x480 [ 168.589196][ T2250] ? __pfx_worker_thread+0x10/0x10 [ 168.594332][ T2250] ? __pfx_kthread+0x10/0x10 [ 168.598929][ T2250] ret_from_fork+0x514/0xb70 [ 168.603524][ T2250] ? __pfx_ret_from_fork+0x10/0x10 [ 168.608646][ T2250] ? __switch_to+0xc89/0x1420 [ 168.613351][ T2250] ? __pfx_kthread+0x10/0x10 [ 168.617947][ T2250] ret_from_fork_asm+0x1a/0x30 [ 168.622754][ T2250] [ 168.626371][ T2250] Kernel Offset: disabled [ 168.630705][ T2250] Rebooting in 86400 seconds..