last executing test programs: 2.731219728s ago: executing program 1 (id=45): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) syz_clone(0xb10e7180, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0xb10e7180, 0x0, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f0000000140)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff0100000001000000560000002500000019000a000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) io_setup(0x5, &(0x7f0000000000)=0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000001c0)={0x0, &(0x7f0000000200)=[@nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x5d, {0x0, "48b8008000000000000066ba6100b8555ad4abef2fad21e6e60c0020000f23f86592927716b9800000c00f3235000800000f30d035000100000f006080000f47dff2b00f30"}}], 0x8d}) (async) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000001c0)={0x0, &(0x7f0000000200)=[@nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x5d, {0x0, "48b8008000000000000066ba6100b8555ad4abef2fad21e6e60c0020000f23f86592927716b9800000c00f3235000800000f30d035000100000f006080000f47dff2b00f30"}}], 0x8d}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f00000002c0)={[{0x80000004, 0x5, 0xcb, 0x8, 0x7c, 0x2, 0x80, 0xe3, 0x3, 0x80, 0x8, 0x2, 0xe}, {0xe, 0xfffd, 0x3, 0x0, 0x9, 0x3, 0x8, 0x4, 0xd, 0x13, 0x3, 0xc8, 0x1}, {0x1ff, 0x5, 0xc, 0x0, 0x26, 0x4, 0x81, 0xfb, 0x4, 0x4, 0x0, 0xfe}], 0x9}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000380)={0x1, 0x0, [{0x48}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000400)={0x0, &(0x7f0000000440)=[@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x9, @control_area=0x2e, 0x4, 0x7, 0x9}}], 0x38}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) (async) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000004c0)={{0x0, 0xffffffff, 0x8, 0xb, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x10, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffff, 0x18, 0xb, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, 0x80050033, 0x0, 0x2000, 0x20, 0x0, 0x500, 0xfee00900}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000007c0)={&(0x7f0000000000/0x1000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000001000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f00000006c0)="28355808ce448e9251eab23acc76126ae7a0d140aa64b9303fdfa32b19dab0ecaa0b9d91c30d554acbdf7c3ca971a2c2ef698eae275f5fccf3522b12537ff905e0e323a12ec105e1b6829250b600b39237f6f85a6bcf3740156565daca6634d947e9712fd81c6dc18f0ea46b4a588b37d2111c3dd0d9c67849017853902e518aa84ecffaa185197de73babd2cd9fa509dc928d317280ee8478ac1af02bdf191f923cf6c600028c8db986ac6b6f79ef0dd8d96f2e0755da3d14ff605cf94112b0015df088d2cb1b85d72b3010c3a35770b42961f2bf61a174480f0fa8ab55b47f76bde1afadbe03722e4b56c13c069cdbe22bf2a4acea5fbca5d5", 0xfa, r1}, 0x68) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000007c0)={&(0x7f0000000000/0x1000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000001000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f00000006c0)="28355808ce448e9251eab23acc76126ae7a0d140aa64b9303fdfa32b19dab0ecaa0b9d91c30d554acbdf7c3ca971a2c2ef698eae275f5fccf3522b12537ff905e0e323a12ec105e1b6829250b600b39237f6f85a6bcf3740156565daca6634d947e9712fd81c6dc18f0ea46b4a588b37d2111c3dd0d9c67849017853902e518aa84ecffaa185197de73babd2cd9fa509dc928d317280ee8478ac1af02bdf191f923cf6c600028c8db986ac6b6f79ef0dd8d96f2e0755da3d14ff605cf94112b0015df088d2cb1b85d72b3010c3a35770b42961f2bf61a174480f0fa8ab55b47f76bde1afadbe03722e4b56c13c069cdbe22bf2a4acea5fbca5d5", 0xfa, r1}, 0x68) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000600)={0x6}) ioctl$KVM_SET_GUEST_DEBUG_x86(r6, 0x4048ae9b, &(0x7f0000000640)={0xe0003, 0x0, {[0x8, 0x7, 0x4, 0x8, 0x3, 0x8, 0x4, 0x4]}}) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) ioctl$KVM_RUN(r6, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r8, &(0x7f0000c00000/0x400000)=nil) (async) r9 = syz_kvm_setup_syzos_vm$x86(r8, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$x86(r9, &(0x7f0000000880)={0x0, 0x0}) ioctl$KVM_SET_MSRS(r10, 0x4008ae89, &(0x7f00000008c0)={0x1, 0x0, [{0x40000102, 0x0, 0xa2}]}) (async) ioctl$KVM_SET_MSRS(r10, 0x4008ae89, &(0x7f00000008c0)={0x1, 0x0, [{0x40000102, 0x0, 0xa2}]}) io_pgetevents(r3, 0x6, 0x2, &(0x7f0000000040)=[{}, {}], &(0x7f0000000080)={0x0, 0x3938700}, &(0x7f0000000100)={&(0x7f00000000c0)={[0xb]}, 0x8}) 2.537555928s ago: executing program 1 (id=47): r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) ioprio_set$pid(0x1, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0x802, 0x0, 0x0, 0x7}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1100000042001f16"], 0x20}}, 0x20000000) write$P9_RCREATE(r0, &(0x7f0000000040)={0x18, 0x73, 0x1, {{0x40, 0x1, 0x2}, 0x6}}, 0x18) 2.42332715s ago: executing program 1 (id=49): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) r1 = socket(0x28, 0x5, 0x0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x4) connect$vsock_stream(r1, &(0x7f00000000c0)={0x28, 0x0, 0x0, @local}, 0x10) sendmmsg(r1, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="1b", 0x1}], 0x1}}], 0x1, 0x4004810) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = accept4$unix(r2, 0x0, 0x0, 0x800) recvfrom$unix(r3, &(0x7f0000000240)=""/248, 0xf8, 0x40000042, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x485, 0x0, 0x40008}, {0x8da, 0x0, 0x4}]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) (async) socket(0x28, 0x5, 0x0) (async) socket(0x28, 0x5, 0x0) (async) bind$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) (async) listen(r2, 0x4) (async) connect$vsock_stream(r1, &(0x7f00000000c0)={0x28, 0x0, 0x0, @local}, 0x10) (async) sendmmsg(r1, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="1b", 0x1}], 0x1}}], 0x1, 0x4004810) (async) socket$netlink(0x10, 0x3, 0x0) (async) syz_open_dev$usbmon(0x0, 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) accept4$unix(r2, 0x0, 0x0, 0x800) (async) recvfrom$unix(r3, &(0x7f0000000240)=""/248, 0xf8, 0x40000042, 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) (async) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x485, 0x0, 0x40008}, {0x8da, 0x0, 0x4}]}) (async) 2.382022025s ago: executing program 2 (id=50): r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/devices/usb2/power/level\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)="fecdc656", 0x4) 2.347090318s ago: executing program 2 (id=51): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x1c8, 0x138, 0x1, 0x0, 0x24c10, 0x0, 0x0, @by_dev={r1}, [@crypt={0x0, 0x2000, 0x0, 0x90, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '128', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 0'}}]}) ioctl$DM_DEV_REMOVE(r0, 0xc138fd04, &(0x7f0000000700)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x20000, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_DEPS(r0, 0xc138fd0b, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x148, 0x138, 0x0, 0x0, 0x81210, 0x0, 0x0, @by_dev={r1}, "97ef39bc8324dbb5f3528b"}) 2.095360304s ago: executing program 3 (id=53): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) sendmsg$ETHTOOL_MSG_FEATURES_GET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="8fdf2cbd7000030000000b"], 0x14}, 0x1, 0x0, 0x0, 0x4005}, 0x40000) recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x8001}, {{0x0, 0x0, &(0x7f0000002640)}, 0x404}], 0x3, 0x0, 0x0) socket(0x27, 0x2, 0x0) 2.079015086s ago: executing program 3 (id=54): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 32) getpid() (async, rerun: 32) setns(0xffffffffffffffff, 0x24020000) (async) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x1c, 0x2f, 0x1, 0x0, 0x0, {}, [@typed={0x8, 0x1, 0x0, 0x0, @str='\x00'}]}, 0x33}}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg2\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000003c0)={'ip6gre0\x00', &(0x7f0000000340)={'syztnl2\x00', r2, 0x4, 0x7, 0x9, 0x7, 0x2, @mcast1, @empty, 0x7, 0x1, 0x0, 0xd88}}) (async, rerun: 32) umount2(&(0x7f0000000140)='.\x00', 0x2) (async, rerun: 32) mount$9p_fd(0x0, &(0x7f0000000180)='.\x00', 0x0, 0x80000, 0x0) (async, rerun: 32) capset(&(0x7f00000000c0)={0x20080522}, &(0x7f0000000100)) (async, rerun: 32) open_tree(0xffffffffffffff9c, 0x0, 0x89901) (async, rerun: 64) pselect6(0x40, &(0x7f0000000000)={0x3, 0x4, 0x5, 0x3, 0x8, 0x6, 0x0, 0x2}, &(0x7f0000000040)={0xe, 0x3, 0x0, 0x5, 0x1, 0x2, 0x9, 0x5}, 0x0, &(0x7f0000000080)={0x77359400}, 0x0) (async, rerun: 64) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, 0x0, 0x0) (async) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='freezer.parent_freezing\x00', 0x275a, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r6, &(0x7f0000001b80)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r5, 0x8905, &(0x7f0000001bc0)={'pim6reg0\x00', @remote}) (async, rerun: 32) syz_genetlink_get_family_id$devlink(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r4, 0x0, 0x44084) (async, rerun: 64) ioctl$AUTOFS_IOC_PROTOSUBVER(0xffffffffffffffff, 0x80049367, &(0x7f0000000480)) (async, rerun: 64) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB], 0x144}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) (async) r7 = socket(0x10, 0x803, 0x0) sendto(r7, &(0x7f0000000580)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) (async, rerun: 32) r8 = socket(0xa, 0x3, 0x9) (rerun: 32) getsockopt$nfc_llcp(r8, 0x29, 0x24, 0x0, 0x2000005d) (async) recvmmsg(r7, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000680)=[{&(0x7f0000000700)=""/100, 0x321}, {&(0x7f0000000780)=""/85, 0x21}, {&(0x7f0000000800)=""/4096, 0x197}, {&(0x7f0000001800)=""/106, 0x659}, {&(0x7f0000001880)=""/73, 0xd}, {&(0x7f0000001900)=""/77, 0x69}, {&(0x7f0000001980)=""/141, 0xe8}, {&(0x7f0000001a40)=""/17, 0x1d8}], 0x21, &(0x7f0000001a80)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000001b40)={0x77359400}) socket$inet_udp(0x2, 0x2, 0x0) 2.003629944s ago: executing program 3 (id=56): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0xa001) ioctl$USBDEVFS_CLAIM_PORT(r0, 0x4004550d, 0x0) syz_usb_connect(0x5, 0x51, &(0x7f0000000200)=ANY=[@ANYBLOB="120101024cf1c50863070210845f0102030109023f0001000000000904000005ff87e7000905880f000000000009050300000000000009050cfeffff01060209050f000000000000090507c2"], &(0x7f00000002c0)={0x0, 0x0, 0xfdc7, 0x0}) syz_usb_connect$midi(0x5, 0x40, &(0x7f0000000280)=ANY=[@ANYBLOB="0102030109022e08010118100409040000020103000609058e0b20000fd702052501012709058c0200066df780052501013a00"/64], &(0x7f0000000100)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x9, 0x9, 0xe, 0x40, 0x40}, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="050f08000103100b3d797dda9cb253ede8d06a432fac1e81be175e2c74d61a346d06d7cde9adea62b4f973ec0efc64fb72c3dafe092a81f9fc6dcd98c0e8013ac69765a4c4a48e641cdf954190a5f32346775e90aa8572db8140209476acc2784069260c352d0d7a54eabfa351812878a691ae4601000000cee491859a1857ba2d54ea6de5090c6a1ab1034f2de74a33a10a6e7459c82f87820545527fded64b567edb8a8ab5b6a78c257c21ab9589169d019cb76f789a31606263b9da99e65d0e17e686df3f58c83b06c45f2eb26f6cfa6ce40a9917354a3890ea0f0f8bbb845897a6e0659f4463284d0ba94671a907dfeb332c737efa86a75e4716991dc31969d8213ca4f0518741473361c42f93f34ab785008103843169c43f"], 0x2, [{0x4, &(0x7f0000000040)=@lang_id={0x4, 0x3, 0x42a}}, {0x50, &(0x7f0000000140)=@string={0x50, 0x3, "0db6029fed85382c6293d001684b37042f8cf535e801a4d29b42a1984ac3bc441bd0472ecfa161b60ef5174fca6d1d6e5d4478bf3d4435b4adaca05d0877a7067541e246419ff7b1cd62665b2b56"}}]}) 1.891272235s ago: executing program 2 (id=58): memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt\x00', 0x24) open$dir(&(0x7f0000000680)='./mnt\x00', 0x0, 0x2) (async) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$tipc(0x1e, 0x2, 0x0) (async) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x8800) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb0}, 0x80) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000540)=0x0, &(0x7f00000005c0)=0x0, &(0x7f0000000600)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000006c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000740)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000780)=0x0) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f00000007c0)={0x0, 0x1, 0x416, 0x1, 0xc8, 0x0, r9}, &(0x7f0000000d00)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x668a, 0x40, 0x0, 0x1a, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x40000, 0x2, 0x145, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x200, 0x1, 0x400000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x4, 0xfffffffc, 0x20d, 0x0, r9}}], 0x1, 0x0, 0x0) (async) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) (async) r11 = syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) (async) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) r13 = dup(r12) syz_ublk_setup_queues(r13, r10, &(0x7f00000004c0)={0x0, 0xd17, 0x10, 0x1, 0x80, 0x0, r11}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe702, 0x1000, 0x3, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x542b, 0x2, 0x4, 0x1bf, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93f9, 0x8000, 0x4003bffc, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x8}}], 0x1, 0x0, 0x0) 1.280778088s ago: executing program 2 (id=64): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0xa900, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup2(r0, r1) ioctl$KVM_HAS_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee3, &(0x7f0000000100)=@attr_riscv64=@attr_config={0x0, 0x1, 0x0, &(0x7f0000000480)=0x8001}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x5, 0x0, 0xeeee6004, 0x1000, &(0x7f0000fff000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) sendmsg$IPSET_CMD_PROTOCOL(r2, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040}, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x408d6}, 0x24008011) r6 = syz_open_procfs(0xffffffffffffffff, 0x0) fchdir(r6) r7 = syz_clone(0xa08100, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000280)={0x2, r7}) r8 = syz_clone3(&(0x7f00000017c0)={0x2000000, &(0x7f00000002c0), 0xfffffffffffffffd, &(0x7f0000000340), {0x18}, &(0x7f0000001940)=""/136, 0x88, &(0x7f00000018c0)=""/111, &(0x7f0000000300)=[0xffffffffffffffff, 0x0, r7, r7, r7], 0x5, {r2}}, 0xfffffffffffffff5) r9 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000001840), 0x0, 0x0) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r9, 0x8000) kcmp$KCMP_EPOLL_TFD(r7, r8, 0x7, r1, &(0x7f0000001880)={r9, r6}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x30, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) setns(0xc9, 0x0) r10 = socket$netlink(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010300000ae6f72087a003"], 0x3c}}, 0x80) recvmmsg(r10, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000006c0)=""/4112, 0x1010}], 0x1}, 0xb}], 0x1, 0x140, 0x0) r11 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) 1.275430608s ago: executing program 1 (id=65): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000540), 0xffffffc1) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x22052, r0, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(r1, 0xc008aec1, &(0x7f0000000240)={0x6, 0x0, [{0x6, 0xfffffffe, 0x6, 0x7ff, 0x1, 0x5, 0xa}, {0xa, 0xfff, 0x1, 0x8, 0x5, 0x5, 0x9}, {0xa, 0x8001, 0x4, 0x800, 0x8, 0x200, 0x2}, {0x80000019, 0x5, 0x2, 0x6, 0x1, 0x5, 0xffffffff}, {0xc0000001, 0x4, 0x0, 0x5, 0x3, 0x368, 0x8}, {0x80000008, 0x9, 0x4, 0x3ff, 0x7, 0x8, 0x4}]}) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000080)={'#! ', '', [{0x20, 'cpuacct.usage_percpu_user\x00'}, {0x20, 'system.posix_acl_default\x00'}, {0x20, '#! '}, {0x20, 'cpuacct.usage_percpu_user\x00'}, {0x20, '%'}]}, 0x5a) (async) ioctl$XFS_IOC_FSCOUNTS(r1, 0x80205871, &(0x7f0000000800)) (async) timer_create(0x8, &(0x7f0000000600)={0x0, 0x15, 0x1, @thr={0x0, 0x0}}, &(0x7f0000000640)) timer_settime(0x0, 0x1, &(0x7f0000000680)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0) (async) syz_open_dev$usbfs(&(0x7f00000006c0), 0x1, 0x208002) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000340)=""/124, 0x7c}], 0x1, 0xfffffffe, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) (async) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)={0x1, 0x0, [{0x9000, 0x59, &(0x7f0000000740)=""/89}]}) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000880)={0x1, 0x0, [{0xc0010015, 0x0, 0x1}]}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000008c0), 0x2002, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) (async) ioctl$KVM_GET_IRQCHIP(r9, 0xc208ae62, &(0x7f0000000900)={0x2, 0x0, @ioapic={0x1000, 0x5, 0xfffffffc, 0x9, 0x0, [{0x2, 0x6, 0x1}, {0x9, 0xfe, 0x3, '\x00', 0x7e}, {0xd2, 0x3, 0x6, '\x00', 0x6}, {0x6, 0x9a, 0xe, '\x00', 0x1}, {0x6, 0xb, 0x2, '\x00', 0x8}, {0x5, 0x9, 0x7, '\x00', 0x98}, {0x3, 0x9, 0x4, '\x00', 0xfd}, {0x2e, 0x81, 0x4, '\x00', 0x9}, {0x2, 0x0, 0x1, '\x00', 0x3}, {0x3, 0x1, 0x80, '\x00', 0x1}, {0x8, 0x40, 0xe, '\x00', 0x8}, {0x9, 0xb, 0xea}, {0xa6, 0x7, 0x0, '\x00', 0x5}, {0xa, 0x9, 0x8, '\x00', 0x2f}, {0x80, 0x7, 0x6, '\x00', 0xff}, {0x3, 0x1, 0x7, '\x00', 0xf8}, {0x14, 0x4f, 0xe}, {0x8, 0x80, 0xd3, '\x00', 0x8}, {0x89, 0x77, 0x5, '\x00', 0x3}, {0x5, 0x2, 0x0, '\x00', 0x4b}, {0x1, 0x7, 0x10, '\x00', 0x4}, {0xc2, 0x1, 0x8, '\x00', 0x80}, {0x3c, 0x1, 0x10, '\x00', 0x3}, {0x78, 0x1, 0xb, '\x00', 0x6}]}}) setxattr$system_posix_acl(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000001000000000000000400000000000000100000000000000020"], 0x24, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x0) (async) listxattr(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)=""/10, 0xa) 1.234919033s ago: executing program 1 (id=66): syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) (async) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) r2 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) open(0x0, 0x60840, 0x0) (async) r3 = open(0x0, 0x60840, 0x0) syz_ublk_add_dev(r1, 0x0, r2, 0x0, &(0x7f0000000080)={0x2e, 0x4e, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2000100000000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0xfffffffffffffe39, &(0x7f0000000100)=@new_dev={0x2, 0x6f7, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x4}}}, &(0x7f0000000140)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x1c1) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x1c1) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000700)='./file0\x00', &(0x7f0000000740), 0x80, &(0x7f0000000780)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r6, &(0x7f0000000f00)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000002f40)={0x50, 0x0, r7, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x2}}, 0x50) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000002fc0)='./file0\x00', 0x0, 0x2c) syz_fuse_handle_req(r6, &(0x7f0000003000)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000005000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000050c0)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_QUOTA_RESCAN(r8, 0x4040942c, 0x0) r9 = syz_ublk_setup_io_uring(0x3, &(0x7f0000000200)={0x0, 0x4, 0x10000}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)) syz_ublk_setup_queues(r3, r5, &(0x7f0000000340)={0x0, 0x2, 0x10000, 0xfffffffe, 0x257}, &(0x7f0000000400)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x2, 0x1c4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x1, 0x0, 0x146, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf78, 0x10, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4a3, 0xa000, 0x1, 0x2ae}}], 0x1, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYRESHEX=r4], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYRESHEX=r4], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000e40)={0x84, &(0x7f0000000180)=ANY=[@ANYBLOB="001e1400000009"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 970.14296ms ago: executing program 0 (id=69): r0 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x2000000]}, 0x8) recvmsg$can_bcm(r0, &(0x7f0000001500)={&(0x7f0000000040)=@tipc, 0x80, &(0x7f0000001440)=[{&(0x7f00000000c0)=""/4096, 0x1000}, {&(0x7f00000010c0)=""/241, 0xf1}, {&(0x7f00000011c0)=""/234, 0xea}, {&(0x7f00000012c0)=""/41, 0x29}, {&(0x7f0000001300)=""/162, 0xa2}, {&(0x7f00000013c0)=""/54, 0x36}, {&(0x7f0000001400)=""/40, 0x28}], 0x7, &(0x7f00000014c0)=""/62, 0x3e}, 0x40) sendto(r0, &(0x7f0000001540)="67f825d8b224de86f2da9d164ff043e600128661dd1955b31db5e12ac69a8f574b42137c46951c649ce4d1f73ea662132218f23cc5bd3a", 0x37, 0x0, &(0x7f0000001580)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r0, 0xc0096616, &(0x7f0000001600)={0x2, [0x0, 0x0]}) r1 = openat$cgroup_devices(r0, &(0x7f0000001640)='devices.allow\x00', 0x2, 0x0) pwritev2(r1, &(0x7f0000001680), 0x0, 0xd, 0x6, 0x4) pwritev(0xffffffffffffffff, &(0x7f0000001700)=[{&(0x7f00000016c0)="ff311655f3908d2a87d6da3caa5334c026419386b5caf2dbb146a8ac6b9f84cd06ddf33a96143d8cd3", 0x29}], 0x1, 0x80000000, 0x100) connect$inet(r0, &(0x7f0000001740)={0x2, 0x4e20, @broadcast}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000017c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001800)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r2, &(0x7f0000001900)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000018c0)={&(0x7f0000001840)={0x70, r3, 0x400, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x5, 0x70}}}}, [@NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x3}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_FLAGS={0xc, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_WME={0x4}, @NL80211_STA_FLAG_WME={0x4}]}, @NL80211_ATTR_STA_VLAN={0x8, 0x14, r4}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x4ae}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x94b0, 0xfffff000}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_VLAN={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000004}, 0x40000) r5 = signalfd4(r0, &(0x7f0000001940)={[0x20]}, 0x8, 0x800) ioctl$KDGKBTYPE(r5, 0x4b33, &(0x7f0000001980)) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f00000019c0)=0x4a5a, 0x4) ioctl$FS_IOC_GETFSSYSFSPATH(r5, 0x80811501, &(0x7f0000001a00)={0x80}) socket$packet(0x11, 0x3, 0x300) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000001f00)={&(0x7f0000001e80)=[{&(0x7f0000001ac0)="058069d6010d91899aff6c9fea20757f2c55d75616b26e78f9cc93a89bf307cba2f2f24e35924dd30a86a2d738135a", 0x2f}, {&(0x7f0000001b00)="01114327b396926a8d4093fe2cbeb9b584cfeb64123e7ddb46a52a5b8ccd399a0a7e1380f9fe40f51893963856147f95d69f933edd116bd1478901b1c93d9bc68699a94592b36e1b3bd30d1ff88676bce1a8e69501edaa6f55df2f3ffff741ed7d9b718bb68443acbdcd42e456621c21464e72116aa46df3ab18561e7a3518f00a4db145effefd7c2a8589e3ea520392fbe760932c6e539561b4f0d8e3fa0526578372f293c2f0e2529f6eca547b5eb34953f043b172ab89e7c6337256494291f0cfcc555125551f39847fb4fa293d6a8e", 0xd1}, {&(0x7f0000001c00)="9016f3378f79e6b6fd1264c6a7ab6a87c35c7c76b1b347978c1403f95cb44a514982b686a023f4f7a312e1dcfefd153b370813848be09780d7c05f3b6b78dc641e169b29e02caa2fcc468e23e7e5551059346ca84ee3277d814164a7e9255f2aecb7f8ba1bcb019845f3fd7736be2f5b4ec1e83a24", 0x75}, {&(0x7f0000001c80)="8f4249d5832ba03e1d777fa43c0b4c067f83a4a83548353149f7f99caa4eb24bf3f6437e3a59", 0x26}, {&(0x7f0000001cc0)="ea2c708fd2b13dc092bfac4e3a4cdf9e01ecf55a6c8917ce49648814403efd3ad4c19e6119e6eb1c3493c72d07e16c4a691d9a26de7c8020aa9fef7303b4045aa3696e34f20fd0d4f060cf0c060a77fbc3f3fd4576e8", 0x56}, {&(0x7f0000001d40)="d848ac19592e6efc589c02bb5baf9f99e85f0ee76561b9ae3e50443b1996aed1bbe3cad0a69e8b5dc9afaa15fdeeed11acf608", 0x33}, {&(0x7f0000001d80)="28f96207e853b6032ac3cacc1361be3c04b1f374d68e49aadd194f87bc8c1561c92c1e3f345a80695ed1c7f8fae8f3e79af433d94739049dfdad963cfe00d7cea3e6838c62b6bf0964e7e6efc66c517c2e58478a125ce0eee644134ae7c75253d4afe10ce5cf0a79c43939287820ac486fc6d34042d5a93f192c904dfc4ed9892497df4503260a08523f27954be1782af109d2337f5c1d53546a10ea21be85d1b1a9effc726e38de7192f0756f149ce259f4d9737a561d7b7761981d8be48e6b889e50273c76d76532f111a71e7e17741c69b69f169c9463536023", 0xdb}], 0x7, 0x0, 0x0, 0x8, 0x9, 0xd7, 0x2, 0x4}) r6 = accept$nfc_llcp(r5, 0x0, &(0x7f0000001f80)) getsockopt$SO_TIMESTAMP(r6, 0x1, 0x40, &(0x7f0000001fc0), &(0x7f0000002000)=0x4) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000002040), 0x3) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r8, 0x6, 0x1d, &(0x7f0000002080), &(0x7f00000020c0)=0x14) r9 = socket$inet6(0xa, 0x3, 0xb60d) ioctl$F2FS_IOC_DECOMPRESS_FILE(r2, 0xf517, 0x0) r10 = accept4$vsock_stream(r0, &(0x7f0000002100)={0x28, 0x0, 0x0, @my}, &(0x7f0000002140)=0x10, 0x80800) setsockopt$SO_ZEROCOPY_vsock(r10, 0x1, 0x3c, &(0x7f0000002180)=0x1, 0x4) recvfrom$inet6(r9, &(0x7f00000021c0)=""/214, 0xd6, 0x0, &(0x7f00000022c0)={0xa, 0x4e23, 0xd, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2}, 0x1c) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000003680)={&(0x7f0000002300)={0xa, 0x4e23, 0xccc7, @dev={0xfe, 0x80, '\x00', 0x19}, 0x8000}, 0x1c, &(0x7f0000003600)=[{&(0x7f0000002340)="1172bae0d2761b0ae555b50edff9edb397f8f29d5fe16b5db676085e110ba0b363acb8e93823d45b9a1cee0ad99c0877bb7b966a5aea28dbc5fbeea66b7d81b434a730a36b161b411edccbea740f5ee9b542ca1bd1fd5470e3b441d1c9c0b63a0e4026b500d4f40f250bbbf6d3e75405e2ddbc7992c447b5bb54b60da8e9d2b2c04f37a6623f4903fc140dc615fa8a7dbea25ef7ae973024791bb3615577665ad826e512d846ab19ac3978b7b460b455bbd1fece3c0bd725f49d88af0d1cb9f95da8884b570902b4cafaafb6b65b290750d817bad27a4b2b1cabc4a9b3b1d00e2337e13e7ecaa4f76c1f33635754e10168f1a9e9265b6816d1522a3c33fb123839f09b3eb3456aedb5adad94d3586b6bbb3d0308dd214fa52f7c35fa110503f505d62087e9415a954fc0493cdd6d29f308cdbca20af6a9a50c440cea7c48d5e6e94d6b0bda6e870a35b9d56220c29afd2b963f4d2e50a586cabc2cf226eae6c41ca654713a4f15c98d4c6ae1e86655198e6f640a4b5e343d3c91843e185f869b08850a9fc0013ed986c7985512dcfcce4374484a0d9f038365785429152edadde70a675541a77f21724d9efe2e723d73a7457aa0adb8fdba7b060aa5af09a3f82ad656dbaf910d7d9db1013668292e37752040f7efbc7ab9f8e1659443462bbab9517e0aab1bcb6c7c7718e8590a60332a69fcc52b5a712d7caffd05cd01329ab0af7128acea86da80412beb76c3fae8f98c4dbc4d80767069921ccfb93eab96ec39117d7b3a9a15e64ccd300b16c453f1558e7edb647f20812805403cf0efd689a60d50b8cdf24cee3c9238f23bbd8d48ff8991c87fb46de4894b58234d64ab70e67612c44a5b8adb7fca0ceb149e7dbd0e44b453a5adcb3f96ab7bec8819b8c646589c2d20b9ce592b9c5eda20d641169ef0648ae9dd04d5746e04d3949031767318b46128e021603062c83873188f20b2263952961762d5b41e68bee5ac4cb3cefa7b75a2c723c637fddd8c040f85d6e650e8a0f646c9d154bfa91f3adbee86adc6a23739bf76ce05a77b8fcec3e95c18482da2db3f448730d86e5fc06439590f7bd40cd7731d67f466b1668256ed6caf7dae33840f7b7808f138082fbc589182d8a4c64f35416b1948d32ae245fb6e04f3e4f7c765b7c0aaf681e2db25e78bd3940c48805beb40b48c5c941ef257c8329034ac21e3c39f1879c5340574f67ee43d3cd7336c6a1a911d1fb18fb820e974ee543313ef8a07107adc12ef0aa454dd952df6ad3bfc8b88d289e8167c228583e86392d7c5c512661619a6af07bf8f82a9cad311f313beaad68ec66e91bcc7b6c1460406aeaade8d2389b31f38343574246088675fa4ae3f9506ce13fe3abb17d845d9a9df04b44b75153c139f170ae08611eadfd0cd9169a9d2851c091e63cff7d4423abd25ef222ebcaa69acabf4c46d89d421fcb292262e07e09d330c7ed3b0288d0992ef24719916bb097a80c3c28b2d3f4101ad2d793e596236663279d179c76040082d22d1ae8c19569cfe4ded0e9effc333e22ed992508b420e4f508898c066baadd89b3dba595dc6b8a3073a5b3c1e32fc6305ca04ef892fee6e82cba08abd4da3d5fc3761d65d5d25a55afbf16a8ece28d5d7d44085f3d743fbf9e25b719175cebc2490c90f79d7ec06c893d4a1308524b302a59e0955633c4fbf18137249877fd89c0903fadb2b1a02a23ec985905f918a2aa9990f9e519cf5437a28770635339f3a59bb828fe8ccc58014b406669278393051a94f361355b5b6fb4511fac8e3a542ff6e7d67164e80917b8358fc235c1d5652eb6730c3f9cc5d1afdc01fec84d167b18fedec8de9e7db784e26cb552d5826214e261acb8f506713aa2b24860bd201ed235d943d25eddf4074b10120b7d632c94d3d5add40f916951bb17a3f08bb120648f210f07c675fcb5da597dad814cc01ef20dcb4b4245284e88fc12ead746bf6030c1f45877ff05a7066daf28f0fef440a8bb8a35994a94ee0e932f385e980cd55226118becfce8eefa4f1ed610e71b1ec5d2d6c2fb53859c780c31349c3cc7c6ad20ec95aba34fd55eaa6b5f19969ba29b58a944c04769192fd997fea989ba485acfea8f5f1d2d9a71f254132bf270ce3a3980b0a5148697747de2c588a9f466a50ff3dd3e43860c51822eddba150198e35ebf8d3153653c1885faace3baa79db9e8768f72f40817a86287f903211fcb85d01ebc7a4ffb3be27d0aa59e2a39b378b3abae29a31ee24950af4549c3cabbfa97a9e5b88bcd614b6ebbe46a6f96186f7a7068834be841ff0d276f19ae2400e298f43fcfa3b10f4eaae29c9fc856618aa2a563578e6ddb228d0c2dcdbeea9506542857801516a22d1a7e220b1e09dd123e255a2a682b8eddfad65d5b3c3131de1656f670f57674e565f9fc5fc4c2b0a4a24e50f36ef9495e6b2bf774e8dd06cf301fc38dc86d48713384a8beed1ca908712b03aa7ff68fb21cbc255c16cdb2a788342a4efd32e4a3994f3fe574ff01b5c7b8511d3e51c0aa8cc02e05b2f3e50bfb43c8d92fd4bd20ea0a2c678ab53136a6005fb7554ffd952e8f034f8e444887aef235d3ba969f981bc5b1eca8ccc7f4746cdb047b8b3ba25ba48e489334deb6d9e8f70999576ff1f5eed99969baa2926bfc81eed033f2f10d948db9cf9e4c9b6baa0d3e64ebc453fdc5648584b712efab6782bd8738936bf3fdc82ef1ed48d3375b9a79c8c9108d6afdb95ddc81107e4a268725741c51b24f25eb9537b2eda2b01224fb83b9d69671eb521e8ba0c052dd1e1d7c6dbb40ce53037b392fe3c4be7fed90a61bbd82356146033e24591dc8b39897c2837f63b6205c7597a33db56492a6b44e3f5e0522d1450abd58fc2fe8b904211727dc2d33c26f60270083c4e49c9ab3a4a2cac9ccebc16c5acd89a105e890ef6c18f533679c4913c2f32d4089efead097107e7fc72d2d288cf9d69f08722e5142f1451881ec3ef1b46d76f701753501ff9b130fb985113d383d09d9deaaa7174a8f95a8f220d398fe9af29e0141f93de5540c5c78ebba7838616d582501eb2d01367c9436dbe6d895a5503ce2fe67e1c2b8b32b1076a98be268b555fc7ed5853d98ab12713ca0378d28988ba8282fef02f2e557b07e23805b2b40125823289570d3d5b8e3bde104f0329c8359471cedc12d6d09ebb0ffa3439f816e6753d3351f13f6d00f419f03b218c95f61f11b18acd935ac8e24426793a1704fe389fcc12c79be3bfff93ea036fe8aca464fbf85168dacc1932dbecf24e9b1387732fd8e229dec2924f8d3365537c458e125bc1eb7c9517666ec34f7f0dfac25c1b4e395409d90308c8342794f4abc7e273c9c6d5e85e5e8a1d11c2466a36f3ccec9c65230415bcd9c79a316f03c2205c5226370472f3cc682fc4d3b23b3dc394401a1b0932551a17b07ef0a067ca9f4f72747bed797d604affc9dd381626d44b15fd96c5d5df45576c4f4e22f17376c2fd565ef1e84f8ad085016499137db2ae7a4aa0ecf46f5e66554fbed5fe967db7e0220670a6ca829a6a9227689b7557c3ec0c9da64f9c0d8fde9891e9520e85495c2fe5d0dd824843b0d0aece0333937999878409cc92ae7eba40fd79f468f230ff5bee854e65044bdeb4b5d3bd7bedda7646d3bf2d1ce7b249698f7ef18ae7fa864d393a9e010219a6b0c115aae459d1c89cd7ea2373d1796c361cc9b3e8510c8687931c4ae92c311d18e0fd23b7aa5373b5da3953ab319ab11313324ea7853d9597d7af50b0b28a95de5fdd489ed27ee5601df993c52a452dc00003e40f466193ee248c1019518cea8207c03dd1ba26715889ab01ca067e0deee4230f8697ec9e651c907706dadea88023d2f28f11616d6fcb07eb42deacddbf904e493d5dc7ce0d29f52cba37ec21fdd344ebd418ced693f21ad76f0df059d81b81be9e4487a96a29c832824e14fa7756b774a76d4d37b582be5b8faa5b0eb34880588bed16fc9778b337210eb561f246af2df58e746389b3fcc2a9f34029ee04b9fc86b1824c4522e696fdbba3c1439dc97707715d38ba9e2b790b02f63297ebe3a240da79e27a27a47d7d3bb3be92af57e1b7e78aab52995ab82ea92bc5081c50e5d05b0f4f6b0742141fc463769d0662cd622ff96c6e7a008e12430217c943b2598d2ce5d9a74c9a8eaa2b98087c400efda76c61afcc432e6613221ac11116fc6c05b42eef382d710a60542390cf354f5a03538389038921a533dfa278d9f0279413ec6388a4733dfbb7ab0d71b071cb8b0cd19ee2e9165c4a47d2e76b119e3b0f8a238b4252816c9738ba0db9371032a792e959844030ffa778d9ba644999482beb6a6ba396a76b0de55f2f5c724d5bfd0b3a68619c836c22958864051fc84446abad6f9769f959c645445ed350579f2e54499d8fe9eb7283a38c993b532df0d7fc51ce8c1d8a7caec14fb3c6e166ef1636ba74006683f3362bfbf6f4bc0ba3bfd3e7e7e59ad8e7bfbd7987e07adbd9cbd3abd255232a345ffbd20ecd051bf7edb55cb546a6a81802912beab2d9dfee96b35ef582b1916f0e5f2498ce2546f3f64eb4f2e942e88d1892443f32a20e3ab3175927e4ca72801d3bfb0537a30283f7e040e91b60b3d9d258bd7580d8b738c56792d2c4a59e070325fcd9ce72b355dbd16d648c067627769cd3bc6972d2dc0dcab195e3cbfd83379eb7c7fb9e5a1fb83f7e88bea1d0a7058156823b881b8cd73c4cd7da6f9d92aeec923ceeedc096995ad209768a92b0265982a961d964b4185f7983038a83d1c8d4359e36efd1153e72dbf208b9b21ef4d1b88710910aa298444989840fdbe60b581d5d660e62bf7b044cb60b791aba1544e15ce93a6b39994d484a7198969a91b3fda376e534d75f7d56f7177809c1311a9e94526bce93ff5f129470e5d1222405875e819dbc812f712c406fa9550eec4a13e22a7e7c27abddd85f45829ca1bbc2be09474ef2f40b0f26a993eb0d86a0e29f71a33d06cfe626d9ac57956042ec155ad53ec48b11c6f24d6c7911402cb12fbd05550f80b1fd47331d31cf35dd3a98b695cd806f3ee1c1f8a1cd103d07e48bc2479730eeb5230cc2078b48c276dae523cf5c2bafb09fc4a0d47c4eac984a5afa04ed5fb94ca26bf9b5f38de6ddf7f840eebbff14733e3ceabcd584f61a0982e1efd5472179a728cb5f3338b85997ce8c1cd0a9da368d03b0ed1f2c7ae9cb6b8779d0b36a60cab66cad538fe53c509da8e77cb17fb2e546bddfb36af15de0d511d1f3cd85622ba91be5e103ea8c64beb3d9e77f5ba68f502d9fb1fb627fe373b84e40e88dd2b7e9e52da7f29c8b3ae840079e36213bfa92c4befa1d6a5c5e35499f842228bec8b6e17cccbe1f6c8172f06c76bf35f38542dc205300ae63d318ff0dae1db322c424e7cf1d0b804e8cd5c78c2a9b037700b13a1c5f195d4d707ed7e938dcbb22553be8dc6b3f915b43df91f9eb99b4e59563f5de673f2294cf985aa4a8136474183296657a1a55afbd4733c976a1b5951e10d085bc69b45c7acbb4aa618ddc213df0d1cd88d3082eb9c14add8e3066dab826b08a0103e0bedbee50c7a5eb36b272dada8b5cbcbf28d65ea87667914904bb9dbfe338e5400c96d3470ac0e06598115fcac06a363cba32167448c0c5e2c3d5079b239f9321df5d1c45c36bf222f4ebd9dab2af8de16dd700d11f5da2a708d7039ff1a6c1adb2d01c4529410a6fbb8943dc365790b8fb0f5cd8bf84b8fa883b1eadf8f4d57f5186200743d74552345298d74c052422d269", 0x1000}, {&(0x7f0000003340)="ab6a9fe293f065567872196d989fb8f20aa6c2ae54d9117f9ffcba190f2e881f372ad1c6327be47bc879c6323de2503537f1699a0c6f104c74c8810eaa2a6d996833242a67659e0f76ba4707de7a4c88d9f753b3dd512d0155f147eef43161822ad0cbbee236919fdec6dbecb97b08e20d7ce58ae67b2e3cd3c37abaa4febdacf3", 0x81}, {&(0x7f0000003400)="7613af57d909540982d06395d620ddec6fb452b2701ec33805d6c1020ad554a4d4fb1ba0446151463d13064a8fe23f8aeca167ce5c57ecb8aeea39156d4528aff79bc7f9de2976add95f7aa2d2c70271be43b1f2818cfefd4f7903c1dbc0bc5501462290a049ee98d1212dcc8c091b263156048ffbdf62e30f3af9eec233ece2858037894768a4054522a9b66a383d56cb791d0d4815fe5455d8a756282ce1bd4119970b9d0a59194e59cd0c4260e9997c14f8b039e7e547a52e4fc7f46ce4eedde88f634d222c5527aa371bb61c55e84e4e35bb1af6", 0xd6}, {&(0x7f0000003500)="a6077624dd6e5365176e8d1bb23fb76dcc1a995fe6f321f9cb13fddf6f211fcb4b74f37cc2627beddb5a967bf5584953fea365c057c9b4080c7829722fb91250b59ada378bb6fbfc40390e1c247b3e04ba812290e6f79295a6c9a4734d8f0a0788f0947af6bcf8b19d2c68d23c16c7a6feb1df01a4f79b8ad12724b69d524c0b81d5e2331cccbd0f7e27e9d8c19994d19784c4a24059ceb4cc068cc6dd0320af466aed916fcdf02ecd7aa3221dbfc00054fe65e1e527d7bc5f32e61628d67c06174106591141145a6a6bc4cef6c8ce709b01e86198e76b001d4fef9c55", 0xdd}], 0x4, &(0x7f0000003640)=[@dstopts_2292={{0x20, 0x29, 0x4, {0x9e, 0x0, '\x00', [@jumbo={0xc2, 0x4, 0x7}]}}}], 0x20}, 0x40080) 953.563012ms ago: executing program 0 (id=70): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x80, @any, 0x0, 0x1}, 0xe) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000140)=0x100000001, 0x4) r2 = socket$inet6(0xa, 0x80002, 0x0) sendmmsg$inet6(r2, &(0x7f00000004c0)=[{{&(0x7f0000000500)={0xa, 0x4e22, 0x8, @local, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000540)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x8}}}, @dstopts_2292={{0x18, 0x29, 0x4, {0xc}}}], 0x30}}], 0x1, 0x4040090) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) setns(0xc9, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010300000ae6f72087a003"], 0x3c}}, 0x80) recvmmsg(r3, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000a00)=""/4112, 0x1010}, {&(0x7f0000001a40)=""/220, 0xdc}], 0x2}, 0xb}], 0x1, 0x10040, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) fstat(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r5, r5) r6 = socket$can_bcm(0x1d, 0x2, 0x2) mlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) connect$can_bcm(r6, &(0x7f0000000200)={0x1d, r7}, 0x10) sendmsg$can_bcm(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="010000006b0100000100000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="0000000001"], 0x48}}, 0x20000000) socket$inet6(0xa, 0x3, 0x9) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000009c0)='memory.events\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MIGRATE(r8, 0x6609) chdir(&(0x7f0000000080)='./file0\x00') mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r8, 0x0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r8, 0x6, 0x16, &(0x7f0000000440)=[@mss={0x2, 0x5}, @timestamp, @timestamp, @timestamp, @window={0x3, 0x9, 0x6}, @timestamp, @mss={0x2, 0x5}, @mss={0x2, 0x8000}, @mss={0x2, 0x2}], 0x9) 895.628908ms ago: executing program 0 (id=71): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='cgroup\x00') (async, rerun: 64) r1 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 64) bind$inet(r1, &(0x7f00000020c0)={0x2, 0x4e21, @local}, 0x47) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000002100)=0x40, 0x4) (async, rerun: 32) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f0000002140)=0x100000001, 0x4) (async, rerun: 32) r2 = syz_open_dev$usbfs(&(0x7f0000002380), 0xf, 0x2) ioctl$USBDEVFS_ALLOC_STREAMS(r2, 0x8008551c, &(0x7f00000023c0)=ANY=[@ANYBLOB="d4a500000300000081"]) (async, rerun: 32) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000002180)=0x2, 0x4) (rerun: 32) connect$inet(r1, &(0x7f00000021c0)={0x2, 0x4e21, @local}, 0x10) (async, rerun: 64) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000002200)=[@mss, @timestamp, @window={0x3, 0x62f3, 0x1}, @mss, @sack_perm, @mss={0x2, 0x6}, @timestamp, @sack_perm], 0x8) (async, rerun: 64) sendmsg(r1, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002280)=[{&(0x7f00000022c0)="29966a", 0x3}], 0x1}, 0x4000800) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000002300), 0x4) (async) sendto$inet(r1, &(0x7f0000002340)='<', 0xfdef, 0x805, 0x0, 0x0) (async) read$FUSE(r0, &(0x7f0000000080)={0x2020}, 0x2020) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x20003f, 0x0) 683.262ms ago: executing program 2 (id=72): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x208402, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x25) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f0000000080)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000040)}) r2 = syz_open_dev$mouse(&(0x7f00000000c0), 0x4, 0x284840) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x842, 0x0, 0x7}]}) r3 = syz_open_dev$loop(&(0x7f0000000140), 0xd7, 0x20000) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r1) modify_ldt$read_default(0x2, &(0x7f0000000180)=""/118, 0x76) r4 = socket$netlink(0x10, 0x3, 0xc) ioctl$VHOST_VDPA_GET_GROUP_NUM(r2, 0x8004af81, &(0x7f0000000200)) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000240)={{{@in=@loopback, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@private2}}, &(0x7f0000000340)=0xe8) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000380)={0x1, 0x0, [{0x6, 0x4, 0x1, 0x8, 0xa4c, 0x2, 0x8}]}) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000000500)={0x14, &(0x7f00000003c0)={0x20, 0x3e, 0x64, {0x64, 0x5, "ee31f871c377269a8b6aeaa219660d26d4f6904e9b0532894993c55e04e255c1b0d0f7feda427ba2804cf93bf34063bec89d21c490b0921b9a22999be9dcf73012dadd277a8f28573bd9035add33cdc5876ed44403c7107b50ed26d7fb52f2b38116"}}, &(0x7f0000000440)={0x0, 0x3, 0x85, @string={0x85, 0x3, "37527299756ab80cc7d511e865cd939823a267898a25e1b3b5a59e35675e72ab7e5cb52edcdbfd1f6335db4c5564a7f7f01314634ab7f9d56dd0db6cd44746ab8df4f9106bab025badb9d42346e0bfd2698e1729e2ae2962fea03758e37f95389e1b54714f82473df92a900fbe964a115cbe7af72c0c866be0bde139e3f2ca31bc008c"}}}, &(0x7f0000000800)={0x44, &(0x7f0000000540)={0x20, 0x14, 0xf3, "76456b79255dacd01da2552bfacb3bde109105bff43903dd04134a36b2ed2ab4f5d684bf30d0abd81875c70d1f66d0a1cd3cdf82b8fc0537c0793fb2561e5890a653995e03906a96a6876f07833d661cd1f1717166bffec0677b701920c5797f4b6136bffa2f6951bbe37cee974c074dd86b2d405703b59127c73e0f64044c9b0d94673e8f2b2f530f97ee494b2394a3ba167d9cfdbcbaa5c9334888d7cac215a28aa9543d548849d575287e38c480c9e6a0c20c0a3eeb72ec720757621b81243d9cace83efa02634751f2783bbc63b66af15286f45c60b7ed2a95fd93d1968b13b9153ea2bae2237cab46b59ccbe402e94e3c"}, &(0x7f0000000640)={0x0, 0xa, 0x1, 0xf}, &(0x7f0000000680)={0x0, 0x8, 0x1, 0x80}, &(0x7f00000006c0)={0x20, 0x81, 0x1, "fb"}, &(0x7f0000000700)={0x20, 0x82, 0x1, "b0"}, &(0x7f0000000740)={0x20, 0x83, 0x3, "d22413"}, &(0x7f0000000780)={0x20, 0x84, 0x3, "a7101a"}, &(0x7f00000007c0)={0x20, 0x85, 0x3, "9a1d6e"}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000880), 0x4000, 0x0) ioctl$KVM_GET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000900)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f00000008c0)=0x3ff}) socket$nl_route(0x10, 0x3, 0x0) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e) modify_ldt$read_default(0x2, &(0x7f0000000940)=""/76, 0x4c) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f00000009c0)) write$UHID_INPUT2(r2, &(0x7f0000000a00)={0xc, {0xb5, "4cd9d9613d8f26b173ca8a9c7e91976c318c453a597641f8bf3deaa680ee1b598da331cf8fed1bacb9b3dafbb6b03edcaf1986d9b3ebb8a310700266f21a507c8e033271214dd144496c82ffd5fc19d4c699075c309ff4033977a42ae1b976af362252f607c939593a5745ce558759d17bdcabd50f165c8c60fc5b067c14e7c9e8f11aa0d9465958f79c1944c3d515fdb1860d289ce2fd88d92d5643e587ed9ee93ef7c7570336ea40f6f128a8cc613c3cc37cd140"}}, 0xbb) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b00), r2) sendmsg$NL80211_CMD_LEAVE_MESH(r2, &(0x7f0000000bc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0xa0000020}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x20, r7, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xfff, 0x5f}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x4000001}, 0x20008814) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r6, 0x4008941a, &(0x7f0000000c00)) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000c40)={r5, 0x1, 0x6, @multicast}, 0x10) ioctl$LOOP_SET_FD(r2, 0x4c00, r6) socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$NFT_BATCH(r4, &(0x7f0000001040)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001000)={&(0x7f0000000cc0)={{0x14}, [@NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELOBJ={0x1c8, 0x14, 0xa, 0x700, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_USERDATA={0x85, 0x8, "5af64fce9d0d55f3c67fc5e40c8177339d532f1c968616f89104351726e7ffded99f05c700aeed2cefd8921aecc42f7cff12551f316d806d7af01e32de67b7b22a0b5675dbc77a808094e7999a6fc442f412a34ea6064996e942e5041c899aaadc6d65820b91e22e688db29ac9221126bfe849b3da0b99c8228ff1f3c86014ea70"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_USERDATA={0xf0, 0x8, "d35a57f6342f51266ffd43fbdfe048db811f95dd7066c21ada7d82318ab0ec4ef0f5524c51347d5a15189dba396c9b2e94509767f0bbf304ed582f3696277e3b721118f6988e8c8e7c85662a92ded25abcd91e3fc364f88f80a94b09dc39e43a906e062ff3e5bb3044abf3be857db15d926e47f2cf2071f158c72508c3123e076ab09e843cf4d7a8ca6499d84d6c64ce4a793f8aa08a1a5d8c783fa15e667254e964d01e7f5157207188f7ffab63a81e4b6bd4194e884d63ab777bc682986a7afe4c80548b4f54cd949301a08cce1c4bd2b79a5cf3f819fcc8347ba7ed89005b1dbb2995a2e0b9fb9c634cfe"}]}, @NFT_MSG_DELFLOWTABLE={0x54, 0x18, 0xa, 0x104, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWFLOWTABLE={0x34, 0x16, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x3ff}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x1c, 0x6, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELSETELEM={0x1c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x310}, 0x1, 0x0, 0x0, 0x4}, 0x40000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 491.057169ms ago: executing program 3 (id=73): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f00000006c0)='.\x00', 0xaa) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x300, 0x0, 0x3, 0x9, 0x3, 0xb}, 0x20) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mremap(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c0002, 0x0) write$vga_arbiter(r1, &(0x7f0000000100)=ANY=[@ANYBLOB='lock io'], 0xc) write$vga_arbiter(r1, &(0x7f0000000140)=@other={'unlock', ' ', 'io+mem'}, 0xe) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x20, 0x103) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101081, 0x30) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r2, 0x0, 0x20000000000002, 0xa) 427.735156ms ago: executing program 3 (id=74): r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) lseek(r0, 0xfffffffffffffffb, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, &(0x7f00000073c0)='wg1\x00', 0x4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000007400)={'wg1\x00', 0x0}) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000007440)={@local, @remote, r2}, 0xc) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000005240)={0x0, 0x0, &(0x7f0000007240)={&(0x7f0000009800)=ANY=[@ANYBLOB="400100001000010000000000fcdbdf250a01010100000000000000000000000000000000000000000000ffff0a01010200000000000000000000200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000033000000fc0100000000000000000000000000010000000000000000000000020000fade0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000066000000000000004800010073686132353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800160006000000"], 0x140}}, 0x48010) r4 = openat(0xffffffffffffff9c, &(0x7f0000000d80)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r4, &(0x7f0000000400)=ANY=[@ANYBLOB="7f454c4607fc3a06010001000000000002003e0007000000bb010000000000004000000000000000dd0100000000000013000000fcff380001000300330300000300000000000000040000000000000000000000010000000300000000000000ec0000000000000004000000000000000300000000000000ff437f0700000030638fb3577cd1e20bc5a34bc55ffc1e4d1e4716570b6efc8ee18c3819bd81b20b0000000000000000663b055ad0184348de18bd7eb6fc372aaae8a0495429be42a6661c2996097a2adc4834fc1b1adcb080daa1c6ee51f2a91a33bf8244ff9466fc6d51b199f803f66f408b3f14f48186"], 0x21b) (async) close(r4) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000007480)='./proc\x00', 0x1ff) (async) mount(0x0, &(0x7f00000074c0)='./proc\x00', &(0x7f0000007500)='proc\x00', 0x4000, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000007540)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r8, &(0x7f0000007580)='100', 0x3) (async) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f00000075c0), 0x0, 0x0) (async) r10 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r10, 0x6, 0xe, &(0x7f0000007600)={@in={{0x2, 0x0, @private=0xa010100}}, 0x0, 0x0, 0x22, 0x0, "70a59b8ef73b52114bf0854b6d184de8fb2add2d2bb9149a8c9b8ad1ff7568565a98f80146847b0c6c4698efb8d42bed462e33eef5219090f01c40a3103cf5a30f2c0cdc339b7665ca4fe3c1d75e3fda"}, 0xd8) (async) ioctl$UI_DEV_SETUP(r9, 0x405c5503, &(0x7f0000007700)={{0x0, 0x3}, 'syz1\x00', 0x33}) (async) ioctl$UI_DEV_CREATE(r9, 0x5501) r11 = openat$procfs(0xffffffffffffff9c, &(0x7f0000007780)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r11, &(0x7f00000077c0)={0x2020}, 0x2020) (async) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x40000081, 0x0, 0xffffffffffffffff}]}) (async) r12 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c0102, 0x0) write$vga_arbiter(r12, &(0x7f00000006c0)=ANY=[@ANYBLOB='lock i'], 0xc) recvmmsg(r4, &(0x7f0000006ec0)=[{{&(0x7f00000000c0)=@pptp={0x18, 0x2, {0x0, @remote}}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000140)=""/121, 0x79}, {&(0x7f00000001c0)=""/38, 0x26}, {&(0x7f0000000200)=""/161, 0xa1}, {&(0x7f00000002c0)=""/159, 0x9f}, {&(0x7f0000000500)=""/133, 0x85}, {&(0x7f00000005c0)=""/194, 0xc2}, {&(0x7f00000006c0)}, {&(0x7f0000000700)=""/160, 0xa0}, {&(0x7f00000007c0)=""/238, 0xee}], 0x9, &(0x7f0000000980)=""/111, 0x6f}, 0xa6f}, {{&(0x7f0000000a00)=@generic, 0x80, &(0x7f0000000d40)=[{&(0x7f0000000a80)=""/198, 0xc6}, {&(0x7f0000000b80)=""/182, 0xb6}, {&(0x7f0000000c40)=""/242, 0xf2}], 0x3, &(0x7f0000000dc0)=""/238, 0xee}, 0x4}, {{&(0x7f0000000ec0)=@caif=@rfm, 0x80, &(0x7f0000001300)=[{&(0x7f0000000f80)=""/249, 0xf9}, {&(0x7f0000001080)=""/152, 0x98}, {&(0x7f0000001140)=""/239, 0xef}, {&(0x7f0000001240)=""/172, 0xac}], 0x4, &(0x7f0000001340)=""/159, 0x9f}, 0x5}, {{0x0, 0x0, &(0x7f00000025c0)=[{&(0x7f0000001400)=""/161, 0xa1}, {&(0x7f00000014c0)=""/4096, 0x1000}, {&(0x7f00000024c0)=""/110, 0x6e}, {&(0x7f0000002540)=""/104, 0x68}], 0x4, &(0x7f0000002600)=""/4096, 0x555}, 0xfff}, {{&(0x7f0000003600)=@l2tp={0x2, 0x0, @loopback}, 0x80, &(0x7f0000003780)=[{&(0x7f0000003680)=""/227, 0xe3}], 0x1, &(0x7f00000037c0)=""/74, 0x4a}, 0x7}, {{&(0x7f0000003840)=@generic, 0x80, &(0x7f0000004c40)=[{&(0x7f00000038c0)=""/240, 0xf0}, {&(0x7f00000039c0)=""/206, 0xce}, {&(0x7f0000003ac0)=""/9, 0x9}, {&(0x7f0000003b00)=""/93, 0x5d}, {&(0x7f0000003b80)=""/167, 0xa7}, {&(0x7f0000003c40)=""/4096, 0x1000}], 0x6}, 0x5}, {{&(0x7f0000004cc0)=@l2tp={0x2, 0x0, @multicast2}, 0x80, &(0x7f00000050c0)=[{&(0x7f0000004d40)=""/50, 0x32}, {&(0x7f0000004d80)=""/102, 0x66}, {&(0x7f0000004e00)=""/251, 0xfb}, {&(0x7f0000004f00)=""/153, 0x99}, {&(0x7f0000004fc0)=""/51, 0x33}, {&(0x7f0000005000)=""/174, 0xae}], 0x6, &(0x7f0000005140)=""/118, 0x76}, 0x6}, {{&(0x7f00000051c0)=@qipcrtr, 0x80, &(0x7f0000005240), 0x0, &(0x7f0000005280)=""/38, 0x26}, 0x6}, {{&(0x7f00000052c0)=@can, 0x80, &(0x7f0000005700)=[{&(0x7f0000005340)=""/78, 0x4e}, {&(0x7f00000053c0)=""/241, 0xf1}, {&(0x7f00000054c0)=""/44, 0x2c}, {&(0x7f0000005500)=""/110, 0x6e}, {&(0x7f0000005580)=""/200, 0xc8}, {&(0x7f0000005680)=""/65, 0x41}], 0x6}, 0x400}, {{&(0x7f0000005780)=@isdn, 0x80, &(0x7f0000006d00)=[{&(0x7f0000007180)=""/93, 0x59}, {&(0x7f0000005880)=""/252, 0xfc}, {&(0x7f0000005980)=""/89, 0x59}, {&(0x7f0000005a00)=""/118, 0x76}, {&(0x7f0000005a80)=""/235, 0xeb}, {&(0x7f0000005b80)=""/4096, 0x1000}, {&(0x7f0000006b80)=""/5, 0x5}, {&(0x7f0000006bc0)=""/112, 0x70}, {&(0x7f0000006c40)=""/86, 0x56}, {&(0x7f0000006cc0)=""/27, 0x1b}], 0xa, &(0x7f0000006dc0)=""/253, 0xfd}, 0xfffffff5}], 0xa, 0x10000, &(0x7f0000007140)) (async) fsopen(&(0x7f0000000380)='tracefs\x00', 0x0) 406.330588ms ago: executing program 3 (id=75): syz_usb_connect(0x5, 0x51, &(0x7f0000000100)=ANY=[@ANYBLOB="120101024cf1c50863070210845f0102030109023f00010000000009240002e9ff87e7000905880f020000000009050300000000000009050cfeffff0106050f0000000000000905073ec8a805e2f60000ac9a10941c8b49416ec5d9d97eeba03ebd63ecd5c162b67419ece5eae33a7fc399b1c4dd885ef25b55dfb061e8c6436dce6993c890bc9b4dff245ebb04d397a8b7ad48ed8b774b7780597053e319550a8a286fd24068e73641938d4ea534ee639cae2aff68986825bc565cb73c96529c17d43beeeef234480fe5d0224b10db7d06bf27cc0d7615f5b6336696ee02807b42255f0470ed2e0d2f80"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) 141.513416ms ago: executing program 2 (id=76): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000cc0)=ANY=[@ANYBLOB="12010000000000205f14120200000000000109022400010000600009040180020300000009210604000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000d00)={0x24, 0x0, 0x0, &(0x7f0000000d40)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000680)={0x2c, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="e302020040ac0203"], 0x0, 0x0, 0x0}, 0x0) 48.003285ms ago: executing program 0 (id=77): syz_ublk_setup_io_uring(0x1d, &(0x7f0000000080)={0x0, 0x30b5, 0x0, 0x3, 0x158}, 0x0, 0x0, 0x0) close(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x98) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000040)='10', 0x2) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000340)="fecdc656", 0x4) 44.853275ms ago: executing program 0 (id=78): inotify_init() (async) r0 = inotify_init() mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) (async) r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) userfaultfd(0x80001) (async) r2 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) (async) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000002, 0x9132, 0xffffffffffffffff, 0x9aa9b000) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000200)=0x0) quotactl_fd$Q_SETINFO(r2, 0xffffffff80000602, r3, &(0x7f0000000500)={0x8, 0x6, 0x0, 0x2}) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x408}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x440000, 0xbd) (async) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x440000, 0xbd) openat(r4, &(0x7f0000000040)='./file0\x00', 0x2, 0x19a) syz_memcpy_off$KVM_EXIT_MMIO(r1, 0x20, &(0x7f0000000100)="64be365de974de7ab149b947a8218d12625b0c29c0496e90", 0x0, 0x18) munmap(&(0x7f0000e5f000/0x1000)=nil, 0x1000) (async) munmap(&(0x7f0000e5f000/0x1000)=nil, 0x1000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x80000a, 0x31, 0xffffffffffffffff, 0xd0fb8000) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r8, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, &(0x7f0000000280)={0x1, 0x0, [{0x4, 0xfffffffffffffdb8, &(0x7f0000000300)=""/179}, {0xd000, 0x0, &(0x7f00000003c0)=""/204}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r8, 0x4004af61, &(0x7f00000004c0)=0x1) setns(r7, 0x24020000) mount(0x0, 0x0, 0x0, 0x0, 0x0) (async) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/mtrr\x00', 0x20002, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) 31.559957ms ago: executing program 1 (id=79): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x181242, 0x148) pwrite64(r0, &(0x7f0000000080)='2', 0xfdef, 0xfecc) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305839, &(0x7f00000000c0)={0xc, r0, 0x1f, 0x20010009, 0xfffffffffffffffd, 0x4}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000002400), 0x240202, 0x0) close(r1) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002440), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r1, 0x80047441, &(0x7f0000002480)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x8e355000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x200, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = fsopen(&(0x7f00000023c0)='binfmt_misc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x8, 0x0, 0x0, 0x0) r6 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000180)={0x2ce, 0x0, 0x4, r6, 0x11}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f00000001c0)={0x27800000002, 0x0, 0x4, r6, 0x1}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0xae03, 0x42) lseek(r0, 0x73, 0x4) pipe(&(0x7f0000000200)={0xffffffffffffffff}) read$FUSE(r8, &(0x7f0000000240)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) getpriority(0x2, r9) waitid(0x2, r9, &(0x7f0000002280), 0x20000000, &(0x7f0000002300)) openat$binderfs_log(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder_logs/stats\x00', 0x0, 0x0) 0s ago: executing program 0 (id=80): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0xb007}, 0x4) (async) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'ip6_vti0\x00', 0x0}) delete_module(&(0x7f0000000000)='^/*:@(){\x00', 0x200) sendto$packet(r0, &(0x7f0000000140)="10031200e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f00000001c0)={0x11, 0x0, r2}, 0x14) 0s ago: executing program 0 (id=81): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f00000000c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000640)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x8200, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}}}) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f0000000480)={0x4, 0x0, 0x0, 0x188, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r2}, [@snapshot={0x0, 0xc88, 0x0, 0x50, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'PO', 0x20, '128'}}]}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind$802154_raw(r3, &(0x7f0000000240)={0x24, @short={0x2, 0xffff, 0xffff}}, 0x14) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x100000000001f, 0x0, 0x0) quotactl$Q_QUOTAOFF(0x0, &(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, 0xee00, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000300)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x100000, 0x0, 0x0, {0x0, {'syz', 0x0, '3\x00'}}}) r6 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000440), 0x8c00, 0x0) ioctl$DM_TABLE_LOAD(r6, 0xc138fd09, &(0x7f00000008c0)={0x4, 0x0, 0x0, 0x1a8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r5}, [@striped={0x0, 0x2400, 0x0, 0x70, 'striped\x00', {0x3, 0x20, '7', [{0x20, {@ram={'/dev/ram', 0x0}, 0x20, '1'}}, {0x20, {@rnull={'/dev/syzrnull', 0x0}, 0x20, '16'}}, {0x20, {@ram={'/dev/ram', 0x0}, 0x20, '8191'}}]}}]}) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r6) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 19.673992][ T36] kauditd_printk_skb: 47 callbacks suppressed [ 19.674010][ T36] audit: type=1400 audit(1793544601.540:59): avc: denied { transition } for pid=232 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 19.705917][ T36] audit: type=1400 audit(1793544601.540:60): avc: denied { noatsecure } for pid=232 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 19.726458][ T36] audit: type=1400 audit(1793544601.550:61): avc: denied { write } for pid=232 comm="sh" path="pipe:[2902]" dev="pipefs" ino=2902 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 19.749116][ T36] audit: type=1400 audit(1793544601.550:62): avc: denied { rlimitinh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 19.778309][ T36] audit: type=1400 audit(1793544601.550:63): avc: denied { siginh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.211' (ED25519) to the list of known hosts. [ 28.106598][ T36] audit: type=1400 audit(1793544609.970:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.110887][ T286] cgroup: Unknown subsys name 'net' [ 28.135127][ T36] audit: type=1400 audit(1793544609.970:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.163728][ T36] audit: type=1400 audit(1793544610.000:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.164288][ T286] cgroup: Unknown subsys name 'devices' [ 28.276541][ T286] cgroup: Unknown subsys name 'hugetlb' [ 28.282658][ T286] cgroup: Unknown subsys name 'rlimit' [ 28.388757][ T36] audit: type=1400 audit(1793544610.250:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.413444][ T36] audit: type=1400 audit(1793544610.250:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.442807][ T36] audit: type=1400 audit(1793544610.250:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 28.482556][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.494789][ T36] audit: type=1400 audit(1793544610.360:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 28.526386][ T36] audit: type=1400 audit(1793544610.360:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.557398][ T36] audit: type=1400 audit(1793544610.420:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.559491][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.587867][ T36] audit: type=1400 audit(1793544610.420:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.572787][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.582048][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.589749][ T294] bridge_slave_0: entered allmulticast mode [ 29.596565][ T294] bridge_slave_0: entered promiscuous mode [ 29.616672][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.624873][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.632411][ T294] bridge_slave_1: entered allmulticast mode [ 29.639551][ T294] bridge_slave_1: entered promiscuous mode [ 29.690120][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.698663][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.706750][ T293] bridge_slave_0: entered allmulticast mode [ 29.713519][ T293] bridge_slave_0: entered promiscuous mode [ 29.725001][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.733969][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.741742][ T293] bridge_slave_1: entered allmulticast mode [ 29.749625][ T293] bridge_slave_1: entered promiscuous mode [ 29.776570][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.784375][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.793587][ T296] bridge_slave_0: entered allmulticast mode [ 29.802030][ T296] bridge_slave_0: entered promiscuous mode [ 29.811147][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.819304][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.827326][ T296] bridge_slave_1: entered allmulticast mode [ 29.834195][ T296] bridge_slave_1: entered promiscuous mode [ 29.845012][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.854769][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.863739][ T295] bridge_slave_0: entered allmulticast mode [ 29.871362][ T295] bridge_slave_0: entered promiscuous mode [ 29.882696][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.890932][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.899884][ T295] bridge_slave_1: entered allmulticast mode [ 29.908642][ T295] bridge_slave_1: entered promiscuous mode [ 30.080012][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.087940][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.097752][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.106421][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.119797][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.127670][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.136034][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.143122][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.190108][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.197273][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.205212][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.213541][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.225089][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.234661][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.243557][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.252267][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.296043][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.304383][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.313156][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.323145][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.334004][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.341687][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.350682][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.360490][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.379761][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.387602][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.397295][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.405276][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.425558][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.435866][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.454802][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.462159][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.472361][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.480461][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.492413][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.500404][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.545552][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.552977][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.566616][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.573913][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.620442][ T294] veth0_vlan: entered promiscuous mode [ 30.640892][ T295] veth0_vlan: entered promiscuous mode [ 30.651007][ T296] veth0_vlan: entered promiscuous mode [ 30.659361][ T293] veth0_vlan: entered promiscuous mode [ 30.673020][ T295] veth1_macvtap: entered promiscuous mode [ 30.697009][ T294] veth1_macvtap: entered promiscuous mode [ 30.709441][ T293] veth1_macvtap: entered promiscuous mode [ 30.729891][ T296] veth1_macvtap: entered promiscuous mode [ 30.777554][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.842383][ T317] WARNING! power/level is deprecated; use power/control instead [ 30.851706][ T318] capability: warning: `syz.2.3' uses deprecated v2 capabilities in a way that may be insecure [ 30.890637][ T326] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.093528][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 31.143882][ T72] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.163541][ T311] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 31.253488][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 31.259259][ T9] usb 4-1: too many configurations: 112, using maximum allowed: 8 [ 31.276463][ T9] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 31.286120][ T9] usb 4-1: New USB device strings: Mfr=144, Product=246, SerialNumber=0 [ 31.294918][ T311] usb 2-1: device descriptor read/64, error -71 [ 31.303811][ T9] usb 4-1: Product: syz [ 31.308527][ T9] usb 4-1: Manufacturer: syz [ 31.315378][ T72] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 31.326207][ T72] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 31.337024][ T72] usb 1-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 31.350932][ T72] usb 1-1: New USB device found, idVendor=1bc3, idProduct=0003, bcdDevice= 1.00 [ 31.360480][ T72] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.369064][ T9] r8152-cfgselector 4-1: Unknown version 0x0000 [ 31.376124][ T9] r8152-cfgselector 4-1: config 0 descriptor?? [ 31.385832][ T313] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 31.394811][ T72] usblp: can't set desired altsetting 0 on interface 0 [ 31.533596][ T311] usb 2-1: device descriptor read/64, error -71 [ 31.590696][ T9] r8152-cfgselector 4-1: bad CDC descriptors [ 31.598947][ T9] r8152-cfgselector 4-1: USB disconnect, device number 2 [ 31.612648][ T313] UDC core: g1: couldn't find an available UDC or it's busy [ 31.627258][ T72] usb 1-1: USB disconnect, device number 2 [ 31.745309][ T336] netlink: 9 bytes leftover after parsing attributes in process `syz.2.8'. [ 31.755138][ T336] z00ªX¹¦: renamed from gretap0 (while UP) [ 31.761869][ T336] z00ªX¹¦: entered allmulticast mode [ 31.773642][ T311] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 31.816555][ T339] netlink: 'syz.2.9': attribute type 7 has an invalid length. [ 31.824835][ T339] netlink: 'syz.2.9': attribute type 5 has an invalid length. [ 31.833184][ T339] netlink: 17 bytes leftover after parsing attributes in process `syz.2.9'. [ 31.903503][ T311] usb 2-1: device descriptor read/64, error -71 [ 32.143942][ T311] usb 2-1: device descriptor read/64, error -71 [ 32.180349][ T362] tap0: tun_chr_ioctl cmd 1074025677 [ 32.187351][ T362] tap0: linktype set to 780 [ 32.265023][ T311] usb usb2-port1: attempt power cycle [ 32.310385][ T378] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 32.420370][ T384] netlink: 28 bytes leftover after parsing attributes in process `syz.0.19'. [ 32.517448][ T388] netlink: 'syz.0.21': attribute type 58 has an invalid length. [ 32.603490][ T311] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 32.634742][ T311] usb 2-1: device descriptor read/8, error -71 [ 32.762599][ T403] rust_binder: 402:403 BC_REQUEST_FREEZE_NOTIFICATION invalid ref 2 [ 32.766465][ T311] usb 2-1: device descriptor read/8, error -71 [ 32.775276][ T403] rust_binder: Write failure EINVAL in pid:37 [ 32.996479][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 33.014053][ T311] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 33.054641][ T311] usb 2-1: device descriptor read/8, error -71 [ 33.164497][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.180102][ T36] kauditd_printk_skb: 100 callbacks suppressed [ 33.180123][ T36] audit: type=1400 audit(1793544615.040:174): avc: denied { ioctl } for pid=418 comm="syz.0.39" path="socket:[3922]" dev="sockfs" ino=3922 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.186758][ T311] usb 2-1: device descriptor read/8, error -71 [ 33.223707][ T9] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 33.243436][ T9] usb 3-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 33.261791][ T421] netlink: 316 bytes leftover after parsing attributes in process `syz.3.31'. [ 33.272695][ T9] usb 3-1: New USB device found, idVendor=1bc3, idProduct=0003, bcdDevice= 1.00 [ 33.282232][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.292905][ T421] capability: warning: `syz.3.31' uses 32-bit capabilities (legacy support in use) [ 33.303542][ T36] audit: type=1400 audit(1793544615.160:175): avc: denied { read } for pid=422 comm="syz.0.33" name="usbmon0" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 33.330320][ T421] netlink: 316 bytes leftover after parsing attributes in process `syz.3.31'. [ 33.351630][ T36] audit: type=1400 audit(1793544615.160:176): avc: denied { open } for pid=422 comm="syz.0.33" path="/dev/usbmon0" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 33.353724][ T400] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 33.376272][ T311] usb usb2-port1: unable to enumerate USB device [ 33.396324][ T36] audit: type=1400 audit(1793544615.250:177): avc: denied { append } for pid=420 comm="syz.3.31" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.402152][ T9] usblp: can't set desired altsetting 0 on interface 0 [ 33.438662][ T36] audit: type=1400 audit(1793544615.250:178): avc: denied { ioctl } for pid=420 comm="syz.3.31" path="/dev/rtc0" dev="devtmpfs" ino=195 ioctlcmd=0x7006 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.481366][ T36] audit: type=1400 audit(1793544615.250:179): avc: denied { unlink } for pid=420 comm="syz.3.31" name="#1" dev="tmpfs" ino=39 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 33.504216][ T36] audit: type=1400 audit(1793544615.250:181): avc: denied { mount } for pid=420 comm="syz.3.31" name="/" dev="overlay" ino=35 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.546178][ T36] audit: type=1400 audit(1793544615.250:180): avc: denied { ioctl } for pid=422 comm="syz.0.33" path="/dev/usbmon0" dev="devtmpfs" ino=87 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 33.582687][ T36] audit: type=1400 audit(1793544615.290:182): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.603865][ T36] audit: type=1400 audit(1793544615.330:183): avc: denied { append } for pid=426 comm="syz.3.34" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 33.650135][ T31] usb 3-1: USB disconnect, device number 2 [ 33.813549][ T311] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 33.877328][ T438] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=513 sclass=netlink_route_socket pid=438 comm=syz.0.38 [ 33.890146][ T406] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 33.898325][ T438] netlink: 80 bytes leftover after parsing attributes in process `syz.0.38'. [ 33.975285][ T311] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 33.990702][ T311] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 34.003632][ T311] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 34.015073][ T311] usb 4-1: New USB device found, idVendor=0e41, idProduct=5058, bcdDevice= 0.40 [ 34.025055][ T311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.039685][ T311] usb 4-1: Product: syz [ 34.044835][ T311] usb 4-1: Manufacturer: syz [ 34.049925][ T311] usb 4-1: SerialNumber: syz [ 34.056703][ T427] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 34.078929][ T406] usb 1-1: Dual-Role OTG device on HNP port [ 34.089802][ T406] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.12 [ 34.099597][ T406] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.123807][ T446] netlink: 8 bytes leftover after parsing attributes in process `syz.1.42'. [ 34.178695][ T449] netlink: 'syz.2.43': attribute type 13 has an invalid length. [ 34.279893][ T427] incfs: Backing dir is not set, filesystem can't be mounted. [ 34.287956][ T427] incfs: mount failed -2 [ 34.302092][ T311] usb 4-1: MIDIStreaming interface descriptor not found [ 34.325921][ T311] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -12 [ 34.359480][ T457] netlink: 'syz.1.45': attribute type 10 has an invalid length. [ 34.367644][ T311] usb 4-1: USB disconnect, device number 3 [ 34.412503][ T321] udevd[321]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card2/controlC2/../uevent} for writing: No such file or directory [ 34.954775][ T499] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=47 sclass=netlink_route_socket pid=499 comm=syz.3.54 [ 35.230487][ T520] mmap: syz.0.60 (520) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 35.254344][ T324] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 35.396073][ T527] FAULT_INJECTION: forcing a failure. [ 35.396073][ T527] name failslab, interval 1, probability 0, space 0, times 1 [ 35.403645][ T324] usb 4-1: Using ep0 maxpacket: 8 [ 35.409841][ T527] CPU: 1 UID: 0 PID: 527 Comm: syz.0.63 Not tainted syzkaller #0 1736d3b6ee88961c9d73e511fbf4428dbce80e3d [ 35.409928][ T527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 35.409987][ T527] Call Trace: [ 35.410009][ T527] [ 35.410033][ T527] __dump_stack+0x21/0x30 [ 35.410097][ T527] dump_stack_lvl+0x140/0x1c0 [ 35.410155][ T527] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.410221][ T527] ? __cfi_do_futex+0x10/0x10 [ 35.410284][ T527] ? kmem_cache_free+0x1bd/0x4f0 [ 35.410377][ T527] dump_stack+0x19/0x20 [ 35.410422][ T527] should_fail_ex+0x3c2/0x510 [ 35.410512][ T527] should_failslab+0xac/0x100 [ 35.410568][ T527] __kmalloc_cache_noprof+0x41/0x470 [ 35.410654][ T527] ? do_epoll_create+0x85/0x3f0 [ 35.410726][ T527] do_epoll_create+0x85/0x3f0 [ 35.410798][ T527] __x64_sys_epoll_create1+0x3b/0x50 [ 35.410854][ T527] x64_sys_call+0x1761/0x2ee0 [ 35.410917][ T527] do_syscall_64+0x57/0xf0 [ 35.410970][ T527] ? clear_bhb_loop+0x50/0xa0 [ 35.411066][ T527] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.411145][ T527] RIP: 0033:0x7fe2c799f559 [ 35.411199][ T527] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.411251][ T527] RSP: 002b:00007fe2c88e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000123 [ 35.411331][ T527] RAX: ffffffffffffffda RBX: 00007fe2c7c25fa0 RCX: 00007fe2c799f559 [ 35.411374][ T527] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 35.411407][ T527] RBP: 00007fe2c7a36b50 R08: 0000000000000000 R09: 0000000000000000 [ 35.411447][ T527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.411487][ T527] R13: 00007fe2c7c26038 R14: 00007fe2c7c25fa0 R15: 00007fff751d3a18 [ 35.411539][ T527] [ 35.605126][ T324] usb 4-1: unable to get BOS descriptor or descriptor too short [ 35.614423][ T324] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 35.625581][ T324] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 35.635840][ T324] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 35.645974][ T324] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 35.657243][ T324] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 35.667713][ T324] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 35.677623][ T324] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 35.687522][ T324] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 35.703708][ T324] usb 4-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 35.713115][ T324] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.721820][ T324] usb 4-1: Product: syz [ 35.726318][ T324] usb 4-1: Manufacturer: syz [ 35.731414][ T324] usb 4-1: SerialNumber: syz [ 35.744197][ T324] usb 4-1: config 0 descriptor?? [ 35.755881][ T507] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 35.771360][ T324] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 35.805240][ T539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.816868][ T539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.827167][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card2/controlC2/../uevent} for writing: No such file or directory [ 35.970863][ T507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.981573][ T507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.990685][ T324] usb 4-1: USB disconnect, device number 4 [ 36.033458][ T406] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 36.099670][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.110387][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.121679][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.131385][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.140922][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.150015][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.159234][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.168880][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.178779][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.188087][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.195749][ T406] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.197504][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.209325][ T406] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.218256][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.230017][ T406] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 36.237817][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.247678][ T406] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.257909][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.274133][ T406] usb 2-1: config 0 descriptor?? [ 36.275503][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.289194][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.298312][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.307875][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.317023][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.326342][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.349124][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.358544][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.367926][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.377306][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.386658][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.396306][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.405763][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.415469][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.424601][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.435597][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.445532][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.454900][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.465350][ T554] usb usb5: usbfs: process 554 (syz.0.71) did not claim interface 0 before use [ 36.482933][ T406] usbhid 2-1:0.0: can't add hid device: -71 [ 36.489145][ T406] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 36.499000][ T406] usb 2-1: USB disconnect, device number 6 [ 36.558370][ T563] netlink: 80 bytes leftover after parsing attributes in process `syz.3.74'. [ 36.863501][ T311] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 37.013426][ T311] usb 4-1: Using ep0 maxpacket: 8 [ 37.033000][ T311] usb 4-1: unable to get BOS descriptor or descriptor too short [ 37.043017][ T311] usb 4-1: config 0 has an invalid descriptor of length 246, skipping remainder of the config [ 37.054918][ T311] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 37.066263][ T581] IPv4: Oversized IP packet from 127.202.26.0 [ 37.073848][ T311] usb 4-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 37.083084][ T311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.098719][ T311] usb 4-1: Product: syz [ 37.103049][ T311] usb 4-1: Manufacturer: syz [ 37.111409][ T311] usb 4-1: SerialNumber: syz [ 37.123029][ T311] usb 4-1: config 0 descriptor?? [ 37.125248][ T9] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 37.145598][ T584] ================================================================== [ 37.153917][ T584] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 37.161692][ T584] Read of size 8 at addr ffff888113283098 by task syz.0.81/584 [ 37.169555][ T584] [ 37.171917][ T584] CPU: 1 UID: 0 PID: 584 Comm: syz.0.81 Not tainted syzkaller #0 1736d3b6ee88961c9d73e511fbf4428dbce80e3d [ 37.171952][ T584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 37.171968][ T584] Call Trace: [ 37.171976][ T584] [ 37.171985][ T584] __dump_stack+0x21/0x30 [ 37.172013][ T584] dump_stack_lvl+0x140/0x1c0 [ 37.172034][ T584] ? __cfi_dump_stack_lvl+0x10/0x10 [ 37.172057][ T584] ? __cfi__printk+0x10/0x10 [ 37.172091][ T584] print_address_description+0x71/0x210 [ 37.172130][ T584] print_report+0x4a/0x70 [ 37.172165][ T584] kasan_report+0x162/0x1a0 [ 37.172188][ T584] ? snapshot_ctr+0x586/0x1350 [ 37.172214][ T584] ? snapshot_ctr+0x586/0x1350 [ 37.172238][ T584] __asan_report_load8_noabort+0x18/0x20 [ 37.172272][ T584] snapshot_ctr+0x586/0x1350 [ 37.172297][ T584] ? dm_split_args+0xa1/0x740 [ 37.172333][ T584] ? __cfi_snapshot_ctr+0x10/0x10 [ 37.172357][ T584] ? dm_split_args+0x5d0/0x740 [ 37.172393][ T584] dm_table_add_target+0x59c/0xcb0 [ 37.172431][ T584] table_load+0x2eb/0x7d0 [ 37.172461][ T584] ? __check_object_size+0x99/0x870 [ 37.172495][ T584] ? __cfi_table_load+0x10/0x10 [ 37.172527][ T584] ? __kasan_check_write+0x18/0x20 [ 37.172567][ T584] ? __cfi_table_load+0x10/0x10 [ 37.172598][ T584] dm_ctl_ioctl+0x8f3/0xde0 [ 37.172630][ T584] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 37.172665][ T584] ? __fget_files+0x2bc/0x330 [ 37.172689][ T584] ? bpf_lsm_file_ioctl+0xd/0x20 [ 37.172713][ T584] ? security_file_ioctl+0x3e/0x110 [ 37.172747][ T584] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 37.172776][ T584] __se_sys_ioctl+0x126/0x1b0 [ 37.172800][ T584] __x64_sys_ioctl+0x7f/0xa0 [ 37.172823][ T584] x64_sys_call+0x1878/0x2ee0 [ 37.172848][ T584] do_syscall_64+0x57/0xf0 [ 37.172869][ T584] ? clear_bhb_loop+0x50/0xa0 [ 37.172900][ T584] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.172929][ T584] RIP: 0033:0x7fe2c799f559 [ 37.172949][ T584] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.172968][ T584] RSP: 002b:00007fe2c88e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 37.172993][ T584] RAX: ffffffffffffffda RBX: 00007fe2c7c25fa0 RCX: 00007fe2c799f559 [ 37.173011][ T584] RDX: 0000200000000480 RSI: 00000000c138fd09 RDI: 0000000000000004 [ 37.173027][ T584] RBP: 00007fe2c7a36b50 R08: 0000000000000000 R09: 0000000000000000 [ 37.173044][ T584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.173058][ T584] R13: 00007fe2c7c26038 R14: 00007fe2c7c25fa0 R15: 00007fff751d3a18 [ 37.173078][ T584] [ 37.173086][ T584] [ 37.295280][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 37.298976][ T584] Allocated by task 584: [ 37.298993][ T584] kasan_save_track+0x3e/0x80 [ 37.461378][ T584] kasan_save_alloc_info+0x3a/0x50 [ 37.467160][ T584] __kasan_kmalloc+0x96/0xb0 [ 37.471901][ T584] __kmalloc_cache_node_noprof+0x225/0x430 [ 37.478297][ T584] dm_get_table_device+0x1e3/0x6c0 [ 37.483464][ T584] dm_get_device+0x32b/0x7f0 [ 37.488107][ T584] snapshot_ctr+0x292/0x1350 [ 37.494642][ T584] dm_table_add_target+0x59c/0xcb0 [ 37.500603][ T584] table_load+0x2eb/0x7d0 [ 37.505110][ T584] dm_ctl_ioctl+0x8f3/0xde0 [ 37.509676][ T584] __se_sys_ioctl+0x126/0x1b0 [ 37.515966][ T584] __x64_sys_ioctl+0x7f/0xa0 [ 37.520612][ T584] x64_sys_call+0x1878/0x2ee0 [ 37.525792][ T584] do_syscall_64+0x57/0xf0 [ 37.531400][ T584] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.538411][ T584] [ 37.540769][ T584] Freed by task 584: [ 37.545406][ T584] kasan_save_track+0x3e/0x80 [ 37.550219][ T584] kasan_save_free_info+0x44/0x50 [ 37.555336][ T584] __kasan_slab_free+0x5f/0x80 [ 37.560248][ T584] kfree+0x158/0x440 [ 37.564651][ T584] dm_put_table_device+0x298/0x2e0 [ 37.569886][ T584] dm_get_device+0x571/0x7f0 [ 37.574597][ T584] snapshot_ctr+0x435/0x1350 [ 37.579579][ T584] dm_table_add_target+0x59c/0xcb0 [ 37.584789][ T584] table_load+0x2eb/0x7d0 [ 37.589169][ T584] dm_ctl_ioctl+0x8f3/0xde0 [ 37.594106][ T584] __se_sys_ioctl+0x126/0x1b0 [ 37.599361][ T584] __x64_sys_ioctl+0x7f/0xa0 [ 37.605141][ T584] x64_sys_call+0x1878/0x2ee0 [ 37.609954][ T584] do_syscall_64+0x57/0xf0 [ 37.614682][ T584] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 37.620909][ T584] [ 37.623367][ T584] The buggy address belongs to the object at ffff888113283080 [ 37.623367][ T584] which belongs to the cache kmalloc-96 of size 96 [ 37.639723][ T584] The buggy address is located 24 bytes inside of [ 37.639723][ T584] freed 96-byte region [ffff888113283080, ffff8881132830e0) [ 37.654358][ T584] [ 37.657029][ T584] The buggy address belongs to the physical page: [ 37.664278][ T584] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113283 [ 37.674984][ T584] flags: 0x4000000000000000(zone=1) [ 37.681056][ T584] page_type: f5(slab) [ 37.685231][ T584] raw: 4000000000000000 ffff888100041280 dead000000000122 0000000000000000 [ 37.694978][ T584] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 37.703767][ T584] page dumped because: kasan: bad access detected [ 37.711636][ T584] page_owner tracks the page as allocated [ 37.718724][ T584] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 34, tgid 34 (kdevtmpfs), ts 37122731500, free_ts 36120548918 [ 37.739656][ T584] post_alloc_hook+0x37d/0x3b0 [ 37.749354][ T584] prep_new_page+0x2d/0x180 [ 37.754069][ T584] get_page_from_freelist+0x4aea/0x4ba0 [ 37.760276][ T584] __alloc_pages_noprof+0x35a/0x7e0 [ 37.766091][ T584] alloc_slab_page+0x6b/0x1e0 [ 37.771323][ T584] allocate_slab+0x69/0x430 [ 37.775859][ T584] ___slab_alloc+0x591/0x8c0 [ 37.780881][ T584] __kmalloc_node_noprof+0x2e7/0x500 [ 37.787095][ T584] __kvmalloc_node_noprof+0x128/0x300 [ 37.792961][ T584] simple_xattr_alloc+0x67/0x140 [ 37.799050][ T584] shmem_initxattrs+0x24f/0x530 [ 37.804212][ T584] security_inode_init_security+0x434/0x600 [ 37.813359][ T584] shmem_mknod+0xd5/0x200 [ 37.818280][ T584] vfs_mknod+0x605/0x6d0 [ 37.822771][ T584] devtmpfs_work_loop+0x928/0xe30 [ 37.828101][ T584] devtmpfsd+0x52/0x60 [ 37.833254][ T584] page last free pid 20 tgid 20 stack trace: [ 37.840057][ T584] free_unref_page+0xb99/0xf50 [ 37.845058][ T584] __free_pages+0x6b/0x3b0 [ 37.851353][ T584] tlb_remove_table_rcu+0x2b2/0x3d0 [ 37.857401][ T584] rcu_do_batch+0x56a/0xcb0 [ 37.862336][ T584] rcu_nocb_cb_kthread+0x533/0xb60 [ 37.869236][ T584] kthread+0x2c7/0x360 [ 37.873352][ T584] ret_from_fork+0x64/0xa0 [ 37.877794][ T584] ret_from_fork_asm+0x1a/0x30 [ 37.882754][ T584] [ 37.885106][ T584] Memory state around the buggy address: [ 37.890747][ T584] ffff888113282f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.899259][ T584] ffff888113283000: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 37.907366][ T584] >ffff888113283080: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 37.915628][ T584] ^ [ 37.920582][ T584] ffff888113283100: 00 00 00 00 00 00 00 00 07 fc fc fc fc fc fc fc [ 37.928876][ T584] ffff888113283180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 37.937050][ T584] ================================================================== [ 37.945853][ T9] usb 3-1: config 0 has no interface number 0 [ 37.948941][ T584] Disabling lock debugging due to kernel taint [ 37.952159][ T9] usb 3-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 37.959045][ T584] device-mapper: table: 252:2: device 1:1 not in table devices list [ 37.979459][ T311] usb 4-1: USB disconnect, device number 5 [ 37.983567][ T9] usb 3-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.998586][ T9] usb 3-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 38.018186][ T588] device-mapper: ioctl: ioctl interface mismatch: kernel(4.48.0), user(0.0.0), cmd(3) [ 38.028547][ T584] device-mapper: table: 252:2: snapshot-merge: COW device cannot be the same as origin device (-EINVAL) [ 38.033626][ T9] usb 3-1: config 0 interface 1 has no altsetting 0 [ 38.044060][ T584] device-mapper: ioctl: error adding target to table [ 38.056764][ T584] device-mapper: table: 252:2: dm_table_destroy: dm_put_device call missing for 1:1 [ 38.063626][ T9] usb 3-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 38.090830][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.103792][ T9] usb 3-1: config 0 descriptor?? [ 38.712579][ T9] uclogic 0003:145F:0212.0001: failed retrieving string descriptor #100: -71 [ 38.723633][ T9] uclogic 0003:145F:0212.0001: failed retrieving pen parameters: -71 [ 38.735174][ T9] uclogic 0003:145F:0212.0001: pen probing failed: -71 [ 38.743137][ T9] uclogic 0003:145F:0212.0001: failed probing parameters: -71 [ 38.752822][ T9] uclogic 0003:145F:0212.0001: probe with driver uclogic failed with error -71 [ 38.765313][ T9] usb 3-1: USB disconnect, device number 3