last executing test programs: 19m21.657862205s ago: executing program 2 (id=820): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x0, 0x42, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000280)=0x5) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc3c0000000c0a01010000000f000000000a0000060900020073797a31000000000900010073797a3100000000100003800c000080080003400000000214000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSETELEM={0x3c, 0xe, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x64}, 0x1, 0x0, 0x0, 0x4044805}, 0x24008040) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000080)="441f08100000009837a0324d7df546bcb8e8c94efe76cef3e200000000", 0x1d) io_uring_setup(0x2f00, &(0x7f00000004c0)={0x0, 0xe8e2, 0x400, 0x20001, 0x2d6}) r5 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/ip_tables_targets\x00') pread64(r5, &(0x7f0000000080)=""/102356, 0x18fd4, 0x6) setsockopt$MRT_FLUSH(r5, 0x0, 0xd4, &(0x7f0000000040)=0x5, 0x4) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = socket$inet(0x2, 0xa, 0x0) sendmmsg$sock(r7, &(0x7f0000003280)=[{{&(0x7f0000000100)=@nl=@unspec, 0x12, 0x0}}], 0x1, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) sendmsg$inet(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x3000c041) 19m17.835606055s ago: executing program 2 (id=828): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x1}}, 0x24) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r3, 0x7}}, 0x48) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000100)=0x80000, r1, 0x0, 0x1, 0x4}}, 0x20) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040084) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x18, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b0000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000a700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x3, 0x8}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000005580)=""/102392, 0x18ff8) r9 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000036c0)=ANY=[@ANYBLOB="c0010000", @ANYRES16=r9, @ANYBLOB="010000000000000000000100000008000700000000001400020077673000000000000000000000000000900108802c0100801400040002004e207f0000010000000000000000e80009801c000080060001000200000008000200ac14143205000300000000007c000080060001000200000008000200640101020500030003000000060001000a00000014000200ff0200000000000000000000000000010500030003000000060001000200000008000200ac1414810500030003000000060001000a00000014000200ff0200000000000000000000000000010500030003000000f2fd0080060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000a00000014000216fe8000000000000000000000000000bb050003000100000024000100000000000000000000000000000000000000000000000000000000000000000006000500000000005c000080060005000800000008000a000101000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff240002"], 0x1c0}, 0x1, 0x0, 0x0, 0xc811}, 0x40000) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {0x5}}, './file0\x00'}) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000002c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0xfefffffd, @mcast2, 0x5}, r1}}, 0x30) syz_clone(0x4000000, &(0x7f0000000200)="0c7598979a5257e3f629655ba2617152a1e054717d86cb8f0eaca1c0de9c0c678ea7035dee3b85b0dd2a7adf43a85e7f84ff3acac0c18521e4be9fdaacd897feaff5583761469eaf30b72e9ef2f1c8de1a369a3ba13fca9f0bd742a1813bf6c7899d795851e4700fbf0e0ead9639a5a4c6e72ca39b554554", 0x78, &(0x7f0000000280), &(0x7f0000000300), &(0x7f0000000340)="ce3baaadb5ffa31088679df3") 19m16.881605588s ago: executing program 2 (id=830): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c0010800800014000000000d97405010000000008000240000000000800", @ANYRES64], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 19m16.157713455s ago: executing program 2 (id=833): connect$llc(0xffffffffffffffff, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) getsockname$llc(0xffffffffffffffff, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10) 19m13.777423238s ago: executing program 2 (id=837): pipe(&(0x7f0000000440)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f00000001c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setregs(0xd, r3, 0x0, 0x0) ptrace$getregset(0x4204, r3, 0x2, &(0x7f0000000740)={0x0}) r4 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x1) fchdir(r5) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(r6, 0x0, 0x2, &(0x7f0000000100)=0x7, 0x4) 19m12.228529558s ago: executing program 2 (id=840): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=ANY=[@ANYBLOB="2c0000003f00070dfeffffff00000000017c0000040077000c00038006000600801a0000080002"], 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0x4044000) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xf, 0xe}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x2, 0x80000000, 0x80, 0x9, 0x591c8d42, 0x9, 0x1, 0x200, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x40804) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b826, 0x25dfdc01, {0x0, 0x0, 0x0, r1, {0xfff3, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xf, 0x86, 0x1, 0x0, 0x1, 0x4, 0x2, 0x2}}, {0x8, 0x2, [0xb, 0x7ff]}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000080}, 0x2880) r3 = socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000380)={0x73622a85, 0x0, 0xffffffffffffffff}) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r11 = dup3(r10, 0xffffffffffffffff, 0x0) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r12, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r12, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x15, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r12, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="44000000180001002cbd7000000000000a1f000000ff02ff000004000008000401003fd724c8d89e3c3224e19d868467f734b38aa025fae939146a294cd60aad1592a34d1d1b09bf659cd2e3f39399181ee5160b5c58b7d9d1dead57cbb646da19f6e560f966f49013309894d965e69fa519236a1bfb853eeab6dc418949cac29d804058af1970a08da943baef8374e0b540d7ab40cc96134d581c8c699c4f73918e695423031e861da5471a3601940727d1adcea30000a512f5dad5c0f52975d8c43cbf1c8a33873a9e0a8a3cf03dd70d234891b3cf76c759a9f60000fe949e698ec6c3ebc6ca86a31032513d17fc98e51ee68f92d6b34dd201369aec631270a7244b75ec9dcbebb9d41537e46b35e301f27a6cf5306aacec220ea7a96334332087bb25420f82d9b7f4bc2007e0f8e0eec7db1702ca20c48f6ee3cbd1fdd7bb50c9f4d28bffb243cee75bb698a62cd273861fe535dc43f3920825c8d7c629defd1c9dfa2bc85d8f3b8370bcff3b568d09ce0ebfdc61ace6f1bb921eb61e1b10c0a0d94aa6ddf695319128799de68f996a364638c72dcc14b80c8d74b50a7404ad68546278779d8624e045caa4eb357f583179ec4dccab848a6c44e7b30700"/466, @ANYRES32=r7, @ANYBLOB="060015000300000018001680140001000200000000000000040004008030b900", @ANYRES64=r3], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=@getqdisc={0x40, 0x26, 0x20, 0x70bd28, 0xa5dfdbff, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0x8, 0x5}, {0x1, 0x10}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004011}, 0x40880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 18m57.061096316s ago: executing program 32 (id=840): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=ANY=[@ANYBLOB="2c0000003f00070dfeffffff00000000017c0000040077000c00038006000600801a0000080002"], 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0x4044000) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xf, 0xe}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x2, 0x80000000, 0x80, 0x9, 0x591c8d42, 0x9, 0x1, 0x200, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x40804) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b826, 0x25dfdc01, {0x0, 0x0, 0x0, r1, {0xfff3, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xf, 0x86, 0x1, 0x0, 0x1, 0x4, 0x2, 0x2}}, {0x8, 0x2, [0xb, 0x7ff]}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000080}, 0x2880) r3 = socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000380)={0x73622a85, 0x0, 0xffffffffffffffff}) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r11 = dup3(r10, 0xffffffffffffffff, 0x0) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r12, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r12, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x15, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r12, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="44000000180001002cbd7000000000000a1f000000ff02ff000004000008000401003fd724c8d89e3c3224e19d868467f734b38aa025fae939146a294cd60aad1592a34d1d1b09bf659cd2e3f39399181ee5160b5c58b7d9d1dead57cbb646da19f6e560f966f49013309894d965e69fa519236a1bfb853eeab6dc418949cac29d804058af1970a08da943baef8374e0b540d7ab40cc96134d581c8c699c4f73918e695423031e861da5471a3601940727d1adcea30000a512f5dad5c0f52975d8c43cbf1c8a33873a9e0a8a3cf03dd70d234891b3cf76c759a9f60000fe949e698ec6c3ebc6ca86a31032513d17fc98e51ee68f92d6b34dd201369aec631270a7244b75ec9dcbebb9d41537e46b35e301f27a6cf5306aacec220ea7a96334332087bb25420f82d9b7f4bc2007e0f8e0eec7db1702ca20c48f6ee3cbd1fdd7bb50c9f4d28bffb243cee75bb698a62cd273861fe535dc43f3920825c8d7c629defd1c9dfa2bc85d8f3b8370bcff3b568d09ce0ebfdc61ace6f1bb921eb61e1b10c0a0d94aa6ddf695319128799de68f996a364638c72dcc14b80c8d74b50a7404ad68546278779d8624e045caa4eb357f583179ec4dccab848a6c44e7b30700"/466, @ANYRES32=r7, @ANYBLOB="060015000300000018001680140001000200000000000000040004008030b900", @ANYRES64=r3], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=@getqdisc={0x40, 0x26, 0x20, 0x70bd28, 0xa5dfdbff, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0x8, 0x5}, {0x1, 0x10}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004011}, 0x40880) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 7m18.631138908s ago: executing program 1 (id=2495): socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)=0x0) getpgrp(r3) keyctl$instantiate(0xc, 0x0, 0x0, 0x2a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000000), &(0x7f0000000240)=0x4) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) symlink(0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002480)=@newtfilter={0x8ac, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x878, 0x2, [@TCA_U32_POLICE={0x850, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x7, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x807, 0x1000, 0xfff, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x8, 0x10000, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x8, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x80000000, 0x2, 0x6, 0x6, 0xaa, 0x0, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0x2f1e, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x1, 0xab, 0x9, 0x7, 0x0, 0xe, 0x10001, 0x8, 0xa, 0x6, 0x0, 0xa1, 0x7, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x10000, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74dc, 0x400000, 0xc, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x81, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x6, 0x5, 0x7, 0x4, 0x3, 0xff, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x5, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf8, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x80, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x3, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x2, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf49d, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x6, 0xc4, 0x9, 0x0, 0xee2, 0x4, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x4, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0x7, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x7, 0x81eb, 0x400, 0xffff, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x3, 0x9, 0x4, 0x3, 0x7, 0x0, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x10042b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xadd1}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x8ac}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) userfaultfd(0x80801) 7m13.106717889s ago: executing program 1 (id=2506): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x0, 0x42, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000280)=0x5) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc3c0000000c0a01010000000f000000000a0000060900020073797a31000000000900010073797a3100000000100003800c000080080003400000"], 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSETELEM={0x3c, 0xe, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x64}, 0x1, 0x0, 0x0, 0x4044805}, 0x24008040) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000080)="441f08100000009837a0324d7df546bcb8e8c94efe76cef3e200000000", 0x1d) io_uring_setup(0x2f00, &(0x7f00000004c0)={0x0, 0xe8e2, 0x400, 0x20001, 0x2d6}) r5 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/ip_tables_targets\x00') pread64(r5, &(0x7f0000000080)=""/102356, 0x18fd4, 0x6) setsockopt$MRT_FLUSH(r5, 0x0, 0xd4, &(0x7f0000000040)=0x5, 0x4) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = socket$inet(0x2, 0xa, 0x0) sendmmsg$sock(r7, &(0x7f0000003280)=[{{&(0x7f0000000100)=@nl=@unspec, 0x12, 0x0}}], 0x1, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) sendmsg$inet(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x3000c041) 7m10.364765591s ago: executing program 1 (id=2510): socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x1, 0x2) socket(0x40000000015, 0x4, 0x20000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x4088080, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) write(0xffffffffffffffff, 0x0, 0x0) socketpair(0x1d, 0x800, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) getpriority(0x2, r1) sendmsg$NL80211_CMD_RELOAD_REGDB(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r5, 0x421, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0xc35d4f6d52288271}, 0x200048c4) 7m8.698503597s ago: executing program 1 (id=2514): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001580)={0x2, 0x4, &(0x7f0000000240)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000001340)='GPL\x00'}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, &(0x7f0000001600), 0x4) connect$unix(r1, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r3, @ANYRESDEC, @ANYRESHEX=r0, @ANYRES8], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f000000e000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="440f78bdb20000003e64460f78b49d0060000065400f841b000000650fc77674dd0166baf80cb85cb2f38cefb800000000efc442a3f5f0c44105d3a100400000b9800000c00f3235000100000f3066baf80cb84a88638aef66bafc0cb017ee", 0x5f}], 0x1, 0x30, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0xf000}, {"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003548000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) ioctl$KVM_RUN(r7, 0xae80, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r4, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x2d8, 0x2d8, 0x138, 0x238, 0x238, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r8, 0x8b2c, &(0x7f0000000040)) socket$packet(0x11, 0x2, 0x300) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) r9 = semget$private(0x0, 0x7, 0x191) semtimedop(r9, &(0x7f0000000140)=[{0x0, 0x7, 0x800}], 0x1, 0x0) 7m7.123501906s ago: executing program 1 (id=2517): recvmmsg(0xffffffffffffffff, 0x0, 0xffffffffffffff7a, 0x40000001, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_int(r1, &(0x7f00000001c0)='cgroup.max.depth\x00', 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000019880)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=0xee01, @ANYRES32], 0xa0, 0x20000000}}], 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0x12) sendfile(r3, r2, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r8, &(0x7f0000000000)="2e000000010002", 0x7) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'syz_tun\x00'}) 7m5.405128795s ago: executing program 1 (id=2520): bind$inet(0xffffffffffffffff, &(0x7f00000006c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r0, &(0x7f0000000480), 0x400000000000179, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) socket$netlink(0x10, 0x3, 0x0) close(0xffffffffffffffff) socket$kcm(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b18, &(0x7f0000000000)={'wlan1\x00', @random="010000000700"}) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0) io_setup(0x8, &(0x7f00000001c0)=0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x1, 0x0) io_submit(r5, 0x0, &(0x7f0000000540)) openat$procfs(0xffffffffffffff9c, &(0x7f0000000900)='/proc/keys\x00', 0x0, 0x0) 6m49.835095058s ago: executing program 33 (id=2520): bind$inet(0xffffffffffffffff, &(0x7f00000006c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r0, &(0x7f0000000480), 0x400000000000179, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) socket$netlink(0x10, 0x3, 0x0) close(0xffffffffffffffff) socket$kcm(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b18, &(0x7f0000000000)={'wlan1\x00', @random="010000000700"}) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0) io_setup(0x8, &(0x7f00000001c0)=0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x1, 0x0) io_submit(r5, 0x0, &(0x7f0000000540)) openat$procfs(0xffffffffffffff9c, &(0x7f0000000900)='/proc/keys\x00', 0x0, 0x0) 4m9.172059245s ago: executing program 6 (id=2841): r0 = syz_open_dev$video(&(0x7f0000000040), 0x3ff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet(0xa, 0x801, 0x84) connect$inet(r3, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r3, 0xfffffffd) accept4(r3, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0xff00000000000000, 0x5, 0xfffffffffffffffd, 0x8001, 0x0, 0x1000001000, 0x45}, 0x0, &(0x7f0000000080)={0x3ff, 0x4, 0x100000, 0x9, 0x0, 0x10, 0x80000002}, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x1c, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa, 0x0, 0x9}, [@CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_TUPLE={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20048000}, 0x4008010) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0x1f4, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x80, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@multicast2, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x0, 0xfffffffffffffff8}, {0xcf, 0x3, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0xf6, 0x3, {{'deflate\x00'}, 0x570, "f9bd71297278f237b5f53646dbf7d8cd508a75ce5c5f3bfdb353621eccd96f31851e57a24925699f7a5269fe7b0b9c9845f4c067286173622078fd99056a0db82d22d4092bf7fa7a062b148c56f68ea0e15efc30342b491597b2065f7f4fa0761b574d6182769448b9a807263dedf095f5fa06a8711fd695e35f9d290fcc328540a2b6a8f98a569e08c88700d054b1a27ec131c3aef22dde8873867bc2fa26c80ac955fca6245df876538647c25b"}}, @mark={0xc, 0x15, {0x35075a, 0x3}}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@local, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@remote, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x9, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f0000000200)=0x1) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r8, 0x4018aebd, &(0x7f00000002c0)={0x400002}) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) 4m7.178278333s ago: executing program 6 (id=2846): socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) socket(0x40000000015, 0x4, 0x20000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x4088080, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) write(0xffffffffffffffff, 0x0, 0x0) socketpair(0x1d, 0x800, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) getpriority(0x2, r0) 4m6.373352136s ago: executing program 6 (id=2847): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x8d) close(r4) socket$vsock_stream(0x28, 0x1, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r5}}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) close_range(r1, 0xffffffffffffffff, 0x0) r7 = fsopen(&(0x7f0000000000)='exfat\x00', 0x0) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r8, 0x29, 0x4e, &(0x7f0000000380)=0x7fffffff, 0x4) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000080)='iocharset', &(0x7f00000000c0)='io#harset', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000080)='iocharset', &(0x7f00000000c0)='io#harset', 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=ANY=[@ANYBLOB="142000003e0007010300000000000000017c00000400428011000100686d61d31acb1b323234290100000000e81f02"], 0x2014}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) syz_usb_control_io$hid(r0, 0x0, 0x0) 4m3.23545443s ago: executing program 6 (id=2852): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x4008054) write$nci(r1, &(0x7f0000000340)=@NCI_GID_PROPRIETARY_NFT={0xf, 0x1, 0x3, 0x0, 0xb}, 0x3) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) r5 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r5, 0xc0606610, &(0x7f00000000c0)={0x60, 0x1, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x9, 0x0, 0x0, 0x6, 0x8, 0x48, 0x6d, 0x7e}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r6, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/155, 0x9b}], 0x1, &(0x7f0000000540)=[{&(0x7f0000001cc0)=""/116, 0x74}], 0x1, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) socket(0x1e, 0x4, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x5, &(0x7f0000000240)=ANY=[@ANYBLOB="1802000003000000000000000000000085000000a0000000850000005000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x0, 0xe, 0x0, &(0x7f00000000c0)="e02742e8680d85ff9782762f86dd", 0x0, 0xfffffff7, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x2042, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) 3m59.542552484s ago: executing program 6 (id=2858): symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x3, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) lstat(&(0x7f0000000240)='./file1\x00', &(0x7f0000000380)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff0000", @ANYRES32], 0x3c}}, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000810087406d040e0a759400000001090212000100000000090400200003"], 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000), 0x8300, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xc, &(0x7f0000000280)={0x200000000, 0xad7}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r2, 0x5, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 3m55.771255672s ago: executing program 6 (id=2863): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$sock_void(r0, 0x1, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x3, @loopback, 0x3}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000140)='nv', 0xffe8) 3m55.067791227s ago: executing program 34 (id=2863): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$sock_void(r0, 0x1, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x3, @loopback, 0x3}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000140)='nv', 0xffe8) 17.461428915s ago: executing program 0 (id=3267): bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="110000000400000004222f3529"], 0x48) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000000c0)="440f20c03507000000440f22c067420f8f04000000c443ad68b60080000095c4828947b600000000b99d090000b82f624a48baf4e055500f30263636f3430fc73636f2360fa5a10050aa37f39066b817018ec8c4c1795a5100", 0x59}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ac0), r2) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140), r2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfc409000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x8004881, 0x0, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r7 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@assoc={0x18, 0x117, 0x4, 0x10}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x40040}], 0x1, 0x8040) 15.333142866s ago: executing program 3 (id=3269): set_mempolicy(0x3, &(0x7f00000000c0)=0x3, 0x5) syz_io_uring_setup(0x258e, &(0x7f0000000040)={0x0, 0xcc6, 0x1000, 0x0, 0x3a7}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={0x0, 0x0, 0x3d, 0x0, 0x1}, 0x28) socket$kcm(0x11, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000000), 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r4, &(0x7f0000000280)=[{0x6, 0x6, 0x0, 0x0, @tick=0x4, {0x5}, {0x4, 0xa}, @result={0x9, 0x1}}, {0x0, 0x0, 0x0, 0xa, @tick=0x5, {0x80}, {0x5}, @result={0x0, 0x99e}}, {0x81, 0x0, 0x0, 0x0, @time={0x7fffffff, 0x40}, {0x6}, {0x5, 0x7}, @control={0x0, 0x4}}, {0x0, 0x0, 0x0, 0x0, @time={0x7, 0xe}, {0x0, 0xf9}, {0x0, 0xff}, @note={0x0, 0x1, 0x3, 0x1, 0x3}}], 0x70) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000a40)=ANY=[@ANYBLOB="fc000000190001000000000000000000fc000b00000000000000000000000000fe8000000000000000000000000000aa00000088000000000a000000000000006e80f053d16a8c0b7ebddad2547a430c16bd3f24c711c57a49fe6ae4ea2498279514e8c97a77345297953262316a93e5a9202ef5044f623fceb8522375f6e11e2a0e54", @ANYRES32, @ANYBLOB], 0xfc}, 0x1, 0x0, 0x0, 0x20048040}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB="a0000000210001000400000000000000ff010000000000000000000000000001fe80000000000000000000000000003a00000000000000000a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000020aa10c000000000500011000a01010100000000000000000000000000000000000000000000000000000001ac141429000000000000000000000000000000000000000000000000000000013c040007020000000a000a00c976aec72338b7ff3fc5412f6073bfb4248d03f9fb2b74d14663605e279e8246bce43a2998418f14fe98efaff3f646abd5135a8b89845b16f9f961db0f650c5bf3c71f7f47cd86428fb6d09881e9ef115ef3cfe005d6cd71c842d5a37f90c4c499b8074860bc10616008db5cef306c85b86a99ab23818a19077be83dc710324a27b6090000009d1dc4cf32"], 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 15.286922112s ago: executing program 4 (id=3270): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket(0x10, 0x3, 0xd1f) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_open_dev$vim2m(0x0, 0x0, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000"], 0x48) r2 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x8000}) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r3}, 0xc) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xb, 0x4, 0x2, 0x4, 0x181, 0x1}, 0x50) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xfffffffffffffeca, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r5}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000007c0)={0x28, 0x4, r5, 0x0, &(0x7f0000561000/0x1000)=nil, 0x1000, 0x1004000}) close_range(r1, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r6, 0x29, 0x1, &(0x7f0000000080), 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0x800001c, @multicast1}, {0x0, 0x17c1, 0x8}}}}}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) 14.329814658s ago: executing program 3 (id=3271): openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3380, 0x1, 0x40024e}, 0x0, 0x0, 0x0) eventfd2(0x7fffffff, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), 0x0, 0x0, 0x1}) 14.252287043s ago: executing program 7 (id=3272): set_mempolicy(0x3, &(0x7f00000000c0)=0x3, 0x5) syz_io_uring_setup(0x258e, &(0x7f0000000040)={0x0, 0xcc6, 0x1000, 0x0, 0x3a7}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={0x0, 0x0, 0x3d, 0x0, 0x1}, 0x28) socket$kcm(0x11, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000000), 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r4, &(0x7f0000000280)=[{0x6, 0x6, 0x0, 0x0, @tick=0x4, {0x5}, {0x4, 0xa}, @result={0x9, 0x1}}, {0x0, 0x0, 0x0, 0xa, @tick=0x5, {0x80}, {0x5}, @result={0x0, 0x99e}}, {0x81, 0x0, 0x0, 0x0, @time={0x7fffffff, 0x40}, {0x6}, {0x5, 0x7}, @control={0x0, 0x4}}, {0x0, 0x0, 0x0, 0x0, @time={0x7, 0xe}, {0x0, 0xf9}, {0x0, 0xff}, @note={0x0, 0x1, 0x3, 0x1, 0x3}}], 0x70) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000a40)=ANY=[@ANYBLOB="fc000000190001000000000000000000fc000b00000000000000000000000000fe8000000000000000000000000000aa00000088000000000a000000000000006e80f053d16a8c0b7ebddad2547a430c16bd3f24c711c57a49fe6ae4ea2498279514e8c97a77345297953262316a93e5a9202ef5044f623fceb8522375f6e11e2a0e54", @ANYRES32, @ANYBLOB], 0xfc}, 0x1, 0x0, 0x0, 0x20048040}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB="a0000000210001000400000000000000ff010000000000000000000000000001fe80000000000000000000000000003a00000000000000000a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000020aa10c000000000500011000a01010100000000000000000000000000000000000000000000000000000001ac141429000000000000000000000000000000000000000000000000000000013c040007020000000a000a00c976aec72338b7ff3fc5412f6073bfb4248d03f9fb2b74d14663605e279e8246bce43a2998418f14fe98efaff3f646abd5135a8b89845b16f9f961db0f650c5bf3c71f7f47cd86428fb6d09881e9ef115ef3cfe005d6cd71c842d5a37f90c4c499b8074860bc10616008db5cef306c85b86a99ab23818a19077be83dc710324a27b6090000009d1dc4cf32"], 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 14.040191333s ago: executing program 4 (id=3274): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x63, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x4, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'hsr0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="c5"], 0x10) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000240)={0x0, 'veth0_macvtap\x00', {0x1}, 0x5}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={0xffffffffffffffff, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x1, 0x1}}, 0x40) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 14.026011199s ago: executing program 3 (id=3275): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2000090, &(0x7f0000000640)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c7766646e6f3dbee9f6ee3f7221e3af59d8bae53df2b99fba04a22b4eb743cc5526eb44fe16a240a610b970b120d22875ff0d04c21f2c3e6764d8030c4816cffc3ebd594c17a77ba11e0d69cdd96467680ea14bc711bb5749c858a51a26abfe93da2358f03d5e8c0a838f68b4342ebb591c24703615f219c197ab3ac64df19d3b8bb3606490ec016395aa0dc9ad41be04418f9f0668af852d7563b16f7b3ddb42bb014387cfd56f39ee4a6c3afe8058d21cdcc88c591a5b7391d0e2e38352370a7f9ac6a0", @ANYRESHEX=r0, @ANYBLOB=',\x00']) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r2, 0x0, 0x0) syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$evdev(&(0x7f0000000080), 0x7, 0x200000) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180)={0x5, 0x0}, 0x8) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000380)={'syztnl1\x00', 0x0, 0x7, 0x20, 0x0, 0x7fffffff, {{0x1b, 0x4, 0x2, 0x3, 0x6c, 0x66, 0x0, 0xff, 0x4, 0x0, @broadcast, @multicast2, {[@timestamp_addr={0x44, 0x3c, 0xac, 0x1, 0xb, [{@empty, 0xffff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x80000000}, {@loopback, 0x9}, {@empty, 0x800}, {@private=0xa010102, 0x4f60}, {@multicast1, 0x5}, {@empty, 0x7}]}, @timestamp_addr={0x44, 0x1c, 0x12, 0x1, 0x9, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x80000000}, {@loopback, 0xa}, {@multicast2, 0xe76}]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x0, 0x0, 0x0, 0x2000004, 0x0, 0x0, 0x41000, 0x0, '\x00', r5, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848360000005e140602000000000e000a00100000000a8000001294", 0x2e}], 0x1}, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000a80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0xffffffffffffff3f, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000580)=ANY=[@ANYBLOB="e71a0d"], 0x0, 0x0, 0x0, 0x0, 0x0}) 13.297630726s ago: executing program 7 (id=3276): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001580)={0x2, 0x4, &(0x7f0000000240)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000001340)='GPL\x00'}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, &(0x7f0000001600), 0x4) connect$unix(r1, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet(0xa, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r3, @ANYRESDEC, @ANYRESHEX=r0, @ANYRES8], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f000000e000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="440f78bdb20000003e64460f78b49d0060000065400f841b000000650fc77674dd0166baf80cb85cb2f38cefb800000000efc442a3f5f0c44105d3a100400000b9800000c00f3235000100000f3066baf80cb84a88638aef66bafc0cb017ee", 0x5f}], 0x1, 0x30, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r8, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0xf000}, {"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003548000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) ioctl$KVM_RUN(r8, 0xae80, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x2d8, 0x2d8, 0x138, 0x238, 0x238, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r9, 0x8b2c, &(0x7f0000000040)) socket$packet(0x11, 0x2, 0x300) syz_emit_vhci(&(0x7f0000000000)=ANY=[], 0xf8) r10 = semget$private(0x0, 0x7, 0x191) semtimedop(r10, &(0x7f0000000140)=[{0x0, 0x7, 0x800}], 0x1, 0x0) 13.087887175s ago: executing program 0 (id=3277): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) fcntl$lock(r0, 0x25, &(0x7f0000000080)={0x1, 0x4, 0x1, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) getpid() syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040010}, 0x30) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r4 = accept4(r3, 0x0, 0x0, 0x800) (fail_nth: 3) sendmmsg$alg(r4, &(0x7f0000007700)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}], 0x1, 0x20004014) r5 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r5, 0x0, 0x30, 0x0, 0x20000) epoll_create(0x89a) r6 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x200000000140, 0x0, 0x0, 0x200000000170, 0x2000000001a0], 0x0, 0x0, &(0x7f0000000140)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x108) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) 12.89305784s ago: executing program 4 (id=3278): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000380)={0x0, {0x2, 0xd, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e22, @remote}, {0x2, 0x0, @broadcast}, 0x140, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x26}) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @loopback}, {0x2, 0x0, @broadcast}, 0xc0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x2}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000400)={{0x1, 0x1, 0x18, r0, {0xfffffffa}}, './cgroup.cpu/cgroup.procs\x00'}) syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x8c240) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r3, 0x40146f2c, &(0x7f0000000100)={0x2, 0x1, 0x3, 0x14, 0x4}) getsockopt(0xffffffffffffffff, 0x8, 0x8, 0x0, &(0x7f000001b080)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x0, 0xe, @loopback}}, 0x0, 0x0, 0x26, 0x0, "2431d0edd9b36cb74d7df7671eacf04be3b08353efa3641776f56c7556fd3713097bd0072577bc6fefb4cdc9e94e420b0ea4fbc5b07a32056eff5e6c42784b46ddab72b1b8fc87f208ad6db80d8dfe25"}, 0xd8) bind$inet6(r4, 0x0, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r5, &(0x7f00000018c0)={&(0x7f0000001040)={0x2, 0x0, @loopback}, 0x10, 0x0}, 0x0) listen(r4, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f00000005c0)={@in6={{0xa, 0x4e24, 0x9, @empty, 0x80}}, 0x0, 0x0, 0xf, 0x0, "aeb864a1cf16a1d5524be5bdf2247481041a5b9cddbc936efc471c56ae3d5f6945d296a285858a891a3b4e7bff572ef69992da867f406182d70f4777343400"}, 0xd8) r6 = openat(0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', 0xc00080, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'veth0_vlan\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b78", 0x22, 0x0, &(0x7f0000000540)={0xc9, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000240)={'tunl0\x00', 0x0, 0x10, 0x8, 0x8, 0x5, {{0x7, 0x4, 0x1, 0x3b, 0x1c, 0x66, 0x0, 0xc, 0x2f, 0x0, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@ra={0x94, 0x4}, @ra={0x94, 0x4}]}}}}}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r6, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000003c0)={&(0x7f0000000480)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000226bd7000fbdbdf25040000003800018008000300020000001400020076657468305f766972745f776966690008000100", @ANYRESOCT=r2, @ANYBLOB="fd090489", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="2000018008000100941c4d45d8e820fb95d79a1b06fc9511b935215ba186b39bd655ced6d7cbf0f848336cd68a4c4432ea8a1c0d95809f73343de5f3482b29ce0bdd0fe477a4e5", @ANYRES32=r9, @ANYBLOB="140002007866726d3000"/20], 0x6c}, 0x1, 0x0, 0x0, 0x8080}, 0x4000) 11.671955721s ago: executing program 7 (id=3279): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x0, 0x42, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000280)=0x5) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc3c0000000c0a01010000000f000000000a0000060900020073797a31000000000900010073797a3100000000100003800c000080080003400000000214000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044805}, 0x24008040) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000080)="441f08100000009837a0324d7df546bcb8e8c94efe76cef3e200000000", 0x1d) io_uring_setup(0x2f00, &(0x7f00000004c0)={0x0, 0xe8e2, 0x400, 0x20001, 0x2d6}) r5 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/ip_tables_targets\x00') pread64(r5, &(0x7f0000000080)=""/102356, 0x18fd4, 0x6) setsockopt$MRT_FLUSH(r5, 0x0, 0xd4, 0x0, 0x0) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = socket$inet(0x2, 0xa, 0x0) sendmmsg$sock(r7, &(0x7f0000003280)=[{{&(0x7f0000000100)=@nl=@unspec, 0x12, 0x0}}], 0x1, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) sendmsg$inet(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x3000c041) 11.65019619s ago: executing program 5 (id=3280): openat$sndseq(0xffffffffffffff9c, 0x0, 0x2) r0 = getpid() syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r4) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6e65772064656661756c7420757365723a73797a203030ddb0dcd174be22990a6c0c3030303430393300"], 0x2a, 0x0) r5 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd) keyctl$read(0xb, r5, &(0x7f0000000240)=""/112, 0x349b7f55) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f00000001c0)={[0x0, &(0x7f00000000c0)='user\x00']}) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[], 0x2a, 0xfffffffffffffff9) add_key(0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) ioctl$I2C_SMBUS(r6, 0x720, 0x0) r7 = syz_pidfd_open(r0, 0x0) ioctl$VIDIOC_QBUF(r7, 0xc058ff0b, &(0x7f0000000200)=@multiplanar_overlay={0xbd1, 0xd, 0x4, 0x1000, 0x4, {}, {0x1, 0xc, 0x81, 0x6, 0xf, 0xc, "717480be"}, 0x9, 0x3, {0x0}, 0x4ff}) 11.393041746s ago: executing program 0 (id=3281): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001580)={0x2, 0x4, &(0x7f0000000240)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000001340)='GPL\x00'}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, &(0x7f0000001600), 0x4) connect$unix(r1, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet(0xa, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r3, @ANYRESDEC, @ANYRESHEX=r0, @ANYRES8], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f000000e000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="440f78bdb20000003e64460f78b49d0060000065400f841b000000650fc77674dd0166baf80cb85cb2f38cefb800000000efc442a3f5f0c44105d3a100400000b9800000c00f3235000100000f3066baf80cb84a88638aef66bafc0cb017ee", 0x5f}], 0x1, 0x30, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r8, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0xf000}, {"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003548000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) ioctl$KVM_RUN(r8, 0xae80, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x2d8, 0x2d8, 0x138, 0x238, 0x238, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r9, 0x8b2c, &(0x7f0000000040)) socket$packet(0x11, 0x2, 0x300) syz_emit_vhci(&(0x7f0000000000)=ANY=[], 0xf8) r10 = semget$private(0x0, 0x7, 0x191) semtimedop(r10, &(0x7f0000000140)=[{0x0, 0x7, 0x800}], 0x1, 0x0) 10.68266073s ago: executing program 7 (id=3282): syz_open_dev$dri(&(0x7f0000000340), 0x1, 0x8000) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = io_uring_setup(0x1d46, &(0x7f0000000340)={0x0, 0x10b140, 0x1000, 0x6, 0x196}) r2 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@mpls_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_TTL_PROPAGATE={0x5, 0x1e}]}, 0x24}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r4, 0x114, 0x3, &(0x7f00000007c0), 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c643c, &(0x7f0000000300)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)="1400000035000b0bc8d643234724d3f90324fc60", 0x14}], 0x1}, 0x0) bind$rxrpc(r2, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r2, 0x4) close_range(r1, r2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0f000000040000000400", @ANYRESDEC=r0, @ANYRES64=r0, @ANYRES8=r0, @ANYRESDEC, @ANYRESHEX=r0, @ANYRESOCT=r0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x7, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="2f00000000000000000000006a3f7860d3ee6eb4b2c5f9c5d04b88356fa0a922c422cc23ac16635b1024517a42fc1dd3ece66beee92cf5132e4b382ddcd6244bcc7ba5f912ac24968ee3031f62673a49be5669c781fc1c8cd4a7ad3bed45bcfcc321b4d085566dfb44", @ANYRES32, @ANYBLOB], 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback=0xffffffffffffffff, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32=r8, @ANYRES32=r8, @ANYBLOB="8197620121bdecd94318bc636c9caa7ef7018286b87ea78bb95814a0c8edbf71d886c166158706e46cdbcdb64e0f94bf2cd4f837aeff7841e11b0f01c1653568ba6dcd13547931da0adb67c390ba78a6fecb69e6a56cd3085fa6b4275b1425b007c62150eea8a6c586b1bafed32fc29b5c9552f1f9118bd8edd07cc1d634f0408c8592e9500eee062602f28e74a78c0bbae6c8268c199a8fc693c0de7c2d6cc616b6ab6df53e72a3e481b5da210f4acd153692fc03", @ANYRES32, @ANYBLOB, @ANYRES32=r8, @ANYBLOB, @ANYRES64=r9], 0x20) 9.326236333s ago: executing program 3 (id=3283): set_mempolicy(0x3, &(0x7f00000000c0)=0x3, 0x5) syz_io_uring_setup(0x258e, &(0x7f0000000040)={0x0, 0xcc6, 0x1000, 0x0, 0x3a7}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={0x0, 0x0, 0x3d, 0x0, 0x1}, 0x28) socket$kcm(0x11, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000000), 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r4, &(0x7f0000000280)=[{0x6, 0x6, 0x0, 0x0, @tick=0x4, {0x5}, {0x4, 0xa}, @result={0x9, 0x1}}, {0x0, 0x0, 0x0, 0xa, @tick=0x5, {0x80}, {0x5}, @result={0x0, 0x99e}}, {0x81, 0x0, 0x0, 0x0, @time={0x7fffffff, 0x40}, {0x6}, {0x5, 0x7}, @control={0x0, 0x4}}, {0x0, 0x0, 0x0, 0x0, @time={0x7, 0xe}, {0x0, 0xf9}, {0x0, 0xff}, @note={0x0, 0x1, 0x3, 0x1, 0x3}}], 0x70) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000a40)=ANY=[@ANYRESHEX, @ANYRES32, @ANYBLOB], 0xfc}, 0x1, 0x0, 0x0, 0x20048040}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB="a0000000210001000400000000000000ff010000000000000000000000000001fe80000000000000000000000000003a00000000000000000a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000020aa10c000000000500011000a01010100000000000000000000000000000000000000000000000000000001ac141429000000000000000000000000000000000000000000000000000000013c040007020000000a000a00c976aec72338b7ff3fc5412f6073bfb4248d03f9fb2b74d14663605e279e8246bce43a2998418f14fe98efaff3f646abd5135a8b89845b16f9f961db0f650c5bf3c71f7f47cd86428fb6d09881e9ef115ef3cfe005d6cd71c842d5a37f90c4c499b8074860bc10616008db5cef306c85b86a99ab23818a19077be83dc710324a27b6090000009d1dc4cf32"], 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 9.233169845s ago: executing program 0 (id=3284): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x328000, 0x81f}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000280)={0x7, &(0x7f0000000300)=[{0x2, 0x7, 0x95, 0x4584}, {0x3ff, 0x10, 0x6, 0xd}, {0x10, 0xb, 0x5, 0xe66}, {0x0, 0xf, 0x36, 0x3}, {0x0, 0x4a, 0x4, 0xd649}, {0x6, 0x78, 0x2, 0x401}, {0x81, 0x7, 0x2, 0x8001}]}) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x1c, r5, 0xd66771a5e8224ded, 0x0, 0x0, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r8, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f00000001c0), 0x4) 7.649365609s ago: executing program 7 (id=3285): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0xe1, 0xec000000, 0xcd}]}) 7.277542926s ago: executing program 3 (id=3286): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2000090, &(0x7f0000000640)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c7766646e6f3dbee9f6ee3f7221e3af59d8bae53df2b99fba04a22b4eb743cc5526eb44fe16a240a610b970b120d22875ff0d04c21f2c3e6764d8030c4816cffc3ebd594c17a77ba11e0d69cdd96467680ea14bc711bb5749c858a51a26abfe93da2358f03d5e8c0a838f68b4342ebb591c24703615f219c197ab3ac64df19d3b8bb3606490ec016395aa0dc9ad41be04418f9f0668af852d7563b16f7b3ddb42bb014387cfd56f39ee4a6c3afe8058d21cdcc88c591a5b7391d0e2e38352370a7f9ac6a0", @ANYRESHEX=r0, @ANYBLOB=',\x00']) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r2, 0x0, 0x0) syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$evdev(&(0x7f0000000080), 0x7, 0x200000) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180)={0x5, 0x0}, 0x8) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000380)={'syztnl1\x00', 0x0, 0x7, 0x20, 0x0, 0x7fffffff, {{0x1b, 0x4, 0x2, 0x3, 0x6c, 0x66, 0x0, 0xff, 0x4, 0x0, @broadcast, @multicast2, {[@timestamp_addr={0x44, 0x3c, 0xac, 0x1, 0xb, [{@empty, 0xffff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x80000000}, {@loopback, 0x9}, {@empty, 0x800}, {@private=0xa010102, 0x4f60}, {@multicast1, 0x5}, {@empty, 0x7}]}, @timestamp_addr={0x44, 0x1c, 0x12, 0x1, 0x9, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x80000000}, {@loopback, 0xa}, {@multicast2, 0xe76}]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x0, 0x0, 0x0, 0x2000004, 0x0, 0x0, 0x41000, 0x0, '\x00', r5, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat$loop(0xffffffffffffff9c, 0x0, 0x1000, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848360000005e140602000000000e000a00100000000a8000001294", 0x2e}], 0x1}, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000a80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0xffffffffffffff3f, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000580)=ANY=[@ANYBLOB="e71a0d"], 0x0, 0x0, 0x0, 0x0, 0x0}) 7.277141752s ago: executing program 0 (id=3287): socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240480d4}, 0x4040) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000080)=0x2) ioctl$VIDIOC_DECODER_CMD(r2, 0xc0485660, &(0x7f0000000000)={0x1, 0x1, @stop_pts=0x1}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0x899, 0x0) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$VIDIOC_DECODER_CMD(r2, 0xc0485660, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, 0x0) 6.028329256s ago: executing program 5 (id=3288): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001280)=@newtaction={0x48, 0x30, 0x9, 0x70bd24, 0x25dfdbfe, {}, [{0x34, 0x1, [@m_mpls={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x48}}, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, 0x0) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r7, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='P\x00\x00', @ANYRES16=r2, @ANYBLOB="07000000000000000400050000001c000380080004005a0a00000800020020000000080005007183bbda180001801400020073797a5f74756e000000000000000000080005"], 0x50}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000080)={0x0, 0x0, 0xc00, 0x0, 0x370}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x4004, @fd_index=0x4, 0x718a, 0x0, 0x0, 0x12, 0x1, {0x2}}) 5.949720483s ago: executing program 7 (id=3289): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x400000000003, 0x210080) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000280)={'broute\x00', 0x0, 0x0, 0x0, [0x1, 0x1, 0x4, 0x3, 0x10000, 0xd5]}, &(0x7f0000000180)=0x78) r3 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x80000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e1f, @dev={0xac, 0x14, 0x14, 0x40}}, 0x10) r4 = openat(0xffffffffffffffff, 0x0, 0x448801, 0x18b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket(0x2, 0x1, 0x0) r6 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0xc000) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x2c, 0x0, @void}, 0x10) openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000140)='syzkaller\x00'}, 0x94) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={r7, 0x0, 0x0}, 0x10) ioctl$NBD_SET_SOCK(r6, 0xab00, r5) ioctl$NBD_DO_IT(r6, 0xab03) ioctl$SNDCTL_SEQ_PANIC(r4, 0x5111) ioctl$NBD_SET_SIZE_BLOCKS(r3, 0xab07, 0x100000000) syz_open_dev$ndb(&(0x7f0000002080), 0x0, 0x80083) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x40) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r1, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080), 0x13f}}, 0x20) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaabb86dd6d002000001311ff00"/36], 0x4b) 4.97080704s ago: executing program 5 (id=3290): r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) write$cgroup_devices(r0, &(0x7f0000000280)=ANY=[], 0x54) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$FBIO_WAITFORVSYNC(r1, 0x40044620, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001f7ff04b7050000240000006a0a00fe00000000850000000b000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4988a0d411a9872971c7c56f0979bd10b97163c066d0e196bf0fb04e500b0c0502df9de9ca3c00cb9a323d9b401bf4e418d07fa22f0610a70f2bdf4000200000000b0c2c125080963f6324bb7b80197aa3161f45346b100000000000000000089e399f6609876b588743794298b79dc192dff048fc207c81f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be06000000000000005064caec04a367c23d9fb6a6991ddb737d527d6acb15426406991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a313e3b3ca5d3393404029e98fa883c71949a34d84030323e3d54fc5b29d27643453ad9226e3550ee5520211d9370175fba303f003073afd1ec9f7c6133f260c6882a146880b9387f1beb5418618bc83a3becf9bb5d80eff7da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb2f30a246c3b2f60000fc4deb91da1368b0960b8d69bd99c64893d44f962524429dc0584b8e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e58219bc54f6ad5679e7f430e6960ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7073be648b12bb1fee58958d6a6f31bfe568215dfbde59dad00008a73b40f09cf018cd496b36050d7fd45e3620c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc348ef2ac3789b847611fcb0a26acafdd6d9a1b17dcb9f7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb0200000000000000cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d944763a4bf5e138d810e29a31f08f7dea7762d2d8f7e1d24cabe17ad4135d8872935ceac6eb4f046f2acc1b0efb4438abddcabb4e4e72a450aab72b589bec83bbb688e659fb426cd43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c106beb49a71c62df5544ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f481112ab8a82247e927fb6f256830dab3671f00500d36a17790bab7d0e89e6c15314f2b963bfc867953476b0505c7d728326d666f39e82cfcf7e7a85df288d75df24c5e4d529c349923f9a4fb882310391dd58b4cbd8def239a227724d39c3e6c40e20e07e68a22888a5c3941b7a765b92bcb37f302487bcbd93ccf3a104021ff34ddf7ffcca1a04eae963e25516a114573779b24a341dfb2e80f1f345c6d96493ffc2a18478b5bf3aab2ea59c51cf0678e1a57d0ea042d911548ff612002ddb2d54d42fbdde42b56887003d27468225b2594a0500200f314113e889468cf13dd92aa0d7744db6b56557a5adad95cb9a69d4de50642b4b9d6d3ba7eb534b00d0fea62f0a61535dfc4da06e7f8695be614c557caed7eb0120516e1351fed7d8ffa31c8f4be364185469cfc5f25c90d71bce745dd2d58a30e0844f12c4cbbdd7a08465e665c2620d78673dfb6d9263e44f59fae487c62c98a3534f1a3eac9ee9f18a18106ba3d7c7a62330f5c0e98cb7982dd7bad02c8dba9c13894185bfc4bd2520b6e2043fcb3fc5eb55ecf9e6e363ea2ac40a14a6f00f0ffffa0fdb6487c51ef12c2e88beeb5aa6f6a4151cfb90644e50630ed474df7d1635afcb1ea3f6c47b5acbba2ce5099a9387f74d1ffbd1da497613174f76a656ba5bacccbb58dddaf9a3510d65383829a51e0f41e661fa80ca1eaaa6cf0824305ba4ec80400c50ffe83ccb0e6fef321190c58aca8c7c8c6d26ff5cbc2cadebda8e1219e04f8dacffd33db1a0a2e74c9eb978d80a12d0b5327bfd053000000000000000000be0d02a14708504412fa93d335992b2983c5addc191b4a21c7b340d0536b01958e15315eb5f3f9f4992c18f666359f40295fa73284c4b607669bae01bd68c3e2b770c324a0ab26b6065d7e95a7bd80052db57506ec7cc861bf3998d07484c66630ca8173fea3f06ed1dfc70a8b90418e2dc76137e0f68cb1c8a908aef9f009f85647dba54e05028c33d94d463fb20d2e7547184b8d3611e45dff02144387f342ef9b9bf650e9d049bf65258a7bc094a6965e24611c077e1ca0891362a9d68f3ec7610c0449ac59110500a09b75885cd79ba32776e4a511c8a4ad922b000000000002ef507ec6fc7f5dc431b9d8cbd9003972bf1dc6a71bedad8e19efc3edd2a7a7e555d5f3176af69920471e6e5bcb8966c813c132d65e2b99d3015e06b372e1aefaae14ee3fbc6349af362c19b59c214de66912d1a9a98d92dc030000009443de62caca334c46d110e50896fe50d0477771d387f40c8ef05750ca651e6e69a237dcf78666d6ab2bda1f853525494e4efdd93be38bb5fc671f8794002d7a951fd336aaf4ed1166cb459df70218c571ba1c40b028234505e5477effff26af8812c2fbb8785a223fce0a0601c2a3b58bea8c6216eadabcabe86ab46e4cd3d58ef7ce8d3c4b0bc5952e81dfc0a490d8568db6f9c51fe703c6864fae0053d2f91f49e977cdc1962dbc28c29471a72199862bc8fc6e211d13d8579cab4fba94b2b613c9b8148d05e0690a4c4ab35aabc45801d2b82081e62b23a01b58b1ffb624f63ad2246796796160cd3682374364edac52f1becb7c6eff50823b75fb2ef516ec4ec1cb20a2535b504502d744f2099674e58f2c117c980cf0d041c8e45c4f166bab4aa5ed200ef4dcff96f7c9c1ab8c22db0f439b23b04bcd41ffc3a0e01976ca1cf43e12d7d72f3faa4979faabd62e2dc54a980eae4d5e8c6498de331c3aba1144ef1190ea6cda641d9416c4560cab2d819eac7b04c70f141754c3ffd79da363fe8859afee531710caf1b2bf5a51142f4755cbb700c28083525a9093790096cb93417f1216000000000000000000000000000040ceb244e4cae2b65a36d41793aabccd3d0c50486eae6793e1f54814a8ee2779c14ca94759266200229b58c12279817869e831cade7b09ddffffff9d93e2ad25eed43c0b9ee4fd209b5b919a42f676b9d7236fc8dd5040899d0676291407ce9ac8101dd3512f5b3ac8cf8179d1749de324000030d0f942ec4604c28d5c287d1435956784003a53eb5f0436ead88d7acf0166dbd9f30a9b259c8a9b9faf1356faf269cded935b07863e4fdad8aab52686c81babd1c08f6700a2fadd413443022ea5c774ffefdd426abed08d437a4db48611fc82a18ab9f54758a1aad86d95cd186ceb55fafa3930090467b8b7bb8ae7e1c8b4b4106a381cb67fdb86def4de2076dc538bb97502b4b4350e633dc0a53c2fc9a01bc5cfae0245f1fab843c633446f5f3a43226109b7dafe7815773bd6969f04cbe15236b90000000000000000000000000000000000000000000000000000ff0779b9c0057addb2efe11b8b3a706569f1522b57d71bb0beccab7c8fe9e1330b2f501b2ac3cfe9e2f505e833217557abb257d61a73a758543651b250f8d8ef9c8481bb28a137d15040b0181c28dfad7c17b30c452a64c43a117cb948247c33abc765a6ba695c3cea5e32a4d11c9b4be91c60932bae2dcbec2ff4268e03aad15efc6004e6b3d7f0edf8b5d4ae7846a6d43c16c90b7c5dc13ac2ff0439ab693498964cad2bb533bcd240778b7e49145c48efde42b44c01517f1a7c7707b4c4fc0900e7086ec40354504590696282286db9030f0320e2fcba8723939005347b3c99e3f1310d41ab328c1f351b3f744ff1973431000000000000000000000000000000000000003495d69aaf9a1d83e83511a3bf44fe753b8ad83bc34ea4d46b397e000fd267c50122aa5aaf8474ec2e57d960d963900bef84a4b3c7dd01ae4d6b5522aa8a35ae7996e298bcfe3f31a34e3e12c58cf172a4d3677a67b52041ec21ae8003aa1c9969178b1b00e4d12ac9741fd788fb6260ec043c013907523c77f8acc20b9e2fd224ca8f21fab2b10991881e0a12f4e1c4f54b9ca7c9a0c8298d60b8b6eaa023418992d6d62b0e9faca4a3b3a845e859137cd933ef5eb8db16f159f32505725da51414562d064b551246dacd58023fed3c087bb52ae4bc09f3846c785d1b278e661ed01fbc2415288bc9c808c4aef648d431b3029da0dec8886c3ee9cad996843d00a3b5eb54e270dd2e96c8f2fdb4c27c2d1bd467f2a14867dec67730d8a68329839d9feff688dfbe25c73f936338e7b057980da58a6303d95f17712d667d5a1066ae457ae32925ce658b559c1182a74e267da57fe25b19153f1cdebaddf3f7a3479c09f2303dff449c0513b152a75ed48215cc31264a6ff648a95daa0d599dbce303b3b5307572df30429a3b4b115cab0a018f2501272048dd9e69877535e20078e7c28a98f26ace7a266bdc15ce904f25ec7fb2434ee7b5b69bed702ba1e7ed72942f452f1a98a2d949450091075efa823b11f5f5eccd921c04c7c15a5a05750cd85b1300fc00ce275de7559e117f87cb6c3c9a4b9f96149e3fcffa44d7000000000000000000d43d07d546acb7009c0c4f6e57b8577d2113bfca1939b9bf757265e175c1863a7c8d7640675830dc11d5d59546daf2385a7074f770c8333b21e2fb660141bc4f1ed45f703da6ac2557ab6952bd0c300000000000000000005b44bff4e3966fdfc9b720412bec09936b08e440c774e222dbd9a323a889f295e5d3bae64fc48ba123668e6a0be1e732aa5e2a0d4373a0b76d84f018d45bdf6f12d6d5d23a0331c3ae5e99a2bcdb52386135ea15890007e1cba5e52a04971139272012ae5542ba109a9d2f49798ce2fc6f639735e0222cd08075418239042bfe47c363973d3245ce507e838dfd90ae442a96fa1343029be56de31c2eff226c05f0ae3dbe2281e7bc02db39342d5b54ad3616733a5aa7753613423a0c4d2844a6e08fa5b76e18f7e24e967f6f83c546718d0f20959376427cdd449a4be3d75fd3e51e1b7f8690855af8eddbd3fd556b4460d0091e3623933f1a11db14aea54af6c49725bfa51fed222dc379995f48b1aab94441767c8bccbfd966d814715203bd8f549cd57d6a87295bf16aa25fb4e7fcaa8cec5e5c03b0095861bf2fed70ffb46bbb78ba90ca272ead9b3d2959fd9dbaabd1d51a60b474cef4c700faf718b810e4d3527a4663ee9fbc0000000000000000000000000000000000000000000000000061abf7a66b7b3f57ff830000"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="5aee41dea43e63a3f7fb7f11c72b", 0x0, 0xf000, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x50) ioctl$F2FS_IOC_COMPRESS_FILE(r2, 0xf518, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x3, 0x8, 0x7ffc0000}]}) readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) 4.77297471s ago: executing program 5 (id=3291): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) remap_file_pages(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x600, 0x20) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) r3 = socket(0x1, 0x2, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40, &(0x7f0000000200)={0x9, 0xffffffff}) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r4 = socket(0x23, 0x80805, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r5 = getpgid(0x0) sched_getscheduler(r5) sendmsg$nl_generic(r4, 0x0, 0x20008081) bind$unix(r3, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) ioctl$SIOCGETLINKNAME(r3, 0x89e0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r6, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r7, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xe, 0x8, &(0x7f0000000180)=@framed={{0x18, 0x8}, [@tail_call={{}, {}, {}, {0x7, 0x0, 0xb, 0x9}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.870611046s ago: executing program 5 (id=3292): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)=0x0) getpgrp(r3) keyctl$instantiate(0xc, 0x0, 0x0, 0x2a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000000), &(0x7f0000000240)=0x4) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) symlink(0x0, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002480)=@newtfilter={0x8ac, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x878, 0x2, [@TCA_U32_POLICE={0x850, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x7, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x807, 0x1000, 0xfff, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x8, 0x10000, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x8, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x80000000, 0x2, 0x6, 0x6, 0xaa, 0x0, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0x2f1e, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x1, 0xab, 0x9, 0x7, 0x0, 0xe, 0x10001, 0x8, 0xa, 0x6, 0x0, 0xa1, 0x7, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x10000, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74dc, 0x400000, 0xc, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x81, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x6, 0x5, 0x7, 0x4, 0x3, 0xff, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x5, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf8, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x80, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x3, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x2, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf49d, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x6, 0xc4, 0x9, 0x0, 0xee2, 0x4, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x4, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0x7, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x7, 0x81eb, 0x400, 0xffff, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x3, 0x9, 0x4, 0x3, 0x7, 0x0, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x10042b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xadd1}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x8ac}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) userfaultfd(0x80801) ppoll(&(0x7f00000000c0)=[{}], 0x1, 0x0, 0x0, 0x0) 2.617043991s ago: executing program 5 (id=3293): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) creat(&(0x7f0000000140)='./file0\x00', 0x49) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x0) unlink(&(0x7f00000001c0)='./file0\x00') open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x0) listen(r0, 0x8) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket(0x10, 0x3, 0xd1f) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_open_dev$vim2m(0x0, 0x0, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x50) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r2}, 0xc) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r4}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f00000007c0)={0x28, 0x4, r4, 0x0, &(0x7f0000561000/0x1000)=nil, 0x1000, 0x1004000}) close_range(r1, 0xffffffffffffffff, 0x0) 2.062336536s ago: executing program 4 (id=3294): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000380), 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x109) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0), 0x104820, &(0x7f0000000340)=ANY=[@ANYBLOB="7472616e733d7463702c706f72743d3078303030303030303030303030346532302c63616368653d6c6f6f73652c0040194a43ae11b82e2634dcdcb4dfa3a033d4e99b7112965cd6538f5a3bc7972b99ea2d3a5ebb05c1b94f28ccf8ffff26b02019932cd547a84b178e"]) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0xa, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000100), 0x400000, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x56f02000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102384, 0x18ff0) openat$tun(0xffffffffffffff9c, 0x0, 0x70b503, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000000)=0x5, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x5e21, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendmmsg$inet(r4, &(0x7f0000000440)=[{{&(0x7f0000000140)={0x2, 0x4e24, @multicast1}, 0x10, 0x0}}], 0x1, 0x44008004) write$binfmt_misc(r4, &(0x7f0000000300), 0xfdef) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f000060b000/0x4000)=nil, 0x4000, 0x2, 0x8031, r1, 0xc9d81000) unshare(0xa000200) semget$private(0x0, 0x4000, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002a00)=ANY=[@ANYRESOCT=r2], 0x28}, 0x1, 0x0, 0x0, 0x20048011}, 0x2004c001) ioctl$FIONREAD(r0, 0x541b, 0x0) 1.147432727s ago: executing program 4 (id=3295): syz_open_dev$dri(&(0x7f0000000340), 0x1, 0x8000) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = io_uring_setup(0x1d46, &(0x7f0000000340)={0x0, 0x10b140, 0x1000, 0x6, 0x196}) r2 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@mpls_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_TTL_PROPAGATE={0x5, 0x1e}]}, 0x24}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r4, 0x114, 0x3, &(0x7f00000007c0), 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c643c, &(0x7f0000000300)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)="1400000035000b0bc8d643234724d3f90324fc60", 0x14}], 0x1}, 0x0) bind$rxrpc(r2, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r2, 0x4) close_range(r1, r2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0f000000040000000400", @ANYRESDEC=r0, @ANYRES64=r0, @ANYRES8=r0, @ANYRESDEC, @ANYRESHEX=r0, @ANYRESOCT=r0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x7, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="2f00000000000000000000006a3f7860d3ee6eb4b2c5f9c5d04b88356fa0a922c422cc23ac16635b1024517a42fc1dd3ece66beee92cf5132e4b382ddcd6244bcc7ba5f912ac24968ee3031f62673a49be5669c781fc1c8cd4a7ad3bed45bcfcc321b4d085566dfb44", @ANYRES32, @ANYBLOB], 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback=0xffffffffffffffff, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)=ANY=[@ANYRES32=r8, @ANYRES32=r8, @ANYBLOB="8197620121bdecd94318bc636c9caa7ef7018286b87ea78bb95814a0c8edbf71d886c166158706e46cdbcdb64e0f94bf2cd4f837aeff7841e11b0f01c1653568ba6dcd13547931da0adb67c390ba78a6fecb69e6a56cd3085fa6b4275b1425b007c62150eea8a6c586b1bafed32fc29b5c9552f1f9118bd8edd07cc1d634f0408c8592e9500eee062602f28e74a78c0bbae6c8268c199a8fc693c0de7c2d6cc616b6ab6df53e72a3e481b5da210f4acd153692fc03", @ANYRES32, @ANYBLOB, @ANYRES32=r8, @ANYBLOB, @ANYRES64=r9], 0x20) 1.1216289s ago: executing program 0 (id=3296): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000380), 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x109) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0), 0x104820, &(0x7f0000000340)=ANY=[@ANYBLOB="7472616e733d7463702c706f72743d3078303030303030303030303030346532302c63616368653d6c6f6f73652c0040194a43ae11b82e2634dcdcb4dfa3a033d4e99b7112965cd6538f5a3bc7972b99ea2d3a5ebb05c1b94f28ccf8ffff26b02019932cd547a84b178e"]) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0xa, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000100), 0x400000, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x56f02000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102384, 0x18ff0) openat$tun(0xffffffffffffff9c, 0x0, 0x70b503, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000000)=0x5, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x5e21, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendmmsg$inet(r4, &(0x7f0000000440)=[{{&(0x7f0000000140)={0x2, 0x4e24, @multicast1}, 0x10, 0x0}}], 0x1, 0x44008004) write$binfmt_misc(r4, &(0x7f0000000300), 0xfdef) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f000060b000/0x4000)=nil, 0x4000, 0x2, 0x8031, r1, 0xc9d81000) unshare(0xa000200) semget$private(0x0, 0x4000, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002a00)=ANY=[@ANYRESOCT=r2], 0x28}, 0x1, 0x0, 0x0, 0x20048011}, 0x2004c001) ioctl$FIONREAD(r0, 0x541b, 0x0) 1.038155809s ago: executing program 3 (id=3297): openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3380, 0x1, 0x40024e}, 0x0, 0x0, 0x0) eventfd2(0x7fffffff, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[0x0], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x1}) 0s ago: executing program 4 (id=3298): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x4d, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x40903, 0x0) ioctl$TCSBRKP(r2, 0x5425, 0x5) ppoll(&(0x7f0000000040)=[{r2, 0x3541}], 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x48, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x7afc5, 0x11a20}, [@IFLA_IFNAME={0x14, 0x3, 'wlan1\x00'}, @IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TRUST={0xc, 0x9, {0x9, 0x3}}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x8c1}, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x20008000) socket$packet(0x11, 0x3, 0x300) r6 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000080)={'veth1_virt_wifi\x00', &(0x7f0000000040)=@ethtool_modinfo={0x42, 0xe, 0x10000}}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b19, &(0x7f0000000040)={'wlan1\x00', @random="0100"}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) socket$packet(0x11, 0x2, 0x300) kernel console output (not intermixed with test programs): , SerialNumber=3 [ 1279.776912][ T5858] usb 7-1: Product: syz [ 1279.781084][ T5858] usb 7-1: Manufacturer: syz [ 1279.806775][ T5858] usb 7-1: SerialNumber: syz [ 1280.143936][T17238] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1280.440475][ T5858] usb 7-1: config 0 descriptor?? [ 1280.816313][ T5871] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1280.855745][T17242] netlink: 'syz.6.2847': attribute type 2 has an invalid length. [ 1280.871756][T17242] hmaÓË224): entered promiscuous mode [ 1280.879920][ T5858] dvb_usb_rtl28xxu 7-1:0.0: chip type detection failed -71 [ 1280.930972][ T5858] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1281.026216][ T5858] usb 7-1: USB disconnect, device number 8 [ 1281.086225][ T5871] usb 6-1: device descriptor read/64, error -71 [ 1281.326253][ T5871] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1282.266524][ T5871] usb 6-1: device descriptor read/64, error -71 [ 1282.410311][ T5871] usb usb6-port1: attempt power cycle [ 1282.885855][ T5871] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 1282.905489][T14840] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 1283.152334][T14840] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1283.175215][T14840] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1283.265051][T14840] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1283.315556][T14840] usb 1-1: config 0 descriptor?? [ 1283.367351][T14840] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1283.547096][T17248] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1283.591383][T17248] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1283.652315][ T5858] usb 1-1: USB disconnect, device number 80 [ 1283.938961][T17265] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2853'. [ 1284.807829][T17269] fuse: Unknown parameter '0x0000000000000006' [ 1285.238555][T17275] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2857'. [ 1285.313416][T17278] mac80211_hwsim hwsim10 wlan1: entered allmulticast mode [ 1285.757461][T17250] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1287.563955][T17292] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2861'. [ 1287.643479][T17292] nbd: socks must be embedded in a SOCK_ITEM attr [ 1288.377272][ T5871] usb 6-1: device descriptor read/8, error -110 [ 1288.503756][T16117] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1288.622446][ T5871] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 1288.652601][ T5871] usb 6-1: device descriptor read/8, error -32 [ 1288.774369][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1288.785739][ T5871] usb usb6-port1: unable to enumerate USB device [ 1288.868033][T16117] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1288.968270][T16117] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1289.075203][T16117] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1289.611003][T16117] bridge_slave_1: left allmulticast mode [ 1289.645712][T16117] bridge_slave_1: left promiscuous mode [ 1289.661491][T16117] bridge0: port 2(bridge_slave_1) entered disabled state [ 1289.703772][T16117] bridge_slave_0: left allmulticast mode [ 1289.724289][T16117] bridge_slave_0: left promiscuous mode [ 1289.737721][T16117] bridge0: port 1(bridge_slave_0) entered disabled state [ 1290.678185][T16117] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1290.754949][T16117] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1290.922342][T16117] bond0 (unregistering): Released all slaves [ 1291.059325][T16928] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1291.071770][T16928] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1291.081327][T16928] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1291.110789][T16928] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1291.121071][T16928] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1291.738942][T16117] hmaÓË224): left promiscuous mode [ 1291.825079][T17339] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode [ 1293.220532][T16928] Bluetooth: hci0: command tx timeout [ 1293.353344][T17329] syz2: rxe_newlink: already configured on ipvlan0 [ 1294.334269][ T30] audit: type=1804 audit(2000001447.837:547): pid=17364 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.3.2874" name="file0" dev="tmpfs" ino=3150 res=1 errno=0 [ 1295.299781][T13901] Bluetooth: hci0: command tx timeout [ 1295.482316][ T5871] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1295.640039][ T5871] usb 6-1: device descriptor read/64, error -71 [ 1295.884387][T17328] chnl_net:caif_netlink_parms(): no params data found [ 1295.928989][ T5871] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1296.078826][ T5871] usb 6-1: device descriptor read/64, error -71 [ 1296.281647][ T5871] usb usb6-port1: attempt power cycle [ 1296.658507][ T5871] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1296.799595][ T5871] usb 6-1: device descriptor read/8, error -71 [ 1297.138159][ T5871] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 1297.395215][T13901] Bluetooth: hci0: command tx timeout [ 1298.136583][T16117] hsr_slave_0: left promiscuous mode [ 1298.237741][T16117] hsr_slave_1: left promiscuous mode [ 1298.256008][T16117] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1298.299394][T16117] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1298.383567][T16117] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1298.402741][T16117] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1298.544889][T16117] veth1_macvtap: left promiscuous mode [ 1298.566856][T16117] veth0_macvtap: left promiscuous mode [ 1298.580263][T16117] veth1_vlan: left promiscuous mode [ 1298.625976][T16117] veth0_vlan: left promiscuous mode [ 1299.459213][T13901] Bluetooth: hci0: command tx timeout [ 1299.712001][T16117] team0 (unregistering): Port device team_slave_1 removed [ 1299.754562][ T5871] usb 6-1: device descriptor read/8, error -71 [ 1299.769056][T16117] team0 (unregistering): Port device team_slave_0 removed [ 1299.867800][ T5871] usb usb6-port1: unable to enumerate USB device [ 1299.940654][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.115268][T17391] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1301.138511][T17328] bridge0: port 1(bridge_slave_0) entered blocking state [ 1301.156164][T17391] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1301.165704][T17391] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1301.176696][T17328] bridge0: port 1(bridge_slave_0) entered disabled state [ 1301.183896][T17328] bridge_slave_0: entered allmulticast mode [ 1301.251582][T17328] bridge_slave_0: entered promiscuous mode [ 1301.444474][T17328] bridge0: port 2(bridge_slave_1) entered blocking state [ 1301.476057][T17328] bridge0: port 2(bridge_slave_1) entered disabled state [ 1301.483239][T17328] bridge_slave_1: entered allmulticast mode [ 1301.521539][T17328] bridge_slave_1: entered promiscuous mode [ 1301.655409][T17328] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1301.718241][T17328] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1301.830463][T17328] team0: Port device team_slave_0 added [ 1301.876361][T17328] team0: Port device team_slave_1 added [ 1301.914989][T17435] syz.5.2886: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1301.930302][ T30] audit: type=1400 audit(2000001711.452:548): avc: denied { getopt } for pid=17434 comm="syz.5.2886" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1301.950149][T17435] CPU: 1 UID: 0 PID: 17435 Comm: syz.5.2886 Tainted: G L syzkaller #0 PREEMPT(full) [ 1301.950170][T17435] Tainted: [L]=SOFTLOCKUP [ 1301.950174][T17435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1301.950182][T17435] Call Trace: [ 1301.950187][T17435] [ 1301.950192][T17435] dump_stack_lvl+0x100/0x190 [ 1301.950218][T17435] warn_alloc.cold+0x95/0x1c1 [ 1301.950240][T17435] ? __pfx_warn_alloc+0x10/0x10 [ 1301.950264][T17435] ? kasan_save_stack+0x3f/0x50 [ 1301.950281][T17435] ? kasan_save_stack+0x30/0x50 [ 1301.950298][T17435] ? kasan_save_track+0x14/0x30 [ 1301.950316][T17435] ? xskq_create+0xfb/0x1d0 [ 1301.950332][T17435] __vmalloc_node_range_noprof+0x1252/0x1530 [ 1301.950351][T17435] ? xskq_create+0xfb/0x1d0 [ 1301.950371][T17435] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1301.950394][T17435] ? xskq_create+0xfb/0x1d0 [ 1301.950409][T17435] vmalloc_user_noprof+0x9e/0xe0 [ 1301.950423][T17435] ? xskq_create+0xfb/0x1d0 [ 1301.950437][T17435] xskq_create+0xfb/0x1d0 [ 1301.950453][T17435] xsk_setsockopt+0x743/0xab0 [ 1301.950478][T17435] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1301.950493][T17435] ? find_held_lock+0x2b/0x80 [ 1301.950510][T17435] ? __fget_files+0x215/0x3d0 [ 1301.950526][T17435] ? selinux_socket_setsockopt+0x6a/0x80 [ 1301.950544][T17435] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1301.950559][T17435] do_sock_setsockopt+0xf3/0x1d0 [ 1301.950580][T17435] __sys_setsockopt+0x195/0x220 [ 1301.950599][T17435] __x64_sys_setsockopt+0xbd/0x160 [ 1301.950615][T17435] ? do_syscall_64+0x95/0xf80 [ 1301.950633][T17435] ? lockdep_hardirqs_on+0x78/0x100 [ 1301.950650][T17435] do_syscall_64+0x106/0xf80 [ 1301.950670][T17435] ? clear_bhb_loop+0x40/0x90 [ 1301.950685][T17435] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.950697][T17435] RIP: 0033:0x7fd0b1f9c819 [ 1301.950709][T17435] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1301.950721][T17435] RSP: 002b:00007fd0b2ee8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1301.950733][T17435] RAX: ffffffffffffffda RBX: 00007fd0b2215fa0 RCX: 00007fd0b1f9c819 [ 1301.950741][T17435] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 1301.950748][T17435] RBP: 00007fd0b2032c91 R08: 0000000000000004 R09: 0000000000000000 [ 1301.950756][T17435] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1301.950765][T17435] R13: 00007fd0b2216038 R14: 00007fd0b2215fa0 R15: 00007ffcdfeeb888 [ 1301.950783][T17435] [ 1301.950816][T17435] Mem-Info: [ 1302.209418][T17328] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1302.209429][T17328] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1302.209451][T17328] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1302.210334][T17328] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1302.210343][T17328] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1302.210357][T17328] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1302.599308][T17442] netlink: 'syz.3.2887': attribute type 1 has an invalid length. [ 1302.701102][T17435] active_anon:34767 inactive_anon:0 isolated_anon:0 [ 1302.701102][T17435] active_file:25361 inactive_file:4375 isolated_file:0 [ 1302.701102][T17435] unevictable:768 dirty:191 writeback:0 [ 1302.701102][T17435] slab_reclaimable:10237 slab_unreclaimable:102975 [ 1302.701102][T17435] mapped:44750 shmem:25746 pagetables:3898 [ 1302.701102][T17435] sec_pagetables:0 bounce:0 [ 1302.701102][T17435] kernel_misc_reclaimable:0 [ 1302.701102][T17435] free:1280199 free_pcp:26732 free_cma:0 [ 1302.701225][T17435] Node 0 active_anon:139068kB inactive_anon:0kB active_file:101444kB inactive_file:17368kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:179000kB dirty:764kB writeback:0kB shmem:101448kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13244kB pagetables:15456kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1302.701288][T17435] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:132kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1302.701344][T17435] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1302.701410][T17435] lowmem_reserve[]: 0 2477 2478 2478 2478 [ 1302.701456][T17435] Node 0 DMA32 free:1185964kB boost:0kB min:34056kB low:42568kB high:51080kB reserved_highatomic:0KB free_highatomic:0KB active_anon:138968kB inactive_anon:0kB active_file:101444kB inactive_file:17368kB unevictable:1536kB writepending:764kB zspages:0kB present:3129332kB managed:2537064kB mlocked:0kB bounce:0kB free_pcp:69372kB local_pcp:50228kB free_cma:0kB [ 1302.701525][T17435] lowmem_reserve[]: 0 0 1 1 1 [ 1302.701567][T17435] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1044kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1302.701631][T17435] lowmem_reserve[]: 0 0 0 0 0 [ 1302.701673][T17435] Node 1 Normal free:3919472kB boost:0kB min:55832kB low:69788kB high:83744kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:132kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:37652kB local_pcp:5952kB free_cma:0kB [ 1302.701741][T17435] lowmem_reserve[]: 0 0 0 0 0 [ 1302.701784][T17435] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1302.701951][T17435] Node 0 DMA32: 6487*4kB (UME) 6773*8kB (UME) 4657*16kB (UME) 2710*32kB (UME) 1750*64kB (UME) 967*128kB (UME) 555*256kB (UME) 393*512kB (UME) 291*1024kB (UM) 13*2048kB (UM) 10*4096kB (M) = 1186004kB [ 1302.702146][T17435] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1302.702269][T17435] Node 1 Normal: 6*4kB (UM) 15*8kB (UM) 8*16kB (UM) 7*32kB (UM) 8*64kB (UM) 3*128kB (UM) 5*256kB (UM) 4*512kB (M) 5*1024kB (UM) 3*2048kB (UM) 953*4096kB (M) = 3919472kB [ 1302.702464][T17435] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1302.702484][T17435] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1302.702504][T17435] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1302.702523][T17435] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1302.702541][T17435] 55403 total pagecache pages [ 1302.702551][T17435] 0 pages in swap cache [ 1302.702559][T17435] Free swap = 124996kB [ 1302.702569][T17435] Total swap = 124996kB [ 1302.702582][T17435] 2097051 pages RAM [ 1302.702590][T17435] 0 pages HighMem/MovableOnly [ 1302.702599][T17435] 430909 pages reserved [ 1302.702607][T17435] 0 pages cma reserved [ 1302.762532][T17328] hsr_slave_0: entered promiscuous mode [ 1302.763033][T17328] hsr_slave_1: entered promiscuous mode [ 1302.763368][T17328] debugfs: 'hsr0' already exists in 'hsr' [ 1302.763380][T17328] Cannot create hsr debugfs directory [ 1303.406890][T17456] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 1305.242857][T17462] fuse: Unknown parameter '0x0000000000000008' [ 1305.796793][T17328] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1305.916387][T17328] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1305.944506][T17328] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1305.972461][T17328] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1306.274039][T17328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1306.305752][T17328] 8021q: adding VLAN 0 to HW filter on device team0 [ 1306.440265][T17486] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 1306.452780][T14840] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 1306.789270][ T1150] bridge0: port 1(bridge_slave_0) entered blocking state [ 1306.796467][ T1150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1307.371708][ T1150] bridge0: port 2(bridge_slave_1) entered blocking state [ 1307.378885][ T1150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1307.523004][T14840] usb 1-1: device descriptor read/64, error -71 [ 1307.792938][T14840] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 1307.853201][T17500] (syz.4.2895,17500,0):ocfs2_get_sector:1714 ERROR: status = -5 [ 1307.860931][T17500] (syz.4.2895,17500,0):ocfs2_sb_probe:753 ERROR: status = -5 [ 1307.868551][T17500] (syz.4.2895,17500,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 1307.877570][T17500] (syz.4.2895,17500,0):ocfs2_fill_super:1177 ERROR: status = -5 [ 1307.985878][T14840] usb 1-1: device descriptor read/64, error -71 [ 1308.134660][T14840] usb usb1-port1: attempt power cycle [ 1308.356346][T17328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1308.482647][T14840] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 1308.582734][T17510] (syz.4.2896,17510,0):ocfs2_get_sector:1714 ERROR: status = -5 [ 1308.590442][T17510] (syz.4.2896,17510,0):ocfs2_sb_probe:753 ERROR: status = -5 [ 1308.597947][T17510] (syz.4.2896,17510,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 1308.607944][T17510] (syz.4.2896,17510,0):ocfs2_fill_super:1177 ERROR: status = -5 [ 1308.629941][T14840] usb 1-1: device descriptor read/8, error -71 [ 1308.922250][T14840] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 1309.070464][T17516] xt_policy: too many policy elements [ 1309.142719][T17519] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2898'. [ 1309.385760][T17519] nbd: socks must be embedded in a SOCK_ITEM attr [ 1309.419664][T14671] block nbd64: NBD_DISCONNECT [ 1309.881449][T17328] veth0_vlan: entered promiscuous mode [ 1309.906251][T17328] veth1_vlan: entered promiscuous mode [ 1309.999150][T14840] usb 1-1: device descriptor read/8, error -71 [ 1310.113602][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1310.164139][T14840] usb usb1-port1: unable to enumerate USB device [ 1310.371522][ T5885] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1310.505317][T17328] veth0_macvtap: entered promiscuous mode [ 1310.792883][T17328] veth1_macvtap: entered promiscuous mode [ 1311.312026][T17328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1311.433633][T17328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1311.522328][T12455] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1311.536795][T12455] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1311.635858][T12455] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1311.663269][T12455] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1311.729037][ T5885] usb 6-1: New USB device found, idVendor=0c72, idProduct=0012, bcdDevice=22.96 [ 1311.748364][ T5885] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1311.793912][ T5885] usb 6-1: Product: syz [ 1311.814248][ T5885] usb 6-1: Manufacturer: syz [ 1311.826665][ T5885] usb 6-1: SerialNumber: syz [ 1311.838655][ T5885] usb 6-1: config 0 descriptor?? [ 1311.851146][T17536] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2901'. [ 1311.878764][ T30] audit: type=1326 audit(2000001721.417:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1311.928525][ T30] audit: type=1326 audit(2000001721.417:550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1311.968220][T12455] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1311.980650][T12455] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1311.996510][ T30] audit: type=1326 audit(2000001721.447:551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1312.024462][ T30] audit: type=1326 audit(2000001721.447:552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1312.117717][ T30] audit: type=1326 audit(2000001721.447:553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1312.256886][T16117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1312.267339][T16117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1312.328373][ T30] audit: type=1326 audit(2000001721.447:554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1312.464984][ T30] audit: type=1326 audit(2000001721.447:555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1312.692145][ T30] audit: type=1326 audit(2000001721.447:556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1312.865287][T17557] netlink: 80 bytes leftover after parsing attributes in process `syz.7.2865'. [ 1314.042388][ T5912] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 1314.250043][ T5912] usb 1-1: Using ep0 maxpacket: 32 [ 1314.264770][ T5912] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1314.292974][ T5912] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1314.341652][ T5912] usb 1-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=d2.a2 [ 1314.360623][ T5912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1314.361579][ T30] audit: type=1326 audit(2000001721.467:557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1314.379437][ T5912] usb 1-1: Product: syz [ 1314.419430][ T5912] usb 1-1: Manufacturer: syz [ 1314.424153][ T5912] usb 1-1: SerialNumber: syz [ 1314.508611][ T30] audit: type=1326 audit(2000001721.467:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17533 comm="syz.4.2901" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdf12d9c819 code=0x7ffc0000 [ 1315.003369][ T5912] usb 1-1: config 0 descriptor?? [ 1315.019930][ T5912] keyspan 1-1:0.0: Keyspan 1 port adapter converter detected [ 1315.028236][ T5912] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 87 [ 1315.037065][ T5912] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 7 [ 1315.048263][ T5912] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 81 [ 1315.189170][ T5912] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 1 [ 1315.197567][ T5912] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 2 [ 1315.205298][ T5912] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 85 [ 1315.227483][ T5885] peak_usb 6-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 1315.239775][ T5885] peak_usb 6-1:0.0: unable to read PCAN-USB FD firmware info (err -71) [ 1315.319272][ T5912] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 5 [ 1315.340148][T17549] netlink: 'syz.0.2905': attribute type 1 has an invalid length. [ 1315.362232][ T5912] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1316.100161][ T5885] peak_usb 6-1:0.0: probe with driver peak_usb failed with error -71 [ 1316.133328][ T5885] usb 6-1: USB disconnect, device number 68 [ 1317.328123][ T5885] usb 1-1: USB disconnect, device number 85 [ 1317.353311][ T5885] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1317.409659][ T5885] keyspan 1-1:0.0: device disconnected [ 1320.269734][T17607] netlink: 80 bytes leftover after parsing attributes in process `syz.5.2917'. [ 1321.306319][T16928] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1321.319772][T16928] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1321.327703][T16928] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1321.335554][T16928] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1321.396178][T16928] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1322.610040][T17617] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1322.619472][T17617] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1322.629122][T17617] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1322.968249][ T1326] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1323.005238][ T1326] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1323.042774][ T1326] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1323.115135][T14748] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1323.277086][T14748] usb 8-1: config 0 has no interfaces? [ 1323.301077][T14748] usb 8-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1323.335060][T14748] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1323.360671][T14748] usb 8-1: Product: syz [ 1323.372078][T14748] usb 8-1: Manufacturer: syz [ 1323.404982][T14748] usb 8-1: SerialNumber: syz [ 1323.426236][T14748] usb 8-1: config 0 descriptor?? [ 1323.436731][ T1326] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1323.457055][T13901] Bluetooth: hci2: command tx timeout [ 1323.540780][ T1326] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1324.011461][ T1326] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1324.928432][ T1326] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1324.939406][ T1326] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1324.950125][ T1326] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1325.531876][T13901] Bluetooth: hci2: command tx timeout [ 1325.570458][ T1326] netdevsim netdevsim0 netdevsim0 (unregistering): left allmulticast mode [ 1325.611043][ T1326] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1325.651366][ T1326] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1325.689884][ T1326] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1326.387058][T14748] usb 8-1: USB disconnect, device number 2 [ 1326.843263][T14748] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 1326.862216][T17610] chnl_net:caif_netlink_parms(): no params data found [ 1326.880809][ T1326] bridge_slave_1: left allmulticast mode [ 1326.887855][ T1326] bridge_slave_1: left promiscuous mode [ 1326.894127][ T1326] bridge0: port 2(bridge_slave_1) entered disabled state [ 1326.914548][ T1326] bridge_slave_0: left allmulticast mode [ 1326.928446][ T1326] bridge_slave_0: left promiscuous mode [ 1326.943433][ T1326] bridge0: port 1(bridge_slave_0) entered disabled state [ 1327.008623][T14748] usb 8-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1327.017999][T14748] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1327.037196][T14748] usb 8-1: Product: syz [ 1327.046837][T14748] usb 8-1: Manufacturer: syz [ 1327.109920][T14748] usb 8-1: SerialNumber: syz [ 1327.283849][T14840] SELinux: failure in sel_netif_sid_slow(), invalid network interface (498) [ 1327.357610][T17679] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2916'. [ 1327.602940][T13901] Bluetooth: hci2: command tx timeout [ 1327.744756][T14748] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1327.778366][T14748] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1328.799372][T14840] SELinux: failure in sel_netif_sid_slow(), invalid network interface (498) [ 1328.912916][ T1326] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1328.925331][ T1326] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1328.942964][ T1326] bond0 (unregistering): Released all slaves [ 1329.103080][ T1326] bond1 (unregistering): Released all slaves [ 1329.121026][T14748] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1329.136779][ T1326] bond2 (unregistering): Released all slaves [ 1329.198062][T17692] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2928'. [ 1329.607973][T14748] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1329.664210][T14748] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1329.681798][T13901] Bluetooth: hci2: command tx timeout [ 1329.851781][T14748] lan78xx 8-1:1.0: probe with driver lan78xx failed with error -32 [ 1329.919094][ T1326] hmaÓË224): left promiscuous mode [ 1330.147418][ T5858] usb 8-1: USB disconnect, device number 3 [ 1331.365851][ T1326] tipc: Left network mode [ 1331.490530][T17610] bridge0: port 1(bridge_slave_0) entered blocking state [ 1331.526655][T17610] bridge0: port 1(bridge_slave_0) entered disabled state [ 1331.575616][T17610] bridge_slave_0: entered allmulticast mode [ 1331.666012][T17610] bridge_slave_0: entered promiscuous mode [ 1331.721028][T17610] bridge0: port 2(bridge_slave_1) entered blocking state [ 1331.761029][T17610] bridge0: port 2(bridge_slave_1) entered disabled state [ 1332.531050][T17610] bridge_slave_1: entered allmulticast mode [ 1332.549570][T17610] bridge_slave_1: entered promiscuous mode [ 1332.597549][T17724] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 1332.635207][T17723] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1332.644626][T17723] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1332.654241][T17723] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1332.716336][T17719] ALSA: mixer_oss: invalid OSS volume 'u' [ 1332.891952][T17610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1332.936603][T17610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1333.130882][T17610] team0: Port device team_slave_0 added [ 1333.196572][T13901] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 1333.207353][T13901] CPU: 0 UID: 0 PID: 13901 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1333.207391][T13901] Tainted: [L]=SOFTLOCKUP [ 1333.207400][T13901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1333.207424][T13901] Workqueue: hci0 hci_rx_work [ 1333.207458][T13901] Call Trace: [ 1333.207467][T13901] [ 1333.207477][T13901] dump_stack_lvl+0x100/0x190 [ 1333.207519][T13901] sysfs_warn_dup.cold+0x1c/0x28 [ 1333.207551][T13901] sysfs_create_dir_ns+0x24b/0x2b0 [ 1333.207589][T13901] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1333.207623][T13901] ? find_held_lock+0x2b/0x80 [ 1333.207653][T13901] ? kobject_add_internal+0x25f/0x930 [ 1333.207678][T13901] ? kobject_add_internal+0x25f/0x930 [ 1333.207706][T13901] ? do_raw_spin_unlock+0x145/0x1e0 [ 1333.207736][T13901] kobject_add_internal+0x2c8/0x930 [ 1333.207767][T13901] kobject_add+0x16a/0x1e0 [ 1333.207792][T13901] ? __pfx_kobject_add+0x10/0x10 [ 1333.207851][T13901] device_add+0x294/0x1950 [ 1333.207880][T13901] ? __pfx_dev_set_name+0x10/0x10 [ 1333.207913][T13901] ? __pfx_device_add+0x10/0x10 [ 1333.207941][T13901] ? mgmt_send_event_skb+0x2fb/0x460 [ 1333.207982][T13901] hci_conn_add_sysfs+0x1a3/0x260 [ 1333.208017][T13901] le_conn_complete_evt+0x11eb/0x1f60 [ 1333.208056][T13901] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1333.208094][T13901] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1333.208125][T13901] ? skb_pull_data+0x15f/0x1e0 [ 1333.208154][T13901] hci_le_meta_evt+0x34a/0x5f0 [ 1333.208190][T13901] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1333.208227][T13901] hci_event_packet+0x51c/0xcd0 [ 1333.208258][T13901] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1333.208291][T13901] ? __pfx_hci_event_packet+0x10/0x10 [ 1333.208326][T13901] ? kcov_remote_start+0x384/0x660 [ 1333.208365][T13901] hci_rx_work+0x451/0xfc0 [ 1333.208399][T13901] process_one_work+0xa23/0x19a0 [ 1333.208439][T13901] ? __pfx_process_one_work+0x10/0x10 [ 1333.208474][T13901] ? __pfx_hci_rx_work+0x10/0x10 [ 1333.208506][T13901] worker_thread+0x5ef/0xe50 [ 1333.208548][T13901] ? kthread+0x13a/0x450 [ 1333.208571][T13901] ? __pfx_worker_thread+0x10/0x10 [ 1333.208596][T13901] kthread+0x370/0x450 [ 1333.208619][T13901] ? __pfx_kthread+0x10/0x10 [ 1333.208644][T13901] ret_from_fork+0x754/0xd80 [ 1333.208672][T13901] ? __pfx_ret_from_fork+0x10/0x10 [ 1333.208698][T13901] ? __switch_to+0x7b4/0x1120 [ 1333.208727][T13901] ? __pfx_kthread+0x10/0x10 [ 1333.208753][T13901] ret_from_fork_asm+0x1a/0x30 [ 1333.208797][T13901] [ 1333.208948][T13901] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1333.486700][T17735] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2937'. [ 1333.515436][T13901] Bluetooth: hci0: failed to register connection device [ 1333.567066][T17610] team0: Port device team_slave_1 added [ 1333.761147][T17735] nbd: socks must be embedded in a SOCK_ITEM attr [ 1335.323081][T17610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1335.399251][T17610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1335.403489][T14670] udevd[14670]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1335.444524][T17610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1335.499795][T17610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1335.548649][T17610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1335.616808][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1335.677872][T17610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1335.790503][ T1326] hsr_slave_0: left promiscuous mode [ 1335.815065][ T1326] hsr_slave_1: left promiscuous mode [ 1335.838429][ T1326] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1335.863591][ T1326] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1335.894792][ T1326] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1335.910650][ T1326] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1335.956812][ T1326] veth1_macvtap: left promiscuous mode [ 1335.980206][ T1326] veth0_macvtap: left promiscuous mode [ 1336.014157][ T1326] veth1_vlan: left promiscuous mode [ 1336.028860][ T1326] veth0_vlan: left promiscuous mode [ 1337.018173][ T5858] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 1337.188755][ T5858] usb 8-1: Using ep0 maxpacket: 32 [ 1337.223976][ T5858] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1337.305495][ T5858] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1337.446213][ T5858] usb 8-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=d2.a2 [ 1337.521658][ T5858] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1337.604204][ T5858] usb 8-1: Product: syz [ 1337.656682][ T5858] usb 8-1: Manufacturer: syz [ 1337.731467][ T5858] usb 8-1: SerialNumber: syz [ 1337.841090][ T5858] usb 8-1: config 0 descriptor?? [ 1338.028178][ T5858] keyspan 8-1:0.0: Keyspan 1 port adapter converter detected [ 1338.039927][T17770] 9p: Bad value for 'rfdno' [ 1338.059375][T17771] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2930'. [ 1338.070411][T17770] netlink: 'syz.3.2941': attribute type 10 has an invalid length. [ 1338.079653][ T5858] keyspan 8-1:0.0: found no endpoint descriptor for endpoint 87 [ 1338.094089][ T5858] keyspan 8-1:0.0: found no endpoint descriptor for endpoint 7 [ 1338.125515][ T5858] keyspan 8-1:0.0: found no endpoint descriptor for endpoint 81 [ 1338.152649][ T5858] keyspan 8-1:0.0: found no endpoint descriptor for endpoint 1 [ 1338.168180][T17760] netlink: 'syz.7.2939': attribute type 1 has an invalid length. [ 1338.196546][ T5858] keyspan 8-1:0.0: found no endpoint descriptor for endpoint 2 [ 1338.233983][ T5858] keyspan 8-1:0.0: found no endpoint descriptor for endpoint 85 [ 1338.270379][ T5858] keyspan 8-1:0.0: found no endpoint descriptor for endpoint 5 [ 1338.292012][ T5858] usb 8-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1338.989920][T17770] veth0_vlan: left promiscuous mode [ 1338.995765][T17770] veth0_vlan: entered promiscuous mode [ 1339.006727][T17770] team0: Device veth0_vlan failed to register rx_handler [ 1339.139960][ T5871] usb 8-1: USB disconnect, device number 4 [ 1339.158530][ T5871] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1339.173392][T17610] hsr_slave_0: entered promiscuous mode [ 1339.251042][ T5871] keyspan 8-1:0.0: device disconnected [ 1339.261295][T17610] hsr_slave_1: entered promiscuous mode [ 1339.279371][T17610] debugfs: 'hsr0' already exists in 'hsr' [ 1339.285180][T17610] Cannot create hsr debugfs directory [ 1341.302753][T17808] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1341.312130][T17808] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1341.321704][T17808] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1343.638345][T17610] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1343.693490][T17610] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1343.724251][T17610] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1343.753902][T17610] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1343.875783][T17833] tmpfs: Unknown parameter 'grpquota_in' [ 1344.122613][T17610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1344.264249][T17610] 8021q: adding VLAN 0 to HW filter on device team0 [ 1344.317173][ T6077] bridge0: port 1(bridge_slave_0) entered blocking state [ 1344.324326][ T6077] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1344.388509][ T6077] bridge0: port 2(bridge_slave_1) entered blocking state [ 1344.395707][ T6077] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1345.795884][T17864] netlink: 88 bytes leftover after parsing attributes in process `syz.4.2956'. [ 1345.805232][T17864] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2956'. [ 1346.665624][T17610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1346.783948][T17767] usb 5-1: new full-speed USB device number 89 using dummy_hcd [ 1346.834644][T17610] veth0_vlan: entered promiscuous mode [ 1346.936294][T17879] netdevsim netdevsim7: loading /lib/firmware/. failed with error -22 [ 1346.945113][T17879] netdevsim netdevsim7: Direct firmware load for . failed with error -22 [ 1346.953760][T17879] netdevsim netdevsim7: Falling back to sysfs fallback for: . [ 1347.355963][T17610] veth1_vlan: entered promiscuous mode [ 1347.376869][T17767] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1347.415408][T17767] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1347.478941][T17767] usb 5-1: Product: syz [ 1347.501881][T17767] usb 5-1: Manufacturer: syz [ 1347.530275][T17767] usb 5-1: SerialNumber: syz [ 1347.720445][T17610] veth0_macvtap: entered promiscuous mode [ 1347.899181][T17610] veth1_macvtap: entered promiscuous mode [ 1347.981523][T17892] openvswitch: netlink: Missing key (keys=800040, expected=2000) [ 1348.078618][T17893] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2958'. [ 1348.370006][T17610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1348.374497][T17767] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1348.380890][T17610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1348.435980][ T1150] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1348.481927][ T1326] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1348.489192][T17767] usb 5-1: 2:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1348.547674][ T1326] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1348.714998][T17767] usb 5-1: found format II with max.bitrate = 0, frame size=9 [ 1348.741683][ T1326] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1349.196926][T17767] usb 5-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 1349.207571][T17767] usb 5-1: 2:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1349.261761][T17767] usb 5-1: found format II with max.bitrate = 0, frame size=9 [ 1349.373355][T17767] usb 5-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 1349.417627][T17767] usb 5-1: unit 5 not found! [ 1349.480444][T17767] usb 5-1: unit 2 not found! [ 1349.573322][ T6077] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1349.861714][ T6077] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1349.931978][T17767] usb 5-1: USB disconnect, device number 89 [ 1350.101662][ T6077] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1350.151618][ T6077] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1352.481577][T17941] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 1352.489895][T17941] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 1352.498419][T17941] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 1353.001353][T16928] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1353.025346][T16928] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1353.035575][T16928] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1353.046242][T16928] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1353.053994][T16928] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1353.391933][T17953] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2971'. [ 1353.761378][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 1353.761394][ T30] audit: type=1400 audit(2000001762.948:572): avc: denied { ioctl } for pid=17950 comm="syz.0.2971" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1354.709580][T13901] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 1354.726158][T13901] CPU: 1 UID: 0 PID: 13901 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1354.726201][T13901] Tainted: [L]=SOFTLOCKUP [ 1354.726211][T13901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1354.726228][T13901] Workqueue: hci2 hci_rx_work [ 1354.726263][T13901] Call Trace: [ 1354.726271][T13901] [ 1354.726281][T13901] dump_stack_lvl+0x100/0x190 [ 1354.726319][T13901] sysfs_warn_dup.cold+0x1c/0x28 [ 1354.726354][T13901] sysfs_create_dir_ns+0x24b/0x2b0 [ 1354.726392][T13901] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1354.726426][T13901] ? find_held_lock+0x2b/0x80 [ 1354.726455][T13901] ? kobject_add_internal+0x25f/0x930 [ 1354.726481][T13901] ? kobject_add_internal+0x25f/0x930 [ 1354.726509][T13901] ? do_raw_spin_unlock+0x145/0x1e0 [ 1354.726539][T13901] kobject_add_internal+0x2c8/0x930 [ 1354.726569][T13901] kobject_add+0x16a/0x1e0 [ 1354.726594][T13901] ? __pfx_kobject_add+0x10/0x10 [ 1354.726618][T13901] ? class_to_subsys+0x10f/0x150 [ 1354.726650][T13901] ? kobject_put+0xb9/0x640 [ 1354.726672][T13901] ? _raw_spin_unlock+0x28/0x50 [ 1354.726712][T13901] device_add+0x294/0x1950 [ 1354.726739][T13901] ? __pfx_dev_set_name+0x10/0x10 [ 1354.726770][T13901] ? __pfx_device_add+0x10/0x10 [ 1354.726797][T13901] ? mgmt_send_event_skb+0x2fb/0x460 [ 1354.726834][T13901] hci_conn_add_sysfs+0x1a3/0x260 [ 1354.726869][T13901] le_conn_complete_evt+0x11eb/0x1f60 [ 1354.726908][T13901] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1354.726947][T13901] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1354.726979][T13901] ? skb_pull_data+0x15f/0x1e0 [ 1354.727008][T13901] hci_le_meta_evt+0x34a/0x5f0 [ 1354.727040][T13901] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1354.727077][T13901] hci_event_packet+0x51c/0xcd0 [ 1354.727108][T13901] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1354.727140][T13901] ? __pfx_hci_event_packet+0x10/0x10 [ 1354.727177][T13901] ? kcov_remote_start+0x384/0x660 [ 1354.727223][T13901] hci_rx_work+0x451/0xfc0 [ 1354.727261][T13901] process_one_work+0xa23/0x19a0 [ 1354.727302][T13901] ? __pfx_process_one_work+0x10/0x10 [ 1354.727337][T13901] ? __pfx_hci_rx_work+0x10/0x10 [ 1354.727370][T13901] worker_thread+0x5ef/0xe50 [ 1354.727408][T13901] ? kthread+0x13a/0x450 [ 1354.727428][T13901] ? __pfx_worker_thread+0x10/0x10 [ 1354.727452][T13901] kthread+0x370/0x450 [ 1354.727473][T13901] ? __pfx_kthread+0x10/0x10 [ 1354.727498][T13901] ret_from_fork+0x754/0xd80 [ 1354.727525][T13901] ? __pfx_ret_from_fork+0x10/0x10 [ 1354.727552][T13901] ? __switch_to+0x7b4/0x1120 [ 1354.727580][T13901] ? __pfx_kthread+0x10/0x10 [ 1354.727606][T13901] ret_from_fork_asm+0x1a/0x30 [ 1354.727649][T13901] [ 1355.019414][T13901] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1355.033782][T13901] Bluetooth: hci2: failed to register connection device [ 1355.109189][T13901] Bluetooth: hci4: command tx timeout [ 1355.310697][T17965] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2974'. [ 1355.570120][T17965] nbd: socks must be embedded in a SOCK_ITEM attr [ 1357.116369][T17978] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 1357.179323][T17978] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 1357.198277][T13901] Bluetooth: hci4: command tx timeout [ 1357.210122][T14670] udevd[14670]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1357.250077][T17978] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 1357.268764][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1357.339892][T17767] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1357.518184][T17767] usb 5-1: Using ep0 maxpacket: 32 [ 1357.555183][T17767] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1357.593156][T17767] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1357.648966][T17767] usb 5-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=d2.a2 [ 1357.664117][T17767] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1357.722444][T17767] usb 5-1: Product: syz [ 1357.767344][T17767] usb 5-1: Manufacturer: syz [ 1357.814391][T17767] usb 5-1: SerialNumber: syz [ 1357.878736][T17767] usb 5-1: config 0 descriptor?? [ 1357.912210][T17948] chnl_net:caif_netlink_parms(): no params data found [ 1357.954954][T17767] keyspan 5-1:0.0: Keyspan 1 port adapter converter detected [ 1358.016071][T17767] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 87 [ 1358.127533][ T6077] vlan2: left allmulticast mode [ 1358.132437][ T6077] dummy0: left allmulticast mode [ 1358.142437][T17767] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 7 [ 1358.315665][T17767] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 81 [ 1358.684861][T17767] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 1 [ 1358.941160][T17767] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 2 [ 1358.969932][ T6077] vlan2: left promiscuous mode [ 1358.975049][ T6077] dummy0: left promiscuous mode [ 1358.980262][ T6077] bridge0: port 3(vlan2) entered disabled state [ 1358.997924][T17977] netlink: 'syz.4.2977': attribute type 1 has an invalid length. [ 1359.012172][ T6077] bridge_slave_1: left allmulticast mode [ 1359.019423][ T6077] bridge_slave_1: left promiscuous mode [ 1359.025089][ T6077] bridge0: port 2(bridge_slave_1) entered disabled state [ 1359.032211][T17767] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 85 [ 1359.044993][ T30] audit: type=1400 audit(2000001768.611:573): avc: denied { create } for pid=17996 comm="syz.5.2979" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1359.090702][T17767] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 5 [ 1359.108189][ T6077] bridge_slave_0: left allmulticast mode [ 1359.113903][ T6077] bridge_slave_0: left promiscuous mode [ 1359.125269][ T6077] bridge0: port 1(bridge_slave_0) entered disabled state [ 1359.162560][T17767] usb 5-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1359.214202][ T30] audit: type=1400 audit(2000001768.781:574): avc: denied { create } for pid=17996 comm="syz.5.2979" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 1359.244601][ T30] audit: type=1400 audit(2000001768.781:575): avc: denied { create } for pid=17996 comm="syz.5.2979" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1359.267334][T13901] Bluetooth: hci4: command tx timeout [ 1360.124205][ T6077] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1360.984449][ T6077] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1361.008038][ T6077] bond0 (unregistering): Released all slaves [ 1361.021991][ T6077] bond1 (unregistering): Released all slaves [ 1361.060356][ T6077] bond2 (unregistering): Released all slaves [ 1361.097432][ T6077] bond3 (unregistering): Released all slaves [ 1361.153406][T17977] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1361.200683][T18021] netdevsim netdevsim7: loading /lib/firmware/. failed with error -22 [ 1361.232983][ T6077] hmaÓË224): left promiscuous mode [ 1361.253788][T18021] netdevsim netdevsim7: Direct firmware load for . failed with error -22 [ 1361.284219][ T5871] usb 5-1: USB disconnect, device number 90 [ 1361.303680][ T5871] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1361.325416][T18021] netdevsim netdevsim7: Falling back to sysfs fallback for: . [ 1361.358422][T13901] Bluetooth: hci4: command tx timeout [ 1361.395718][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.452513][ T6077] !: left promiscuous mode [ 1362.137045][ T5871] keyspan 5-1:0.0: device disconnected [ 1362.415142][ T6077] tipc: Left network mode [ 1362.439360][T17948] bridge0: port 1(bridge_slave_0) entered blocking state [ 1362.465572][T17948] bridge0: port 1(bridge_slave_0) entered disabled state [ 1362.503301][T17948] bridge_slave_0: entered allmulticast mode [ 1362.527710][T17948] bridge_slave_0: entered promiscuous mode [ 1362.548008][T17948] bridge0: port 2(bridge_slave_1) entered blocking state [ 1362.566054][T17948] bridge0: port 2(bridge_slave_1) entered disabled state [ 1362.615196][T17948] bridge_slave_1: entered allmulticast mode [ 1362.631582][T17948] bridge_slave_1: entered promiscuous mode [ 1363.331326][T17948] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1363.398971][T17948] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1364.341881][T17948] team0: Port device team_slave_0 added [ 1364.420832][T17948] team0: Port device team_slave_1 added [ 1364.903619][T18074] fuse: Unknown parameter '0x0000000000000008' [ 1365.121220][T17948] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1365.171247][T17948] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1365.254132][T17948] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1365.541645][ T6077] hsr_slave_0: left promiscuous mode [ 1365.587012][ T6077] hsr_slave_1: left promiscuous mode [ 1365.760724][T18088] 9p: Bad value for 'wfdno' [ 1366.043634][T17659] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1366.094641][ T6077] team0 (unregistering): Port device team_slave_1 removed [ 1366.603393][T17659] usb 5-1: Using ep0 maxpacket: 32 [ 1366.636484][T17659] usb 5-1: config 0 has an invalid interface number: 188 but max is 0 [ 1366.746787][T17659] usb 5-1: config 0 has no interface number 0 [ 1366.777244][T17659] usb 5-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1366.794961][ T6077] team0 (unregistering): Port device team_slave_0 removed [ 1366.856792][T17659] usb 5-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1366.876404][T17659] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.908442][T17659] usb 5-1: Product: syz [ 1366.937939][T17659] usb 5-1: Manufacturer: syz [ 1366.942542][T17659] usb 5-1: SerialNumber: syz [ 1366.990953][T17659] usb 5-1: config 0 descriptor?? [ 1366.999825][T18088] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1367.207587][T17948] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1367.223511][T18088] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1367.242803][T17948] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1367.320155][T17948] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1367.371400][T18089] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1367.454759][T18089] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1367.545687][T18089] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1367.602720][T17948] hsr_slave_0: entered promiscuous mode [ 1367.622538][T17948] hsr_slave_1: entered promiscuous mode [ 1367.648619][T17948] debugfs: 'hsr0' already exists in 'hsr' [ 1367.769300][T18092] netlink: 'syz.4.2992': attribute type 10 has an invalid length. [ 1367.783234][T17948] Cannot create hsr debugfs directory [ 1368.126338][T18092] veth0_vlan: left promiscuous mode [ 1368.204037][T18092] veth0_vlan: entered promiscuous mode [ 1368.281279][T18092] team0: Device veth0_vlan failed to register rx_handler [ 1369.208153][T18097] mac80211_hwsim hwsim20 wlan1: entered allmulticast mode [ 1369.362953][T17659] asix 5-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1369.432740][T17659] asix 5-1:0.188: probe with driver asix failed with error -71 [ 1369.591865][T17659] usb 5-1: USB disconnect, device number 91 [ 1370.144578][ T6077] IPVS: stop unused estimator thread 0... [ 1371.502873][T18123] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 1371.571331][T18123] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 1371.662543][T18123] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 1373.427824][T18156] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 1373.496846][T18156] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1375.659893][T17948] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1375.713254][T17948] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1375.748026][T17948] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1376.044730][T18196] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 1376.444580][T18196] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 1376.463657][T17948] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1376.562791][T18196] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 1377.048788][T17948] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1377.261262][T17948] 8021q: adding VLAN 0 to HW filter on device team0 [ 1377.345368][T12455] bridge0: port 1(bridge_slave_0) entered blocking state [ 1377.352527][T12455] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1377.437622][T12455] bridge0: port 2(bridge_slave_1) entered blocking state [ 1377.444865][T12455] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1378.770547][T18221] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1378.779962][T18221] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1378.789565][T18221] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1380.609627][T17948] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1380.824260][T17948] veth0_vlan: entered promiscuous mode [ 1380.928060][T17948] veth1_vlan: entered promiscuous mode [ 1381.118165][T17948] veth0_macvtap: entered promiscuous mode [ 1381.616670][T17948] veth1_macvtap: entered promiscuous mode [ 1381.709819][T17948] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1381.772870][T17948] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1381.842549][ T162] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1381.880465][ T162] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1381.995652][ T162] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1382.069572][T16116] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1382.626862][ T162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1382.634708][ T162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1382.822465][T16117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1382.835307][T16117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1382.902220][T18270] xt_ipcomp: unknown flags 1D [ 1384.145221][ T5858] usb 1-1: new full-speed USB device number 86 using dummy_hcd [ 1384.282574][ T30] audit: type=1400 audit(2000002305.841:576): avc: denied { mounton } for pid=18287 comm="syz.3.3027" path="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 1384.336660][ T5858] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 1384.365265][ T30] audit: type=1400 audit(2000002305.901:577): avc: denied { unmount } for pid=17948 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 1384.385388][ T5858] usb 1-1: config 8 has no interface number 0 [ 1384.391504][ T5858] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1384.462766][T18299] netlink: 80 bytes leftover after parsing attributes in process `syz.7.3026'. [ 1384.873095][ T5858] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1384.897860][ T5858] usb 1-1: config 8 interface 177 has no altsetting 0 [ 1384.909023][ T5858] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1384.942214][ T5858] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1385.488235][T18280] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1385.613962][T18280] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1385.652158][ C0] ir_toy 1-1:8.177: out urb status: -71 [ 1386.429514][ T5858] ir_toy 1-1:8.177: could not write reset command: -110 [ 1386.480573][ T5858] ir_toy 1-1:8.177: probe with driver ir_toy failed with error -110 [ 1386.548193][ T5858] usb 1-1: USB disconnect, device number 86 [ 1387.424130][T13901] Bluetooth: hci5: Dropping invalid advertising data [ 1387.431619][T13901] Bluetooth: hci5: Malformed LE Event: 0x02 [ 1387.971355][T16928] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1387.987598][T16928] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1387.997486][T16928] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1388.038096][T16928] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1388.343351][T16928] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1390.104613][T18358] 9p: Bad value for 'wfdno' [ 1390.161317][T18180] bond0: (slave syz_tun): Releasing backup interface [ 1390.371583][ T24] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1390.515479][T13901] Bluetooth: hci1: command tx timeout [ 1390.645305][T18346] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1390.793060][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 1390.867598][T18370] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3040'. [ 1390.964291][ T24] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 1391.260718][T18346] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1391.290382][ T24] usb 6-1: config 0 has no interface number 0 [ 1391.307957][T18346] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1391.317477][ T24] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1391.356162][ T24] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1391.398592][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1391.517760][ T24] usb 6-1: Product: syz [ 1391.561055][ T24] usb 6-1: Manufacturer: syz [ 1391.565661][ T24] usb 6-1: SerialNumber: syz [ 1391.597567][T18373] 9p: Bad value for 'wfdno' [ 1391.636621][ T24] usb 6-1: config 0 descriptor?? [ 1391.669866][T18358] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1391.883037][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.896275][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1391.907119][T18358] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1391.914461][T14840] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 1392.605292][T13901] Bluetooth: hci1: command tx timeout [ 1392.621349][T14840] usb 8-1: Using ep0 maxpacket: 32 [ 1392.638498][T14840] usb 8-1: config 0 has an invalid interface number: 188 but max is 0 [ 1392.663564][T14840] usb 8-1: config 0 has no interface number 0 [ 1392.683540][T14840] usb 8-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1392.742769][T14840] usb 8-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1392.786898][T14840] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1392.905659][T18385] netlink: 'syz.5.3039': attribute type 10 has an invalid length. [ 1393.168774][ T24] asix 6-1:0.188 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1393.211388][T14840] usb 8-1: Product: syz [ 1393.226373][T14840] usb 8-1: Manufacturer: syz [ 1393.251049][T14840] usb 8-1: SerialNumber: syz [ 1393.291250][T14840] usb 8-1: config 0 descriptor?? [ 1393.301819][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.321612][T18373] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1393.345391][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1393.409292][T18385] veth0_vlan: left promiscuous mode [ 1393.437824][T18385] veth0_vlan: entered promiscuous mode [ 1393.491058][T18385] team0: Device veth0_vlan failed to register rx_handler [ 1393.571618][T18373] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1393.635612][ T24] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1393.684623][ T24] asix 6-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 1393.702489][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.723663][ T24] asix 6-1:0.188: probe with driver asix failed with error -71 [ 1393.740115][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1393.776580][ T24] usb 6-1: USB disconnect, device number 69 [ 1393.915194][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1393.947007][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1394.129623][T18389] netlink: 'syz.7.3041': attribute type 10 has an invalid length. [ 1394.285495][T18389] veth0_vlan: left promiscuous mode [ 1394.298276][T18389] veth0_vlan: entered promiscuous mode [ 1394.323484][T18389] team0: Device veth0_vlan failed to register rx_handler [ 1394.459486][T18336] chnl_net:caif_netlink_parms(): no params data found [ 1394.780252][T13901] Bluetooth: hci1: command tx timeout [ 1395.719164][T14840] asix 8-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1395.783244][T14840] asix 8-1:0.188: probe with driver asix failed with error -61 [ 1395.800333][T18336] bridge0: port 1(bridge_slave_0) entered blocking state [ 1395.909541][T18336] bridge0: port 1(bridge_slave_0) entered disabled state [ 1395.970208][T18336] bridge_slave_0: entered allmulticast mode [ 1396.094541][T14840] usb 8-1: USB disconnect, device number 5 [ 1396.105474][T18336] bridge_slave_0: entered promiscuous mode [ 1396.488702][T18336] bridge0: port 2(bridge_slave_1) entered blocking state [ 1396.539514][T18336] bridge0: port 2(bridge_slave_1) entered disabled state [ 1396.566259][T18336] bridge_slave_1: entered allmulticast mode [ 1396.583879][T18336] bridge_slave_1: entered promiscuous mode [ 1396.861833][T13901] Bluetooth: hci1: command tx timeout [ 1396.993854][T18336] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1397.146233][T18336] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1397.308645][T18336] team0: Port device team_slave_0 added [ 1397.378149][T18336] team0: Port device team_slave_1 added [ 1398.461244][ T12] hsr0: left allmulticast mode [ 1398.490803][ T12] hsr_slave_0: left allmulticast mode [ 1398.511064][ T12] hsr_slave_1: left allmulticast mode [ 1398.583413][ T12] hsr0: left promiscuous mode [ 1398.622238][ T12] bridge0: port 3(hsr0) entered disabled state [ 1398.722299][ T12] bridge_slave_1: left allmulticast mode [ 1398.728062][ T12] bridge_slave_1: left promiscuous mode [ 1398.758618][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 1399.343215][T18448] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3052'. [ 1399.755617][ T12] bridge_slave_0: left allmulticast mode [ 1399.793448][ T12] bridge_slave_0: left promiscuous mode [ 1399.814110][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 1400.258060][T18451] 9p: Bad value for 'wfdno' [ 1400.527145][ T5858] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1401.257995][ T5858] usb 4-1: Using ep0 maxpacket: 32 [ 1401.268366][ T5858] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 1401.281736][ T5858] usb 4-1: config 0 has no interface number 0 [ 1401.294326][ T5858] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1401.344167][ T5858] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1401.360250][ T5858] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.370152][ T5858] usb 4-1: Product: syz [ 1401.375344][ T5858] usb 4-1: Manufacturer: syz [ 1401.380464][ T5858] usb 4-1: SerialNumber: syz [ 1401.403021][ T5858] usb 4-1: config 0 descriptor?? [ 1401.410152][T18451] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1401.676625][T18451] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1401.774207][ T12] bond1 (unregistering): (slave geneve3): Releasing active interface [ 1401.996169][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1402.009741][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1402.023592][ T12] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1402.039082][ T12] bond0 (unregistering): Released all slaves [ 1402.056819][ T12] bond1 (unregistering): Released all slaves [ 1402.090932][T18423] mac80211_hwsim hwsim22 wlan1: entered allmulticast mode [ 1402.100264][T18336] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1402.107607][T18336] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1402.135259][T18336] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1402.233702][T18431] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1402.318802][T18431] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1402.322547][T18456] netlink: 'syz.3.3053': attribute type 10 has an invalid length. [ 1402.570708][T18336] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1402.601214][T18336] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1402.660723][T18336] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1402.672059][T18431] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1402.695468][T18460] 9p: Bad value for 'wfdno' [ 1402.700023][ T12] hmaÓË224): left promiscuous mode [ 1402.808494][ T5858] asix 4-1:0.188 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1402.844088][T18456] veth0_vlan: left promiscuous mode [ 1402.876328][T18456] veth0_vlan: entered promiscuous mode [ 1402.913308][T18456] team0: Device veth0_vlan failed to register rx_handler [ 1402.965173][ T10] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 1403.090300][T18336] hsr_slave_0: entered promiscuous mode [ 1403.111860][T18336] hsr_slave_1: entered promiscuous mode [ 1403.130123][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 1403.137674][T18336] debugfs: 'hsr0' already exists in 'hsr' [ 1403.157072][ T10] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 1403.165015][T18336] Cannot create hsr debugfs directory [ 1403.172918][ T5858] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1403.188887][ T10] usb 1-1: config 0 has no interface number 0 [ 1403.206904][ T5858] asix 4-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 1403.219508][ T10] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1403.244675][ T5858] asix 4-1:0.188: probe with driver asix failed with error -71 [ 1403.257312][ T10] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1403.282188][ T5858] usb 4-1: USB disconnect, device number 78 [ 1403.290967][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1403.315482][ T10] usb 1-1: Product: syz [ 1403.319686][ T10] usb 1-1: Manufacturer: syz [ 1403.324276][ T10] usb 1-1: SerialNumber: syz [ 1403.364182][ T10] usb 1-1: config 0 descriptor?? [ 1403.379993][T18460] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1403.708913][T18460] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1404.354192][T18475] netlink: 'syz.0.3055': attribute type 10 has an invalid length. [ 1404.801860][T18486] 9p: Bad value for 'wfdno' [ 1404.803920][ T10] asix 1-1:0.188 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1404.956711][T18475] veth0_vlan: left promiscuous mode [ 1404.976960][T18475] veth0_vlan: entered promiscuous mode [ 1405.567587][T18475] team0: Device veth0_vlan failed to register rx_handler [ 1405.703804][ T24] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1405.787200][ T10] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1405.808206][ T10] asix 1-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 1405.872862][T18500] netlink: 80 bytes leftover after parsing attributes in process `syz.7.3062'. [ 1406.256072][ T10] asix 1-1:0.188: probe with driver asix failed with error -71 [ 1406.268701][ T10] usb 1-1: USB disconnect, device number 87 [ 1406.283844][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 1406.298311][ T24] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 1406.307677][ T12] hsr_slave_0: left promiscuous mode [ 1406.313080][ T24] usb 6-1: config 0 has no interface number 0 [ 1406.319979][ T12] hsr_slave_1: left promiscuous mode [ 1406.327432][ T24] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1406.338241][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1406.348539][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1406.358779][ T24] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1406.373927][ T12] veth1_macvtap: left promiscuous mode [ 1406.381178][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1406.389391][ T12] veth1_vlan: left promiscuous mode [ 1406.395328][ T24] usb 6-1: Product: syz [ 1406.399740][ T24] usb 6-1: Manufacturer: syz [ 1406.404470][ T24] usb 6-1: SerialNumber: syz [ 1406.417626][ T24] usb 6-1: config 0 descriptor?? [ 1406.429693][T18491] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1406.831165][T18486] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1406.993796][ T30] audit: type=1400 audit(2000002584.584:578): avc: denied { write } for pid=18506 comm="syz.7.3064" name="mouse0" dev="devtmpfs" ino=923 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1407.522360][T18491] netlink: 'syz.5.3061': attribute type 10 has an invalid length. [ 1407.827922][ T24] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1407.863136][ T12] team0 (unregistering): Port device team_slave_1 removed [ 1407.874561][ T24] asix 6-1:0.188: probe with driver asix failed with error -61 [ 1407.900922][ T12] team0 (unregistering): Port device team_slave_0 removed [ 1408.729854][T18491] veth0_vlan: left promiscuous mode [ 1408.772908][T18491] veth0_vlan: entered promiscuous mode [ 1408.810640][T18491] team0: Device veth0_vlan failed to register rx_handler [ 1408.894347][ T24] usb 6-1: USB disconnect, device number 70 [ 1409.178448][ T12] IPVS: stop unused estimator thread 0... [ 1409.194109][T18532] mac80211_hwsim hwsim24 wlan1: entered allmulticast mode [ 1409.890444][T18336] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1409.953782][T18336] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1409.992266][T18336] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1410.018641][T18336] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1411.279273][T18336] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1411.586641][T18336] 8021q: adding VLAN 0 to HW filter on device team0 [ 1411.607008][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1411.614161][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1411.683842][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1411.690981][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1413.529207][T18336] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1415.109520][T13901] Bluetooth: hci0: command 0x0406 tx timeout [ 1416.755214][T18336] veth0_vlan: entered promiscuous mode [ 1416.806030][T18336] veth1_vlan: entered promiscuous mode [ 1417.267605][T18336] veth0_macvtap: entered promiscuous mode [ 1417.281119][T18336] veth1_macvtap: entered promiscuous mode [ 1417.310680][T18336] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1417.363403][T18336] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1417.428808][T16116] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1417.441491][T16116] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1417.494494][T16116] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1417.545086][T16116] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1417.793054][T18353] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1417.831756][T18353] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1417.875675][T18640] netlink: set zone limit has 8 unknown bytes [ 1418.076882][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1418.323951][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1419.029172][T17659] usb 8-1: new full-speed USB device number 6 using dummy_hcd [ 1419.479653][T17659] usb 8-1: config 8 has an invalid interface number: 177 but max is 0 [ 1419.497006][T17659] usb 8-1: config 8 has no interface number 0 [ 1419.523524][T17659] usb 8-1: config 8 interface 177 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1419.592192][T16928] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 1419.602320][T16928] CPU: 1 UID: 0 PID: 16928 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1419.602357][T16928] Tainted: [L]=SOFTLOCKUP [ 1419.602366][T16928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1419.602383][T16928] Workqueue: hci1 hci_rx_work [ 1419.602416][T16928] Call Trace: [ 1419.602425][T16928] [ 1419.602435][T16928] dump_stack_lvl+0x100/0x190 [ 1419.602476][T16928] sysfs_warn_dup.cold+0x1c/0x28 [ 1419.602518][T16928] sysfs_create_dir_ns+0x24b/0x2b0 [ 1419.602555][T16928] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1419.602590][T16928] ? find_held_lock+0x2b/0x80 [ 1419.602620][T16928] ? kobject_add_internal+0x25f/0x930 [ 1419.602646][T16928] ? kobject_add_internal+0x25f/0x930 [ 1419.602674][T16928] ? do_raw_spin_unlock+0x145/0x1e0 [ 1419.602704][T16928] kobject_add_internal+0x2c8/0x930 [ 1419.602735][T16928] kobject_add+0x16a/0x1e0 [ 1419.602760][T16928] ? __pfx_kobject_add+0x10/0x10 [ 1419.602783][T16928] ? preempt_schedule_thunk+0x16/0x30 [ 1419.602821][T16928] ? kobject_put+0xb9/0x640 [ 1419.602842][T16928] ? _raw_spin_unlock+0x3e/0x50 [ 1419.602881][T16928] device_add+0x294/0x1950 [ 1419.602909][T16928] ? __pfx_dev_set_name+0x10/0x10 [ 1419.602939][T16928] ? __pfx_device_add+0x10/0x10 [ 1419.602966][T16928] ? mgmt_send_event_skb+0x2fb/0x460 [ 1419.603005][T16928] hci_conn_add_sysfs+0x1a3/0x260 [ 1419.603040][T16928] le_conn_complete_evt+0x11eb/0x1f60 [ 1419.603079][T16928] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1419.603108][T16928] ? irqentry_exit+0x180/0x670 [ 1419.603148][T16928] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1419.603180][T16928] ? skb_pull_data+0x15f/0x1e0 [ 1419.603208][T16928] hci_le_meta_evt+0x34a/0x5f0 [ 1419.603239][T16928] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1419.603272][T16928] hci_event_packet+0x51c/0xcd0 [ 1419.603302][T16928] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1419.603334][T16928] ? __pfx_hci_event_packet+0x10/0x10 [ 1419.603367][T16928] ? kcov_remote_start+0x374/0x660 [ 1419.603399][T16928] ? lockdep_hardirqs_on+0x78/0x100 [ 1419.603439][T16928] hci_rx_work+0x451/0xfc0 [ 1419.603475][T16928] process_one_work+0xa23/0x19a0 [ 1419.603521][T16928] ? __pfx_process_one_work+0x10/0x10 [ 1419.603558][T16928] ? __pfx_hci_rx_work+0x10/0x10 [ 1419.603591][T16928] worker_thread+0x5ef/0xe50 [ 1419.603626][T16928] ? __pfx_worker_thread+0x10/0x10 [ 1419.603652][T16928] ? kthread+0x13a/0x450 [ 1419.603674][T16928] ? __pfx_worker_thread+0x10/0x10 [ 1419.603697][T16928] kthread+0x370/0x450 [ 1419.603719][T16928] ? __pfx_kthread+0x10/0x10 [ 1419.603744][T16928] ret_from_fork+0x754/0xd80 [ 1419.603771][T16928] ? __pfx_ret_from_fork+0x10/0x10 [ 1419.603798][T16928] ? __switch_to+0x7b4/0x1120 [ 1419.603827][T16928] ? __pfx_kthread+0x10/0x10 [ 1419.603852][T16928] ret_from_fork_asm+0x1a/0x30 [ 1419.603896][T16928] [ 1419.604015][T16928] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1419.896003][T18668] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3092'. [ 1419.941860][T16928] Bluetooth: hci1: failed to register connection device [ 1420.447490][T18668] nbd: socks must be embedded in a SOCK_ITEM attr [ 1420.642947][T18674] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3093'. [ 1420.654292][T18674] nbd: device at index 64 is going down [ 1420.696562][T16928] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 1422.667057][T17659] usb 8-1: config 8 interface 177 altsetting 9 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1422.678833][T17659] usb 8-1: config 8 interface 177 has no altsetting 0 [ 1422.686432][T17659] usb 8-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1422.696221][T17659] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1422.763314][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.694895][T17659] usb 8-1: can't set config #8, error -71 [ 1423.765204][T17659] usb 8-1: USB disconnect, device number 6 [ 1424.038484][T14670] udevd[14670]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1424.086298][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1424.817220][ T5818] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 1425.095281][T18703] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3098'. [ 1425.436689][T18703] nbd: socks must be embedded in a SOCK_ITEM attr [ 1427.075063][T14903] udevd[14903]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1427.129176][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1427.141688][T18721] 9p: Bad value for 'wfdno' [ 1427.308606][T18727] xt_ipcomp: unknown flags 1D [ 1427.443303][ T10] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1427.722786][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 1427.738293][ T10] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 1427.778526][ T10] usb 6-1: config 0 has no interface number 0 [ 1428.213889][ T10] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1428.368433][ T10] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1428.406647][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1428.442818][ T10] usb 6-1: Product: syz [ 1428.467317][ T10] usb 6-1: Manufacturer: syz [ 1428.499635][ T10] usb 6-1: SerialNumber: syz [ 1428.572048][ T10] usb 6-1: config 0 descriptor?? [ 1428.632717][T18721] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1429.072609][T17767] usb 5-1: new full-speed USB device number 92 using dummy_hcd [ 1429.236730][T18721] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1429.373281][T17767] usb 5-1: config 8 has an invalid interface number: 177 but max is 0 [ 1429.407367][T17767] usb 5-1: config 8 has no interface number 0 [ 1429.481904][T17767] usb 5-1: config 8 interface 177 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1429.526194][T17767] usb 5-1: config 8 interface 177 altsetting 9 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1429.583366][T17767] usb 5-1: config 8 interface 177 has no altsetting 0 [ 1429.654386][ T5818] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 1429.706959][T18756] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3107'. [ 1429.726499][T17767] usb 5-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1429.900225][T18759] netlink: 'syz.5.3101': attribute type 10 has an invalid length. [ 1429.913031][T18759] veth0_vlan: left promiscuous mode [ 1429.930999][T18759] veth0_vlan: entered promiscuous mode [ 1429.962551][T18759] team0: Device veth0_vlan failed to register rx_handler [ 1430.169648][T17767] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1430.357556][T18748] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1430.422211][T18748] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1430.524684][T18756] nbd: socks must be embedded in a SOCK_ITEM attr [ 1430.880637][ C0] ir_toy 5-1:8.177: out urb status: -71 [ 1431.381145][T17767] ir_toy 5-1:8.177: could not write reset command: -110 [ 1431.450522][T17767] ir_toy 5-1:8.177: probe with driver ir_toy failed with error -110 [ 1431.911220][T17767] usb 5-1: USB disconnect, device number 92 [ 1432.554226][ T10] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1432.602570][T15135] udevd[15135]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1432.613719][ T10] asix 6-1:0.188: probe with driver asix failed with error -71 [ 1432.654740][T14670] udevd[14670]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1432.989524][ T10] usb 6-1: USB disconnect, device number 71 [ 1439.616823][ T5912] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1441.134111][ T5912] usb 6-1: config 0 has no interfaces? [ 1441.158897][ T5912] usb 6-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1441.216604][ T5912] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1441.250740][ T5912] usb 6-1: Product: syz [ 1441.265098][ T5912] usb 6-1: Manufacturer: syz [ 1441.286457][ T5912] usb 6-1: SerialNumber: syz [ 1441.318305][ T5912] usb 6-1: config 0 descriptor?? [ 1441.539625][ T24] usb 6-1: USB disconnect, device number 72 [ 1441.763888][T18840] xt_ipcomp: unknown flags 1D [ 1442.945320][T18857] 9p: Bad value for 'wfdno' [ 1443.135058][ T24] usb 8-1: new full-speed USB device number 7 using dummy_hcd [ 1443.219648][ T5885] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1443.323627][ T24] usb 8-1: config 8 has an invalid interface number: 177 but max is 0 [ 1443.378738][ T24] usb 8-1: config 8 has no interface number 0 [ 1443.581114][ T5885] usb 4-1: Using ep0 maxpacket: 32 [ 1443.654977][ T24] usb 8-1: config 8 interface 177 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1443.686272][ T5885] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 1443.715118][ T5885] usb 4-1: config 0 has no interface number 0 [ 1443.731955][ T24] usb 8-1: config 8 interface 177 altsetting 9 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1443.743052][ T5885] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1443.763455][ T24] usb 8-1: config 8 interface 177 has no altsetting 0 [ 1443.772520][ T5885] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1443.832128][ T24] usb 8-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1443.851533][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1443.871586][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1443.880018][ T5885] usb 4-1: Product: syz [ 1443.890177][ T5885] usb 4-1: Manufacturer: syz [ 1443.912679][ T5885] usb 4-1: SerialNumber: syz [ 1443.918962][T18852] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1443.932500][T18852] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1443.971292][ T5885] usb 4-1: config 0 descriptor?? [ 1443.993983][ C1] ir_toy 8-1:8.177: out urb status: -71 [ 1444.000391][T18857] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1444.660200][ T24] ir_toy 8-1:8.177: could not write reset command: -110 [ 1444.696523][ T24] ir_toy 8-1:8.177: probe with driver ir_toy failed with error -110 [ 1444.705197][T18857] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1445.014407][ T24] usb 8-1: USB disconnect, device number 7 [ 1445.314027][ T5818] Bluetooth: hci2: command 0x0406 tx timeout [ 1445.814530][ T5885] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1446.065112][ T5885] asix 4-1:0.188: probe with driver asix failed with error -61 [ 1446.302803][T18875] FAULT_INJECTION: forcing a failure. [ 1446.302803][T18875] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1446.335070][T18875] CPU: 0 UID: 0 PID: 18875 Comm: syz.5.3136 Tainted: G L syzkaller #0 PREEMPT(full) [ 1446.335102][T18875] Tainted: [L]=SOFTLOCKUP [ 1446.335109][T18875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1446.335120][T18875] Call Trace: [ 1446.335127][T18875] [ 1446.335135][T18875] dump_stack_lvl+0x100/0x190 [ 1446.335170][T18875] should_fail_ex.cold+0x5/0xa [ 1446.335195][T18875] _copy_from_iter+0x1f4/0x1690 [ 1446.335220][T18875] ? __asan_memset+0x23/0x50 [ 1446.335247][T18875] ? __pfx__copy_from_iter+0x10/0x10 [ 1446.335270][T18875] ? __pfx___alloc_skb+0x10/0x10 [ 1446.335294][T18875] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 1446.335336][T18875] netlink_sendmsg+0x808/0xda0 [ 1446.335372][T18875] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1446.335398][T18875] ? __might_fault+0x50/0x140 [ 1446.335433][T18875] ____sys_sendmsg+0x9e1/0xb70 [ 1446.335450][T18875] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1446.335468][T18875] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1446.335486][T18875] ___sys_sendmsg+0x190/0x1e0 [ 1446.335500][T18875] ? __pfx____sys_sendmsg+0x10/0x10 [ 1446.335536][T18875] __sys_sendmsg+0x170/0x220 [ 1446.335553][T18875] ? __pfx___sys_sendmsg+0x10/0x10 [ 1446.335577][T18875] do_syscall_64+0x106/0xf80 [ 1446.335594][T18875] ? clear_bhb_loop+0x40/0x90 [ 1446.335608][T18875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.335620][T18875] RIP: 0033:0x7fd0b1f9c819 [ 1446.335631][T18875] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1446.335643][T18875] RSP: 002b:00007fd0b2ee8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1446.335654][T18875] RAX: ffffffffffffffda RBX: 00007fd0b2215fa0 RCX: 00007fd0b1f9c819 [ 1446.335662][T18875] RDX: 0000000004040000 RSI: 0000200000000100 RDI: 0000000000000004 [ 1446.335672][T18875] RBP: 00007fd0b2ee8090 R08: 0000000000000000 R09: 0000000000000000 [ 1446.335679][T18875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1446.335685][T18875] R13: 00007fd0b2216038 R14: 00007fd0b2215fa0 R15: 00007ffcdfeeb888 [ 1446.335701][T18875] [ 1448.654022][ T24] usb 4-1: USB disconnect, device number 79 [ 1448.672915][T18890] xt_ipcomp: unknown flags 1D [ 1452.170529][ T5871] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 1452.372082][ T5871] usb 8-1: config 8 has an invalid interface number: 177 but max is 0 [ 1452.418443][ T5871] usb 8-1: config 8 has no interface number 0 [ 1452.462616][ T5871] usb 8-1: config 8 interface 177 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1452.480429][ T5871] usb 8-1: config 8 interface 177 altsetting 9 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1452.553410][ T5871] usb 8-1: config 8 interface 177 has no altsetting 0 [ 1452.577524][ T5871] usb 8-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1452.596370][ T5871] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1452.667792][T18920] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1452.695980][T18920] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1452.746256][ C1] ir_toy 8-1:8.177: out urb status: -71 [ 1452.870200][ T5885] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 1452.887204][T18934] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 1452.908581][T18934] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 1452.920843][T18934] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 1453.137810][ T30] audit: type=1400 audit(2000002886.732:579): avc: denied { accept } for pid=18925 comm="syz.5.3149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1453.250007][ T5871] ir_toy 8-1:8.177: could not write reset command: -110 [ 1453.274941][ T5871] ir_toy 8-1:8.177: probe with driver ir_toy failed with error -110 [ 1453.291819][ T5871] usb 8-1: USB disconnect, device number 8 [ 1453.433221][ T5885] usb 1-1: config 0 has no interfaces? [ 1453.499919][ T5885] usb 1-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1453.521294][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1453.539858][ T5885] usb 1-1: Product: syz [ 1453.545604][ T5885] usb 1-1: Manufacturer: syz [ 1453.550601][ T5885] usb 1-1: SerialNumber: syz [ 1453.559030][ T5885] usb 1-1: config 0 descriptor?? [ 1453.701029][T18941] xt_ipcomp: unknown flags 1D [ 1456.333025][T18954] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1456.512908][ T5871] usb 1-1: USB disconnect, device number 88 [ 1456.532223][T16928] Bluetooth: hci4: Dropping invalid advertising data [ 1456.579429][T16928] Bluetooth: hci4: Malformed LE Event: 0x02 [ 1460.671434][T18983] netdevsim netdevsim7: loading /lib/firmware/. failed with error -22 [ 1460.679788][T18983] netdevsim netdevsim7: Direct firmware load for . failed with error -22 [ 1460.688320][T18983] netdevsim netdevsim7: Falling back to sysfs fallback for: . [ 1461.345091][ T59] Bluetooth: hci3: Frame reassembly failed (-84) [ 1461.661770][T18988] SELinux: ebitmap: map size 1701995264 does not match my size 64 (high bit was 191198305) [ 1461.742937][T18988] SELinux: failed to load policy [ 1463.281484][T19001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1463.354719][T19001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1463.430959][ T5818] Bluetooth: hci3: command 0x1003 tx timeout [ 1463.439260][T18035] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1463.448108][T16928] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1463.481849][T19001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1463.551658][T19001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1463.702958][T19001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1463.734925][T18035] usb 4-1: device descriptor read/64, error -71 [ 1463.979302][T18035] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1464.173649][T19001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1464.185142][T19001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1464.200849][T19001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1464.255742][T19001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1464.287351][T19001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1464.308037][T18035] usb 4-1: device descriptor read/64, error -71 [ 1464.454890][T18035] usb usb4-port1: attempt power cycle [ 1466.927068][ T30] audit: type=1400 audit(2000002900.549:580): avc: denied { mount } for pid=19031 comm="syz.7.3176" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 1468.158362][ T5858] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 1468.316964][T19045] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 1468.322479][ T5858] usb 4-1: device descriptor read/64, error -71 [ 1468.331830][T19045] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 1468.340441][T19045] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 1468.672310][ T5858] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1469.114950][ T5858] usb 4-1: device descriptor read/64, error -71 [ 1469.332994][ T5858] usb usb4-port1: attempt power cycle [ 1473.657619][T19092] 9p: Bad value for 'wfdno' [ 1474.249476][T18035] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1474.414263][T18035] usb 5-1: Using ep0 maxpacket: 32 [ 1474.420725][T18035] usb 5-1: config 0 has an invalid interface number: 188 but max is 0 [ 1474.431686][T18035] usb 5-1: config 0 has no interface number 0 [ 1474.440890][T18035] usb 5-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1474.461763][T18035] usb 5-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1474.471297][T18035] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1474.480939][T18035] usb 5-1: Product: syz [ 1474.485689][T18035] usb 5-1: Manufacturer: syz [ 1474.491514][T18035] usb 5-1: SerialNumber: syz [ 1474.500537][T18035] usb 5-1: config 0 descriptor?? [ 1474.506356][T19092] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1474.782154][T19092] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1474.920513][ T792] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 1475.112280][ T792] usb 1-1: device descriptor read/64, error -71 [ 1475.530157][T19111] netlink: 'syz.4.3191': attribute type 10 has an invalid length. [ 1475.630443][T19111] veth0_vlan: left promiscuous mode [ 1475.655168][T19111] veth0_vlan: entered promiscuous mode [ 1475.718771][T19111] team0: Device veth0_vlan failed to register rx_handler [ 1475.818699][ T792] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 1475.971841][T18035] asix 5-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1476.004675][T16928] Bluetooth: hci5: Ignoring HCI_Connection_Complete for existing connection [ 1476.040534][T18035] asix 5-1:0.188: probe with driver asix failed with error -61 [ 1476.129474][T19115] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3196'. [ 1476.170079][T13901] Bluetooth: hci4: command 0x0406 tx timeout [ 1476.183135][ T792] usb 1-1: device descriptor read/64, error -71 [ 1476.270576][T19115] nbd: socks must be embedded in a SOCK_ITEM attr [ 1476.308720][ T792] usb usb1-port1: attempt power cycle [ 1476.314542][T14670] block nbd64: NBD_DISCONNECT [ 1476.718573][ T792] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 1476.999950][ T792] usb 1-1: device descriptor read/8, error -71 [ 1477.084726][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1477.307936][ T792] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 1477.339533][ T792] usb 1-1: device descriptor read/8, error -71 [ 1477.449318][ T792] usb usb1-port1: unable to enumerate USB device [ 1477.934173][T19135] openvswitch: netlink: Missing key (keys=800040, expected=2000) [ 1478.612699][T17767] usb 5-1: USB disconnect, device number 93 [ 1478.828839][ T792] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 1479.536991][ T792] usb 8-1: Using ep0 maxpacket: 16 [ 1479.550464][ T792] usb 8-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1479.563749][ T792] usb 8-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1479.786871][T18035] usb 1-1: new full-speed USB device number 93 using dummy_hcd [ 1479.797131][ T792] usb 8-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 1479.810994][ T792] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1479.817874][ T792] usb 8-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 1479.827034][ T792] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1479.853314][ T792] usb 8-1: config 0 descriptor?? [ 1479.982735][T19153] xt_ipcomp: unknown flags 1D [ 1480.012104][T18035] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 1480.172508][T18035] usb 1-1: config 8 has no interface number 0 [ 1480.181775][T18035] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1480.203492][T18035] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1480.417456][T18035] usb 1-1: config 8 interface 177 has no altsetting 0 [ 1480.424822][T18035] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1480.451861][T18035] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1480.490642][T19144] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1480.507166][T19144] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1480.535422][ C1] ir_toy 1-1:8.177: out urb status: -71 [ 1481.231952][T18035] ir_toy 1-1:8.177: could not write reset command: -110 [ 1481.242430][T18035] ir_toy 1-1:8.177: probe with driver ir_toy failed with error -110 [ 1481.814184][T18035] usb 1-1: USB disconnect, device number 93 [ 1482.292899][T17767] usb 8-1: USB disconnect, device number 9 [ 1482.926277][T18035] usb 1-1: new full-speed USB device number 94 using dummy_hcd [ 1483.086875][T18035] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 1483.097828][T18035] usb 1-1: config 8 has no interface number 0 [ 1483.105421][T18035] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1483.119764][T18035] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1483.136418][T18035] usb 1-1: config 8 interface 177 has no altsetting 0 [ 1483.143437][T18035] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1483.155806][T18035] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1483.167571][T19176] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1483.175025][T19176] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1483.186439][ C1] ir_toy 1-1:8.177: out urb status: -71 [ 1483.205133][ T5885] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 1483.295340][ T792] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1483.314967][ T24] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1483.356784][ T5885] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1483.367500][ T5885] usb 8-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1483.378076][ T5885] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1483.389843][ T5885] usb 8-1: config 0 descriptor?? [ 1483.399219][ T5885] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 1483.424952][ T792] usb 5-1: device descriptor read/64, error -71 [ 1483.469236][ T24] usb 6-1: New USB device found, idVendor=0e41, idProduct=4244, bcdDevice= 0.40 [ 1483.478379][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.537269][ T24] usb 6-1: Product: syz [ 1483.542332][ T24] usb 6-1: Manufacturer: syz [ 1483.548434][ T24] usb 6-1: SerialNumber: syz [ 1483.601247][T19180] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1483.612297][T19180] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1483.735752][T17767] usb 8-1: USB disconnect, device number 10 [ 1483.765867][T18035] ir_toy 1-1:8.177: could not write reset command: -110 [ 1483.773087][T18035] ir_toy 1-1:8.177: probe with driver ir_toy failed with error -110 [ 1483.786477][T18035] usb 1-1: USB disconnect, device number 94 [ 1483.829231][ T792] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1484.278067][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.362777][ T24] usb 6-1: BAAD HEADSET ADAPTER c_chmask mismatch [ 1484.390871][ T24] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1484.412110][ T24] usb 6-1: USB disconnect, device number 73 [ 1484.434292][T14671] udevd[14671]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1484.450389][ T792] usb 5-1: device descriptor read/64, error -71 [ 1484.581459][ T792] usb usb5-port1: attempt power cycle [ 1484.640842][T19197] xt_ipcomp: unknown flags 1D [ 1485.599001][T18035] usb 4-1: new full-speed USB device number 86 using dummy_hcd [ 1485.663777][ T792] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1485.684929][ T792] usb 5-1: device descriptor read/8, error -71 [ 1485.767145][T18035] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1485.778536][T18035] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1485.787713][T18035] usb 4-1: Product: syz [ 1485.792019][T18035] usb 4-1: Manufacturer: syz [ 1485.797023][T18035] usb 4-1: SerialNumber: syz [ 1486.899269][ T792] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1487.058358][T18035] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1487.092181][T18035] usb 4-1: 2:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1487.142164][T18035] usb 4-1: found format II with max.bitrate = 0, frame size=9 [ 1487.273065][ T792] usb 5-1: device not accepting address 97, error -71 [ 1487.280060][T18035] usb 4-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 1487.290437][ T792] usb usb5-port1: unable to enumerate USB device [ 1487.301605][T18035] usb 4-1: 2:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1487.311538][T18035] usb 4-1: found format II with max.bitrate = 0, frame size=9 [ 1487.790913][T18035] usb 4-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 1488.010443][T19225] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1488.345846][T18035] usb 4-1: unit 5 not found! [ 1488.350631][T18035] usb 4-1: unit 2 not found! [ 1488.465735][T18035] usb 4-1: USB disconnect, device number 86 [ 1489.121429][T14751] udevd[14751]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1489.165217][T19221] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3222'. [ 1490.781377][ T5885] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 1491.113205][T19251] xt_ipcomp: unknown flags 1D [ 1491.264794][ T5885] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1491.278100][ T5885] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1491.287966][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1491.365453][ T5885] usb 1-1: config 0 descriptor?? [ 1491.603122][ T5885] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1491.642370][T19247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1491.661874][T19247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1492.612945][T18035] usb 1-1: USB disconnect, device number 95 [ 1493.682325][T19277] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3234'. [ 1494.254739][ T30] audit: type=1400 audit(2000002927.283:581): avc: denied { mount } for pid=19271 comm="syz.7.3234" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1494.277494][ T24] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1494.280635][ T30] audit: type=1400 audit(2000002927.293:582): avc: denied { remount } for pid=19271 comm="syz.7.3234" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1494.305919][ T30] audit: type=1400 audit(2000002927.893:583): avc: denied { unmount } for pid=17328 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 1494.399799][T17767] usb 6-1: new full-speed USB device number 74 using dummy_hcd [ 1494.444785][T19284] FAULT_INJECTION: forcing a failure. [ 1494.444785][T19284] name failslab, interval 1, probability 0, space 0, times 0 [ 1494.459743][ T24] usb 5-1: device descriptor read/64, error -71 [ 1494.471701][T19284] CPU: 0 UID: 0 PID: 19284 Comm: syz.0.3238 Tainted: G L syzkaller #0 PREEMPT(full) [ 1494.471734][T19284] Tainted: [L]=SOFTLOCKUP [ 1494.471740][T19284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1494.471748][T19284] Call Trace: [ 1494.471753][T19284] [ 1494.471757][T19284] dump_stack_lvl+0x100/0x190 [ 1494.471786][T19284] should_fail_ex.cold+0x5/0xa [ 1494.471803][T19284] should_failslab+0xc2/0x120 [ 1494.471816][T19284] __kmalloc_cache_noprof+0x7a/0x6f0 [ 1494.471831][T19284] ? drm_mode_page_flip_ioctl+0xe07/0x14a0 [ 1494.471847][T19284] ? drm_framebuffer_check_src_coords+0xfd/0x230 [ 1494.471866][T19284] drm_mode_page_flip_ioctl+0xe07/0x14a0 [ 1494.471887][T19284] ? __pfx_drm_mode_page_flip_ioctl+0x10/0x10 [ 1494.471910][T19284] ? drm_is_current_master+0x2c/0x40 [ 1494.471924][T19284] ? drm_is_current_master+0x2c/0x40 [ 1494.471939][T19284] ? do_raw_spin_unlock+0x145/0x1e0 [ 1494.471955][T19284] drm_ioctl_kernel+0x1f3/0x3e0 [ 1494.471967][T19284] ? __pfx_drm_mode_page_flip_ioctl+0x10/0x10 [ 1494.471983][T19284] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 1494.472000][T19284] drm_ioctl+0x5e6/0xc60 [ 1494.472014][T19284] ? __pfx_drm_mode_page_flip_ioctl+0x10/0x10 [ 1494.472030][T19284] ? __pfx_drm_ioctl+0x10/0x10 [ 1494.472049][T19284] ? selinux_file_ioctl+0x139/0x290 [ 1494.472065][T19284] ? selinux_file_ioctl+0xb4/0x290 [ 1494.472082][T19284] ? __pfx_drm_ioctl+0x10/0x10 [ 1494.472095][T19284] __x64_sys_ioctl+0x18e/0x210 [ 1494.472113][T19284] do_syscall_64+0x106/0xf80 [ 1494.472130][T19284] ? clear_bhb_loop+0x40/0x90 [ 1494.472144][T19284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1494.472156][T19284] RIP: 0033:0x7f2676d9c819 [ 1494.472167][T19284] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1494.472178][T19284] RSP: 002b:00007f2677bb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1494.472190][T19284] RAX: ffffffffffffffda RBX: 00007f2677015fa0 RCX: 00007f2676d9c819 [ 1494.472198][T19284] RDX: 0000200000000000 RSI: 00000000c01864b0 RDI: 0000000000000003 [ 1494.472205][T19284] RBP: 00007f2677bb5090 R08: 0000000000000000 R09: 0000000000000000 [ 1494.472212][T19284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1494.472219][T19284] R13: 00007f2677016038 R14: 00007f2677015fa0 R15: 00007ffe30830c18 [ 1494.472235][T19284] [ 1494.869955][ T24] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1494.958537][T17767] usb 6-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1494.967868][T17767] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1494.977725][T17767] usb 6-1: Product: syz [ 1494.985919][T17767] usb 6-1: Manufacturer: syz [ 1494.991189][T17767] usb 6-1: SerialNumber: syz [ 1495.219012][ T24] usb 5-1: device descriptor read/64, error -71 [ 1495.371754][ T24] usb usb5-port1: attempt power cycle [ 1495.459267][T17767] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1495.548334][T17767] usb 6-1: 2:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1495.557166][T17767] usb 6-1: found format II with max.bitrate = 0, frame size=9 [ 1495.585626][T17767] usb 6-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 1495.618117][T17767] usb 6-1: 2:1 : unknown format tag 0x3 is detected. processed as MPEG. [ 1495.636251][T17767] usb 6-1: found format II with max.bitrate = 0, frame size=9 [ 1496.728249][ T24] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 1496.768405][T17767] usb 6-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 1496.839169][T17767] usb 6-1: unit 5 not found! [ 1496.843806][T17767] usb 6-1: unit 2 not found! [ 1496.968117][ T24] usb 5-1: device not accepting address 100, error -71 [ 1497.452477][T17767] usb 6-1: USB disconnect, device number 74 [ 1497.593423][T14751] udevd[14751]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1500.446552][T19324] 9p: Bad value for 'wfdno' [ 1500.876350][ T5871] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1501.136163][ T5871] usb 5-1: Using ep0 maxpacket: 32 [ 1501.498067][ T5871] usb 5-1: config 0 has an invalid interface number: 188 but max is 0 [ 1501.533711][ T5871] usb 5-1: config 0 has no interface number 0 [ 1501.555360][ T5871] usb 5-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1501.589505][ T5871] usb 5-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1501.612502][ T5871] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1501.636235][ T5871] usb 5-1: Product: syz [ 1501.651640][ T5871] usb 5-1: Manufacturer: syz [ 1501.666732][ T5871] usb 5-1: SerialNumber: syz [ 1501.689101][ T5871] usb 5-1: config 0 descriptor?? [ 1501.698079][T19324] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1501.935062][T19324] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1502.325435][ T5885] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 1502.463920][T19345] netlink: 'syz.4.3251': attribute type 10 has an invalid length. [ 1502.474951][T19345] veth0_vlan: left promiscuous mode [ 1502.484925][T19345] veth0_vlan: entered promiscuous mode [ 1502.501411][T19345] team0: Device veth0_vlan failed to register rx_handler [ 1502.725420][ T5885] usb 8-1: device descriptor read/64, error -71 [ 1502.885842][ T5871] asix 5-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1502.921745][ T5871] asix 5-1:0.188: probe with driver asix failed with error -61 [ 1503.045141][ T5885] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 1503.197234][ T5885] usb 8-1: device descriptor read/64, error -71 [ 1503.380711][ T5885] usb usb8-port1: attempt power cycle [ 1504.164395][ T5818] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 1504.245247][T19361] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3257'. [ 1504.278444][T18035] usb 5-1: USB disconnect, device number 102 [ 1504.297365][ T5885] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 1504.462526][ T5885] usb 8-1: device descriptor read/8, error -71 [ 1504.777774][ T5885] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 1504.849652][T19361] nbd: socks must be embedded in a SOCK_ITEM attr [ 1505.074949][T18035] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 1505.321861][T18035] usb 6-1: New USB device found, idVendor=0f11, idProduct=1000, bcdDevice= 0.7f [ 1505.390989][T18035] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1505.504955][T18035] usb 6-1: config 0 descriptor?? [ 1506.673432][T18035] usb 6-1: string descriptor 0 read error: -71 [ 1506.679726][T18035] ldusb 6-1:0.0: Interrupt in endpoint not found [ 1506.718000][T18035] usb 6-1: USB disconnect, device number 75 [ 1507.241456][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1508.658350][ T5818] Bluetooth: hci5: Ignoring HCI_Connection_Complete for existing connection [ 1508.736840][T19398] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3266'. [ 1509.021696][T19398] nbd: socks must be embedded in a SOCK_ITEM attr [ 1509.912136][ T5885] usb 8-1: device descriptor read/8, error -110 [ 1510.015134][T14671] udevd[14671]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1510.042405][ T5885] usb usb8-port1: unable to enumerate USB device [ 1510.441945][T19413] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3269'. [ 1510.894258][T19411] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1511.535831][T19422] netlink: 80 bytes leftover after parsing attributes in process `syz.7.3272'. [ 1511.830650][ T5818] Bluetooth: hci1: command 0x0406 tx timeout [ 1512.543482][T19425] 9p: Bad value for 'wfdno' [ 1513.107174][T19431] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1513.272440][T17659] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1513.432765][T19437] FAULT_INJECTION: forcing a failure. [ 1513.432765][T19437] name failslab, interval 1, probability 0, space 0, times 0 [ 1513.445559][T19437] CPU: 0 UID: 0 PID: 19437 Comm: syz.0.3277 Tainted: G L syzkaller #0 PREEMPT(full) [ 1513.445589][T19437] Tainted: [L]=SOFTLOCKUP [ 1513.445594][T19437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1513.445601][T19437] Call Trace: [ 1513.445606][T19437] [ 1513.445611][T19437] dump_stack_lvl+0x100/0x190 [ 1513.445635][T19437] should_fail_ex.cold+0x5/0xa [ 1513.445650][T19437] should_failslab+0xc2/0x120 [ 1513.445664][T19437] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 1513.445680][T19437] ? __d_alloc+0x34/0xa80 [ 1513.445698][T19437] __d_alloc+0x34/0xa80 [ 1513.445713][T19437] d_alloc_pseudo+0x1c/0xc0 [ 1513.445730][T19437] alloc_file_pseudo+0xcf/0x230 [ 1513.445746][T19437] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1513.445759][T19437] ? inode_init_always_gfp+0xd0e/0x1040 [ 1513.445776][T19437] sock_alloc_file+0x50/0x210 [ 1513.445794][T19437] do_accept+0x242/0x530 [ 1513.445807][T19437] ? do_raw_spin_lock+0x128/0x260 [ 1513.445821][T19437] ? __pfx_do_accept+0x10/0x10 [ 1513.445844][T19437] __sys_accept4+0x108/0x200 [ 1513.445858][T19437] ? __pfx___sys_accept4+0x10/0x10 [ 1513.445875][T19437] __x64_sys_accept4+0x96/0x100 [ 1513.445888][T19437] ? lockdep_hardirqs_on+0x78/0x100 [ 1513.445906][T19437] do_syscall_64+0x106/0xf80 [ 1513.445921][T19437] ? clear_bhb_loop+0x40/0x90 [ 1513.445935][T19437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.445947][T19437] RIP: 0033:0x7f2676d9c819 [ 1513.445958][T19437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1513.445970][T19437] RSP: 002b:00007f2677b94028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 1513.445982][T19437] RAX: ffffffffffffffda RBX: 00007f2677016090 RCX: 00007f2676d9c819 [ 1513.445989][T19437] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 1513.445996][T19437] RBP: 00007f2677b94090 R08: 0000000000000000 R09: 0000000000000000 [ 1513.446002][T19437] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 1513.446009][T19437] R13: 00007f2677016128 R14: 00007f2677016090 R15: 00007ffe30830c18 [ 1513.446025][T19437] [ 1513.879655][T17659] usb 4-1: Using ep0 maxpacket: 32 [ 1513.980170][T17659] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 1513.995829][T17659] usb 4-1: config 0 has no interface number 0 [ 1514.003686][T17659] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1514.017122][T17659] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1514.027184][T17659] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1514.059995][T17659] usb 4-1: Product: syz [ 1514.541306][T17767] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1514.552230][T17659] usb 4-1: Manufacturer: syz [ 1514.557215][T17659] usb 4-1: SerialNumber: syz [ 1514.565324][T17659] usb 4-1: config 0 descriptor?? [ 1514.572163][T19425] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1514.815753][T17767] usb 6-1: config 0 has no interfaces? [ 1514.829004][T17767] usb 6-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1514.859575][T19425] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1515.251682][T19451] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1515.366654][T17767] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1515.387752][T17767] usb 6-1: Product: syz [ 1515.394522][T17767] usb 6-1: Manufacturer: syz [ 1515.414391][T17767] usb 6-1: SerialNumber: syz [ 1515.436067][T17767] usb 6-1: config 0 descriptor?? [ 1515.470856][T19455] netdevsim netdevsim7: loading /lib/firmware/. failed with error -22 [ 1515.480465][T19455] netdevsim netdevsim7: Direct firmware load for . failed with error -22 [ 1515.489044][T19455] netdevsim netdevsim7: Falling back to sysfs fallback for: . [ 1516.185955][T17659] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1516.206807][T17659] asix 4-1:0.188: probe with driver asix failed with error -71 [ 1516.318433][T17659] usb 4-1: USB disconnect, device number 87 [ 1516.780950][T19469] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3283'. [ 1519.475917][ T24] usb 6-1: USB disconnect, device number 76 [ 1519.479248][T19480] 9p: Bad value for 'wfdno' [ 1520.286983][ T5885] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1520.578048][ T30] audit: type=1326 audit(2000003466.231:584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1520.630314][ T5885] usb 4-1: Using ep0 maxpacket: 32 [ 1520.635632][ T30] audit: type=1326 audit(2000003466.261:586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1520.693395][ T5885] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 1520.731894][ T30] audit: type=1326 audit(2000003466.261:585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1520.765781][ T5885] usb 4-1: config 0 has no interface number 0 [ 1520.802874][ T5885] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1520.812514][ T30] audit: type=1326 audit(2000003466.261:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1520.976134][ T30] audit: type=1326 audit(2000003466.261:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1521.577759][ T5885] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1521.624759][ T30] audit: type=1326 audit(2000003466.261:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=267 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1521.656385][ T30] audit: type=1326 audit(2000003466.261:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1521.658150][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1521.680405][ T30] audit: type=1326 audit(2000003466.261:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1521.717460][ T5885] usb 4-1: Product: syz [ 1522.869552][ T30] audit: type=1326 audit(2000003466.281:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1522.930514][T19499] netlink: 'syz.3.3286': attribute type 10 has an invalid length. [ 1522.943348][T19499] veth0_vlan: left promiscuous mode [ 1522.958539][T19499] veth0_vlan: entered promiscuous mode [ 1522.985657][T19499] team0: Device veth0_vlan failed to register rx_handler [ 1523.309340][ T30] audit: type=1326 audit(2000003466.281:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19488 comm="syz.5.3290" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fd0b1f9c819 code=0x7ffc0000 [ 1523.416164][ T5885] usb 4-1: Manufacturer: syz [ 1523.457418][ T5885] usb 4-1: SerialNumber: syz [ 1523.526012][ T5885] usb 4-1: config 0 descriptor?? [ 1523.542610][T19480] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1524.097020][ T5885] asix 4-1:0.188: probe with driver asix failed with error -71 [ 1524.155297][ T5885] usb 4-1: USB disconnect, device number 88 [ 1524.566108][T19517] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 1524.576536][T19517] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 1524.585741][T19517] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 1525.522203][T13901] block nbd7: Receive control failed (result -107) [ 1525.531124][T13901] [ 1525.533453][T13901] ====================================================== [ 1525.540457][T13901] WARNING: possible circular locking dependency detected [ 1525.547460][T13901] syzkaller #0 Tainted: G L [ 1525.553420][T13901] ------------------------------------------------------ [ 1525.560411][T13901] kworker/u9:1/13901 is trying to acquire lock: [ 1525.566628][T13901] ffff888055968260 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x67/0x410 [ 1525.575573][T13901] [ 1525.575573][T13901] but task is already holding lock: [ 1525.582913][T13901] ffff88802aad3470 (&nsock->tx_lock){+.+.}-{4:4}, at: recv_work+0x5e7/0x8c0 [ 1525.591595][T13901] [ 1525.591595][T13901] which lock already depends on the new lock. [ 1525.591595][T13901] [ 1525.601976][T13901] [ 1525.601976][T13901] the existing dependency chain (in reverse order) is: [ 1525.610967][T13901] [ 1525.610967][T13901] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 1525.618610][T13901] __mutex_lock+0x1a2/0x1b90 [ 1525.623704][T13901] nbd_queue_rq+0x428/0x1080 [ 1525.628800][T13901] blk_mq_dispatch_rq_list+0x422/0x1e70 [ 1525.634853][T13901] __blk_mq_sched_dispatch_requests+0xcea/0x1620 [ 1525.641687][T13901] blk_mq_sched_dispatch_requests+0xd7/0x1c0 [ 1525.648172][T13901] blk_mq_run_hw_queue+0x23c/0x670 [ 1525.653789][T13901] blk_mq_dispatch_list+0x51d/0x1360 [ 1525.659580][T13901] blk_mq_flush_plug_list+0x130/0x600 [ 1525.665458][T13901] __blk_flush_plug+0x2c4/0x4b0 [ 1525.670820][T13901] __submit_bio+0x584/0x6c0 [ 1525.675831][T13901] submit_bio_noacct_nocheck+0x562/0xc10 [ 1525.681971][T13901] submit_bio_noacct+0xd17/0x2010 [ 1525.687502][T13901] submit_bh_wbc+0x59c/0x770 [ 1525.692600][T13901] block_read_full_folio+0x264/0x8e0 [ 1525.698392][T13901] filemap_read_folio+0xfc/0x3b0 [ 1525.703840][T13901] do_read_cache_folio+0x2d7/0x6b0 [ 1525.709474][T13901] read_part_sector+0xd1/0x370 [ 1525.714744][T13901] adfspart_check_ICS+0x93/0x910 [ 1525.720185][T13901] bdev_disk_changed+0x7f8/0xc80 [ 1525.725625][T13901] blkdev_get_whole+0x187/0x290 [ 1525.730981][T13901] bdev_open+0x2c7/0xe40 [ 1525.735727][T13901] blkdev_open+0x34e/0x4f0 [ 1525.740651][T13901] do_dentry_open+0x6d8/0x1660 [ 1525.745918][T13901] vfs_open+0x82/0x3f0 [ 1525.750492][T13901] path_openat+0x208c/0x31a0 [ 1525.755588][T13901] do_file_open+0x20e/0x430 [ 1525.760598][T13901] do_sys_openat2+0x10d/0x1e0 [ 1525.765779][T13901] __x64_sys_openat+0x12d/0x210 [ 1525.771139][T13901] do_syscall_64+0x106/0xf80 [ 1525.776245][T13901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1525.782639][T13901] [ 1525.782639][T13901] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 1525.789829][T13901] __mutex_lock+0x1a2/0x1b90 [ 1525.794922][T13901] nbd_queue_rq+0xba/0x1080 [ 1525.799927][T13901] blk_mq_dispatch_rq_list+0x422/0x1e70 [ 1525.805982][T13901] __blk_mq_sched_dispatch_requests+0xcea/0x1620 [ 1525.812815][T13901] blk_mq_sched_dispatch_requests+0xd7/0x1c0 [ 1525.819301][T13901] blk_mq_run_hw_queue+0x23c/0x670 [ 1525.824921][T13901] blk_mq_dispatch_list+0x51d/0x1360 [ 1525.830713][T13901] blk_mq_flush_plug_list+0x130/0x600 [ 1525.836594][T13901] __blk_flush_plug+0x2c4/0x4b0 [ 1525.841950][T13901] __submit_bio+0x584/0x6c0 [ 1525.846963][T13901] submit_bio_noacct_nocheck+0x562/0xc10 [ 1525.853100][T13901] submit_bio_noacct+0xd17/0x2010 [ 1525.858629][T13901] submit_bh_wbc+0x59c/0x770 [ 1525.863725][T13901] block_read_full_folio+0x264/0x8e0 [ 1525.869521][T13901] filemap_read_folio+0xfc/0x3b0 [ 1525.874968][T13901] do_read_cache_folio+0x2d7/0x6b0 [ 1525.880589][T13901] read_part_sector+0xd1/0x370 [ 1525.885859][T13901] adfspart_check_ICS+0x93/0x910 [ 1525.891300][T13901] bdev_disk_changed+0x7f8/0xc80 [ 1525.896740][T13901] blkdev_get_whole+0x187/0x290 [ 1525.902097][T13901] bdev_open+0x2c7/0xe40 [ 1525.906844][T13901] blkdev_open+0x34e/0x4f0 [ 1525.911779][T13901] do_dentry_open+0x6d8/0x1660 [ 1525.917058][T13901] vfs_open+0x82/0x3f0 [ 1525.921644][T13901] path_openat+0x208c/0x31a0 [ 1525.926744][T13901] do_file_open+0x20e/0x430 [ 1525.931754][T13901] do_sys_openat2+0x10d/0x1e0 [ 1525.936940][T13901] __x64_sys_openat+0x12d/0x210 [ 1525.942304][T13901] do_syscall_64+0x106/0xf80 [ 1525.947486][T13901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1525.954072][T13901] [ 1525.954072][T13901] -> #4 (set->srcu){.+.+}-{0:0}: [ 1525.961189][T13901] __synchronize_srcu+0xa2/0x300 [ 1525.966639][T13901] blk_mq_quiesce_queue+0x149/0x1c0 [ 1525.972345][T13901] elevator_switch+0x17b/0x7e0 [ 1525.977615][T13901] elevator_change+0x352/0x530 [ 1525.982881][T13901] elevator_set_default+0x29e/0x360 [ 1525.988585][T13901] blk_register_queue+0x412/0x590 [ 1525.994113][T13901] __add_disk+0x73f/0xe40 [ 1525.998953][T13901] add_disk_fwnode+0x118/0x5c0 [ 1526.004226][T13901] nbd_dev_add+0x77a/0xb10 [ 1526.009146][T13901] nbd_init+0x291/0x2b0 [ 1526.013812][T13901] do_one_initcall+0x11d/0x760 [ 1526.019083][T13901] kernel_init_freeable+0x6e5/0x7a0 [ 1526.024792][T13901] kernel_init+0x1f/0x1e0 [ 1526.029626][T13901] ret_from_fork+0x754/0xd80 [ 1526.034721][T13901] ret_from_fork_asm+0x1a/0x30 [ 1526.040081][T13901] [ 1526.040081][T13901] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 1526.047882][T13901] __mutex_lock+0x1a2/0x1b90 [ 1526.052980][T13901] elevator_change+0x1bc/0x530 [ 1526.058252][T13901] elevator_set_none+0x92/0xf0 [ 1526.063523][T13901] blk_mq_update_nr_hw_queues+0x4c1/0x15f0 [ 1526.069837][T13901] nbd_start_device+0x1a6/0xbd0 [ 1526.075193][T13901] nbd_genl_connect+0xff2/0x1a40 [ 1526.080634][T13901] genl_family_rcv_msg_doit+0x214/0x300 [ 1526.086683][T13901] genl_rcv_msg+0x560/0x800 [ 1526.091688][T13901] netlink_rcv_skb+0x159/0x420 [ 1526.096965][T13901] genl_rcv+0x28/0x40 [ 1526.101454][T13901] netlink_unicast+0x5aa/0x870 [ 1526.106739][T13901] netlink_sendmsg+0x8b0/0xda0 [ 1526.112019][T13901] ____sys_sendmsg+0x9e1/0xb70 [ 1526.117291][T13901] ___sys_sendmsg+0x190/0x1e0 [ 1526.122477][T13901] __sys_sendmsg+0x170/0x220 [ 1526.127579][T13901] do_syscall_64+0x106/0xf80 [ 1526.132680][T13901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1526.139077][T13901] [ 1526.139077][T13901] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 1526.147671][T13901] blk_alloc_queue+0x610/0x790 [ 1526.152943][T13901] blk_mq_alloc_queue+0x174/0x290 [ 1526.158477][T13901] __blk_mq_alloc_disk+0x29/0x120 [ 1526.164010][T13901] nbd_dev_add+0x492/0xb10 [ 1526.168929][T13901] nbd_init+0x291/0x2b0 [ 1526.173592][T13901] do_one_initcall+0x11d/0x760 [ 1526.178866][T13901] kernel_init_freeable+0x6e5/0x7a0 [ 1526.184574][T13901] kernel_init+0x1f/0x1e0 [ 1526.189409][T13901] ret_from_fork+0x754/0xd80 [ 1526.194501][T13901] ret_from_fork_asm+0x1a/0x30 [ 1526.199768][T13901] [ 1526.199768][T13901] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 1526.206960][T13901] fs_reclaim_acquire+0xc4/0x100 [ 1526.212403][T13901] kmem_cache_alloc_node_noprof+0x53/0x6f0 [ 1526.218724][T13901] __alloc_skb+0x140/0x710 [ 1526.223653][T13901] tcp_stream_alloc_skb+0x34/0x660 [ 1526.229269][T13901] tcp_sendmsg_locked+0x1396/0x45e0 [ 1526.234971][T13901] tcp_sendmsg+0x2e/0x50 [ 1526.239747][T13901] inet_sendmsg+0xb9/0x140 [ 1526.244667][T13901] sock_write_iter+0x4ea/0x5a0 [ 1526.249933][T13901] vfs_write+0x6ac/0x1070 [ 1526.254762][T13901] ksys_write+0x1f8/0x250 [ 1526.259592][T13901] do_syscall_64+0x106/0xf80 [ 1526.264690][T13901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1526.271087][T13901] [ 1526.271087][T13901] -> #0 (sk_lock-AF_INET){+.+.}-{0:0}: [ 1526.278718][T13901] __lock_acquire+0x14b8/0x2630 [ 1526.284071][T13901] lock_acquire+0x1cf/0x380 [ 1526.289079][T13901] lock_sock_nested+0x41/0xf0 [ 1526.294268][T13901] inet_shutdown+0x67/0x410 [ 1526.299272][T13901] nbd_mark_nsock_dead+0xae/0x5c0 [ 1526.304807][T13901] recv_work+0x5fb/0x8c0 [ 1526.309555][T13901] process_one_work+0xa23/0x19a0 [ 1526.314997][T13901] worker_thread+0x5ef/0xe50 [ 1526.320091][T13901] kthread+0x370/0x450 [ 1526.324666][T13901] ret_from_fork+0x754/0xd80 [ 1526.329774][T13901] ret_from_fork_asm+0x1a/0x30 [ 1526.335045][T13901] [ 1526.335045][T13901] other info that might help us debug this: [ 1526.335045][T13901] [ 1526.345272][T13901] Chain exists of: [ 1526.345272][T13901] sk_lock-AF_INET --> &cmd->lock --> &nsock->tx_lock [ 1526.345272][T13901] [ 1526.357859][T13901] Possible unsafe locking scenario: [ 1526.357859][T13901] [ 1526.365286][T13901] CPU0 CPU1 [ 1526.370627][T13901] ---- ---- [ 1526.375967][T13901] lock(&nsock->tx_lock); [ 1526.380364][T13901] lock(&cmd->lock); [ 1526.386845][T13901] lock(&nsock->tx_lock); [ 1526.393762][T13901] lock(sk_lock-AF_INET); [ 1526.398159][T13901] [ 1526.398159][T13901] *** DEADLOCK *** [ 1526.398159][T13901] [ 1526.406278][T13901] 3 locks held by kworker/u9:1/13901: [ 1526.411627][T13901] #0: ffff888028214948 ((wq_completion)nbd7-recv){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 1526.422320][T13901] #1: ffffc90003bdfd08 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 1526.433447][T13901] #2: ffff88802aad3470 (&nsock->tx_lock){+.+.}-{4:4}, at: recv_work+0x5e7/0x8c0 [ 1526.442573][T13901] [ 1526.442573][T13901] stack backtrace: [ 1526.448443][T13901] CPU: 1 UID: 0 PID: 13901 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1526.448469][T13901] Tainted: [L]=SOFTLOCKUP [ 1526.448476][T13901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1526.448489][T13901] Workqueue: nbd7-recv recv_work [ 1526.448506][T13901] Call Trace: [ 1526.448513][T13901] [ 1526.448521][T13901] dump_stack_lvl+0x100/0x190 [ 1526.448550][T13901] print_circular_bug.cold+0x178/0x1c7 [ 1526.448578][T13901] check_noncircular+0x146/0x160 [ 1526.448608][T13901] __lock_acquire+0x14b8/0x2630 [ 1526.448630][T13901] lock_acquire+0x1cf/0x380 [ 1526.448646][T13901] ? inet_shutdown+0x67/0x410 [ 1526.448667][T13901] lock_sock_nested+0x41/0xf0 [ 1526.448690][T13901] ? inet_shutdown+0x67/0x410 [ 1526.448707][T13901] inet_shutdown+0x67/0x410 [ 1526.448724][T13901] nbd_mark_nsock_dead+0xae/0x5c0 [ 1526.448750][T13901] recv_work+0x5fb/0x8c0 [ 1526.448768][T13901] ? __lock_acquire+0xd73/0x2630 [ 1526.448787][T13901] ? __pfx_recv_work+0x10/0x10 [ 1526.448803][T13901] ? debug_object_deactivate+0x2e4/0x3b0 [ 1526.448834][T13901] ? rcu_is_watching+0x12/0xc0 [ 1526.448857][T13901] process_one_work+0xa23/0x19a0 [ 1526.448881][T13901] ? __pfx_process_one_work+0x10/0x10 [ 1526.448904][T13901] ? __pfx_recv_work+0x10/0x10 [ 1526.448922][T13901] worker_thread+0x5ef/0xe50 [ 1526.448945][T13901] ? kthread+0x13a/0x450 [ 1526.448961][T13901] ? __pfx_worker_thread+0x10/0x10 [ 1526.448980][T13901] kthread+0x370/0x450 [ 1526.448996][T13901] ? __pfx_kthread+0x10/0x10 [ 1526.449013][T13901] ret_from_fork+0x754/0xd80 [ 1526.449032][T13901] ? __pfx_ret_from_fork+0x10/0x10 [ 1526.449051][T13901] ? __switch_to+0x7b4/0x1120 [ 1526.449072][T13901] ? __pfx_kthread+0x10/0x10 [ 1526.449094][T13901] ret_from_fork_asm+0x1a/0x30 [ 1526.449121][T13901] [ 1526.842613][T19529] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1526.983575][T19523] nbd7: detected capacity change from 0 to 8589934592 [ 1526.990850][T19502] block nbd7: Dead connection, failed to find a fallback [ 1526.999687][T19502] block nbd7: shutting down sockets [ 1527.004992][T19502] blk_print_req_error: 138 callbacks suppressed [ 1527.005007][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.058611][T19526] mac80211_hwsim hwsim26 wlan1: entered allmulticast mode [ 1527.111353][T19502] buffer_io_error: 138 callbacks suppressed [ 1527.111367][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.135755][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.205971][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.250047][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.312344][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.347486][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.372868][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.380671][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.403549][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.411964][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.421529][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.429810][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.440482][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.449011][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.458850][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.471544][T19502] ldm_validate_partition_table(): Disk read failed. [ 1527.479353][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.488928][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.496761][T19502] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1527.506339][T19502] Buffer I/O error on dev nbd7, logical block 0, async page read [ 1527.514711][T19502] Dev nbd7: unable to read RDB block 0 [ 1527.520460][T19502] nbd7: unable to read partition table [ 1527.540990][T19502] ldm_validate_partition_table(): Disk read failed. [ 1527.548644][T19502] Dev nbd7: unable to read RDB block 0 [ 1527.555006][T19502] nbd7: unable to read partition table