last executing test programs: 18m11.018272562s ago: executing program 0 (id=453): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$can_raw(0x1d, 0x3, 0x1) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1f, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) (async) mincore(&(0x7f0000223000/0x2000)=nil, 0x2000, &(0x7f0000000000)) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(0xffffffffffffffff, 0x80184151, 0x0) (async) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYRESOCT=r0], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x4) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220a000000830000000027c8746a23"], 0x0}, 0x0) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000000a85142eb0f5e63d08d49734ea91c09623ebf1d41af9040386826cdbc79cc6d5d719a2b357c6fe1a598c824d7c94e971511279310f0d8b19183b018efe6749faf2feeb1367b3576fb6513a667f0595f32148199cfcc852008bb8498f12ddf8c5c03512ceff347f83540ad00786e6ff4697f41a8a0e78465e1b66cd2fe4dd9d91c59748d5b229b1c9550c728ef200b2da3433cc7851b94fa9a1c3a110983f13f7a5a18e9ddd2379da45be090d4c82133257bb02", @ANYRES16=0x0, @ANYBLOB="00042cbd70000002000002000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000000) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x3, 0x400, @remote, 0x9}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x168, 0x6c, 0x0, 0x0, 0x0, 0x248, 0x258, 0x258, 0x248, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0={0xfc, 0x0, '\x00', 0x1}, [0xffffff00], [0x0, 0x0, 0xff], 'ipvlan0\x00', 'ip6gre0\x00', {0xff}, {}, 0x11, 0x6}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0x5}}, @inet=@rpfilter={{0x28}, {0xc}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0xfffffffd, 'netbios-ns\x00', 'syz1\x00'}}}, {{@ipv6={@loopback, @empty, [], [0xff, 0xff], 'netdevsim0\x00', 'lo\x00', {}, {}, 0x0, 0x0, 0x0, 0x14}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {0x0, 0x0, 0x2}, {}, 0x0, 0x7}}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0x378) sendmsg(r2, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4) (async) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0x0}, 0x68) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r4 = io_uring_setup(0x1b7b, &(0x7f0000000180)={0x0, 0xc8a0, 0xbffe, 0x808, 0x3c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x6}, {0xe, 0xffff}}}, 0x24}}, 0x0) (async) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(0xffffffffffffffff, 0x81785501, &(0x7f0000000200)=""/4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) (async) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) socket$inet(0x2, 0x80001, 0x84) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'batadv_slave_0\x00', 0x1000}) (async, rerun: 32) socket$kcm(0x2, 0x3, 0x2) (rerun: 32) lsetxattr$security_capability(&(0x7f0000000440)='./cgroup/cgroup.procs\x00', &(0x7f0000000700), &(0x7f0000000400)=@v3={0x3000000, [{0x26da2361, 0xfffff801}, {0xe, 0x803}]}, 0x18, 0x0) (async) creat(&(0x7f0000000180)='./cgroup/cgroup.procs\x00', 0x10) 18m9.075319643s ago: executing program 0 (id=459): setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r0 = socket$tipc(0x1e, 0x2, 0x0) connect$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x5}}, 0x10) sendmmsg$inet(r0, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f00000056c0)=[{&(0x7f0000001240)="80349c0d9e8fcc9f44658138dc4a3c4ad42f918348474a5bc38ff0e0571fc22c8eb5cb22fdf30ced1a4c1ccb5e5b35fed7db48c1a8a7132adc5623d146ddfe2254dd2579b4284b53d1cea6206864473d31bdb00c9d1462458b678827e80c94d88099e7471a58b1463086f9cdd1ccc19fa2fc4a9dd5a56fe782d15e66648c7630f1aaa7e9820460c46e292dbb8fa6f6701048ff17f46097b1ee0750ed038f18b81b2ba014bf866062c9a6f88b5d07e13b7eddd968ba9c7a53609c7b61471a51fd85bceebc0a92b2cd7c45a7f4571e693abebc3c5ff16c8128d92476", 0xdb}, {&(0x7f0000000280)="5b4ea50f20d7212327afde5e7a457cde2dff791c69fbc3", 0x17}, {&(0x7f00000002c0)="851d8a90d516f218f839a7c48edfe734b2490c90a2fbf5be3383f1c9f5be8e55148723ac0258ef4f8af1f5e0b0a86885f018523d60072c7d9c1568700b3abe208fbd5dad2daf18b5150a530d816bf4cc6e43da4f2793611b38009e8c0970268cf5836926fd1223f4f8bec6a4a68b2aaff7af151a661793a04cd9b936da8f53eae22356781c580df817f3168269eaeeae014fa9b1878bd89e2acb4853ffd7b9a06d7f5ff090c605f5d343e6d93c80d747365d21acea325c44fbb87f6271a2d9333e9b9dd1d36dfea61641d34fd54cd2970ac14acdadd04357bdd44bc926d0adef887b2e25c2f435ce79bac1d1f473c3a49a12aa5c5cfa4bfa4fd2470308ed259e62c218aee67006a3ca187c9aa13a806d99b2275341fd6022940537b1cb1fd2389f417ea92c6e77a09a9d09a98c4e2f0912d36b47588ff991aa98c3c650055bacb669aaf68dd4f8a7b43569c9af62e7cee6ba05278fe8642feafa5c436cb13fa45b3cdf750f8956c493acf7c561b12259331a363c74fb5f2947652ced415b0986b673680e8ad7bad823ff84c30681cbe45114510d9aa6f423f212bcdf1c244178ae31474d9f176707e9c481057f72d489372f7daeba51e3ea86895c8eed109566ad19f3957d0df21a671fce2d674c207d8643c85a018834f4e8e3992e6991d815", 0xeb}, {&(0x7f0000001440)="f0e266805aba28ca0c0d67b3479e1c7cb90d64b8ba8093c11696a92981d4fdd1f40043ce52efdea3f8d7b9ba23840df17c5a35207d6fc677263be310a063adb7b1528b8a04ec5b50d2cfa0df73c57f16a94941e8fb22f429a1f34b5b01514fefc4bd79a2cb936cf2eae82bd7b628431ae2d7b61059b35abc6ee24fd40e3c1bd6106af177bc4670395df7238a420fecf1e6ed3fe8906c3a2843215618fcb72ae77c6d36feefb4d45157e5d35fb4bf297d15ca042520f08e85ad2d7c5045fc7c4a2a8b6e149fc755d70437b3835083ee9fc662afbf840ab97f0adcdde20099bb22e909b937696e9d950ca0a361dfa8f5453454696927ae5a2401340264bdcdcd86941c18b536bdccb964461679d1b62855dadee9b66e5d494183283808c706247cdf83b45c44178775fc957483923b717724549dbe2f9a092fa07e93a7772d16bfbff9a0dd14d48d30b1e4f8206f92cf2fe08a7702f73404b79e77dec1b694e8a7c588a7bb2d770122291b10b456c4419dda49da0433a0aa5f0be221d29b45082b4f9521c2a1fbae507aa2652123619b78f340f01523bf9e6089e8e8186af2b85476d7059226f07467a6e036bf8808f2e9070b2a94ac1c64ec066def276c362a1d4a830edf754783f0a1e52e1adc4f6ca2d7200fd73b9cda79ccfcf57a27f60e184ebe12c4daeb214c2057b69719db280e0dcc2d10b085c7ab8e2394bae44893e3f335a3121bae3a33c32b004ab7bca48726029b77a6c784d2af3789fd520e37009d103c0a63598fa5857ee1b86a38a9feaf1d1f512d1884861c13d647d26888430e2f15e78cdd6a4c875e52de709dfdc4af4775ce03d7c8c3ff2b9fbae82dbabf11460bd1bc1ffe10c5062a265fd211a2b52a41613cc03917b8d34591885396369d1d172df31244a236c49d4457a936848684b59e326872d58c5db20684d1194ccb7ecbf5017f0f702f29c75cdeea09619db8bf00b41b1a165af13b3810d7f7b6a681aef628190f4fd53244a650b0500df500946792d003f2d2f0ba3c57f8257c0cc897cb1dabd63870ef86378a14e7f5068ea6a2311414656d766fb24e43c2a57b44cb1dc584d71e91628348790dc6a9adf85bc403a934e7603f7b45473407cf1395163b3efc9e880963bbd98140adfd624ccfc1141cd899826261e152265b9307695488c0cbad9027bf74b6f0c7adbc9878983d96e6026c818ac30fac3e2392e1c8fdab8ccf902d0915a471701083949efafc7a2e05608139fd0ef22d834ff02569878579c43635ad2d56d7cdfacaba8a3adc47c7fd42e521ca6b14726e68f67e2662c972bf9824ba847e22985400fad74280c22a0636aee80eeb7ef0c691cee94573ec78b53d43316ba691fd5274d1ff8085e297d2781a31f704dfeb58db9fa216c3356341207e953712de9ef27018bdfdddba8abc0c5f205908f12a42685ecc0c20cd92a57bba45a435f7bb412ccab1a6d877392971de8b808af07ea32b102dbcd7d00c869ad5cd8f5a5895b3d6dfef226d51d819756a85ffdde3d08f59fbbb7510a9ac3568f8f039fa7abc7b34685f3579050e88773cb4bb7958ff83aba1f23c8ab4ecd019c59781d47bcc50c64a957c3fa37311a240649313f77fa81020a5da0560d3bdabe6001ab6792ad782fe0e44bbb59efd4a524984742940563dd9e9a0226925324ac94373a9dcb16f32183ef3f465a13b83974f593e664f53131241e2133ce22917fbb412354a51026847f92aa7afadb1cdf51677fc2fe5938812ef17ae79f4db75afdfce3c5b8822dd612457b5f59dd616acdc473e97afb83f3c9789f3df399a2c3c89e8b5e6db33a306168b0cd4e8acbbd6ac81dd46cfb2f7d24b609d009049784611d027daa0cfb12111c1236aa010796cc687cbb151ba30e3a786ee8bfdae51e65a0c3667f7b8856089621742bdc19ad66f60eb48bd7f20b0ac2a523e89e6a7089e3704f266c52c58994e018e5d20b77a0413c71cafd420d9e0abb77e9f1199aca31f6d94372ca5736c749c197cac572e4962fc089f866a896763cd7b804c8e7211bd3a64f1ed12d65182deb850279ecb530683551bd50214e03b9f813431688dadf4caaf77d2e8b20d3e5c424243ab50f9c20462cea0f38eb080b02074e3e77a236d4ec929b04d134dcc5f767736c096794be3aec9f1195b87862128b436fbd0305a6ad6ebb0b2167e184c1de57048144b7567a6ad6c028c4b8a78858925f0ed415313da984484f753d14234d30964aa3d15af13337b6e5338d4f787abc18e0ea4d9656aa3c1d3eee0854078470a0e724062fd61a95f17516ca92faae8397ce07ba558a689ea49d25685a28c68fbc533892827829692d65a15711f0d14f7f685095f6c5dd085b30ffc4dfd9097157c1fab80023d24912861e87d1e484fe5a4476743dcb983d3eecabfe168db03f888432d8b1639e89c8f0513dc36ca8969ec364d28814fa6e21f979020df1292d772cd20c0eb4a5888f38d8d129e30ffee29ab6baf3b2f3a509e02d26b354f1ebe3531fe97968f1f678937b36f3684a8c100030a2328941dfc09574f7cebc26337cd4b2a6fc0b92affc3f3f892542e46fd6cfc2780c0b8a916b3fbb7f33a2537571b06643d82f86e2156740e024b360f48b844797971383610dc93abedc9945ec26d6a56e2701522e3fd6b77d4647a137346985af549d8944c652ddd797e1856a30f296258eb275981bc9432f38532d6e141d603b002c75247b3e71b39dbc01e8e64bc0cd510bd1700685a95ead8fb3fe8fbd72be2e8f9f5a9f1b2c400bfdc0aeabb14a7538c9a38a4839bf41120f2c2aa00277a327d7dff15f52854146a94ea41e4f14a15443124c6bcff43489e7e242c8315ed8d542377fefb6002292c1adc571c730d67b8dab5a4da06659fe7b69bac3147ef39fc877c323edbb9912886ab468c530a8d7844692010ea93effd20f4ccc47b3ff51f378c12b1d03155d49772f14d65bf2ce38f589ca4647b6713ae081fd13e74b307aba8bc34a4406d78c26ccfdf328f5c273b294f6c6419cc157eca59939ec4c0b95cc6d5f97c83c3f14aeb5b88910ec29cf64496d9b1b855fe073d4791507c7533846cdd7810667427583b3a8b7febb2c43643c09bebbb12c08781ac9d0995723fb47febef49e0d6631f054e5b3b3a284391590cfb5d5cf4aaa71586cb37b9fffa15848176da20969e88ed87dd8a4fa2b5140fd56f0a9973217f8ce0c6ee50b67214b6d7d6b84d41d83694a14b2e96f0cb79b49f5fe4dd21727c00819e83b6ea203bada46e9ae8ce7bebaf24f05fd20672e4230b3851b8f05bb2f0977dda7c8cdd1f2689b7a10a72018ff76699e53b2a3f77bf7fa03fe3cf85d4859c9db915fa5c1ddff79e77d0b1b6316d3e50d0d60a42271332f3e81376f120836cd3ea55b7f1453833a7bce0058f79b698a4bd0e857ae35b8ac8f20ed8f238475757af11ce7b450cf89191a4f27a365f594ef68efe6ea1a5c3518712b1aa37a1f47e05f85debfa461f5346d985a71e49ef17f4eb068862977d56671d445176934be6b5318300d7debf3ad8d7da0c014b25af2d8fa52753974116a8cea6c974692f5de03b526a075cc3bc8a4375333f0ef09dd3c361738a151f326ba3253c171f8f7876107eeac122a65124e59dfe7c66bb9546d6428559df314063ac08c03d96b04b6a91508371fa18348c65238546f3d489c7efc1bd01e6e389fbeaa8f125bc7b7c8673904eb676bbdfa3680fea612ba20fab20cdd411c2bafe0417b76852de9e863f09d291bf59510ead793cfd9d6710c0de77cefb5b65481d3aabde2683457b13e3b32ebc06f60d5afa47e36f652a95bd16dcf55dd3e1b05d0df9b8a183553097c2aa95aa175eda6792f58a74170781260e6120981549b3836d13ef037178dd8ddcb5a5624f3790f9d92b0f8f3cd11bddf478cd79456db871f32dd6e24948dd762ba2c22a94300f527c1df5ff05aef5ae4893ff88adc8f7af779d03fcb4ecabfa32460315f27505681242064541657acbb29f531043ce1d04ad189045140232f24f46d0580ada560c61fa4a90aec4743a9a0d466493476923cdff87a21127bac3da7d61d674d8bc9bd63cc3df85c707a912773e090256d5a0bdc5da8ceae2ca25c596410982b63055e6d292a31776cefe58457cb6b5cb92a2c69ed5eeed35e4ea3d6b54ee22e41dea28adac6e1eeadf604f0ef3a67c86974c3ecacdb7f502c74ed31138123dcb80282dbfb0ea0fc2a6016dccecbcbe4952c27b09e7abf784db6b7cc55366d048f16f6473a268b90a1c9b9c612f88bed9008308b11e47d79329cbefc3f313863eff4a16e6a70c41a296d3042a1164d0578297642ec82da1f92dfaa6a67ff9cfcd1b3e88fc442246a303a0e539ce65ad6fcb6d8657937cd88d4c30fd369f2bef0308f5db8824919139b25f82f56e24ef4cf1feda07c3bef9dd215575ed774dc05603f4664332c7b002c48d873bf1ebec930a273efc78dafe153f7eba9161002ca9a8fa855bc357f3a67810fc081b9ae9b4f69401ef93d039c7c1398fa8c9eeb1ce001e08e9231ce2c2beacdafe2955d4056e18d4d09ed22a996666d4df5ca91c37663bb54eb42fe39712736fa0e64ad4f8ca843fe52702c9ae48e60a3f5eac160f58ff3cb80684120845b9e34bc1aecb19662b1a429926ae351d004eca1d367fcb34facbeb2184716c5140a7e420c7f4379b0c43ce872b62723a587d9ad528c2aabf158cefa2df3422203b5cc73e9443825089527700b69a2331e0558a9b1e9d3e69a59896e6cf4df46b41a8cbb0e598a874fc23b16a6eda6eafde02451f0255ff9e6d1bd007c86dee8b6ae875752415b8057b916a3fe7b35cfcf7d38a50e461f1fc1d6a4541ba4079e1f21d0ea2a5ce4aad561215a1d75a2599c757cd6025753fc0578e4b7f4195ad025c46d50c5c351af1ce1e8f8c35439c8598293cd59d2e90a1445497b0249a314379dd13e95f00f2d8240190da9e12adbdd809b1a96900054db156d2893f7998aca02c86f61478a9b21e9e11a6f4b9f7f382243739e492e9048ed9c7b0b8118d966c0f41709abd171873c498a3168639bb2451e0f65e93755fc9cbf3b996ed0873a8256a579372146c3a1e749a9a640f8e9c01af2d0fdd34f2b5fcf4e0bac0b7becd41851359f89dc17156b6ddbd6377c05a059cde362397f28ae2cbbdac107142b40913aaf059d897039ce3fda8c29ae93210676e44f131f78e78d68d858bb7fde230a2f0fd542c5e8374fdc11a488da9de28bc3992a8d74089de36a732110c841bbdc5f24f71663d9a5f5209791fb7027749be23cdb3380f581151563d3707290cd31b28c13139b8e041cd72af3ad9b0fd0b3f131608a8ec5d80c4e7cd458abebae0244c921ef69a4ea0e9a2c2073bd13b49f574a7e278c7ba08c22d89b678a3cd814e8d0dea0101d95f789ada5178f46a4c6beb8dd12352cec179c886ae98ac2bc4382acb565df99eaff3f6824536ef7de884176ea3ca14a9f225f8ada2aac871e7c35df92943600cf7961b8eefdeb70d985fbc93252c978c5c773b4f2ab4b7683e2563d36ebfa4355969f6201e4bcac04ede3c6c9a18ed23f23ec331cbe2d645fa4ffcb2c742ba4905788c27a9bc97536dcbc08d3cbdd2f7195acc0f0eb3cf52aad9a1d23a1dd3633a49a482a1c1eb8761dcc7474f0fd4596a661b7668ab22ebecbfe33886b9b4a0c250380a9a34fefd9724ff89b32e5622258287b3281bcccd0bade4e260b6fefe73219c41f2de521587404ac1d2de4e2999202b3870099718115552aac2d446e649", 0xb47}, {&(0x7f0000002440)="253c10cd0a56ebbb9e8b465670109c340c95f1d27d36cbeb7fa948545e9b18da346b70b5dc6ea12ad1a30e4f7038336f1af1d61b04de988f1755e9b3ba9919b2a4952ceda920a7f0e22dd239d4a74f2d1c854bc64f09f979aa3e9f5c25ff8ec189e5d809483583f648cd8870291200e428", 0x71}, {&(0x7f00000024c0)="2ba671ae8107530b978dd82841597ed8f4275ed9e6b9f7b73ee6324ddf688ad9d88125b82afd2e28aef7183086ce0dd4ee880fc56a2ca8b52ef8f5b5f3e475f49b0bcd201fe612703d680fdd1151dd32535b04d4697d472c7750d6c4c197162e9f872253b611b1ca20e79dcf40d1faf58a453f8db9a03fdd351b54ad4e77fa0fda7990bb281079ae7ba3994aef7380e1d6342305e2d12c57379fd12e784f48e4e832171df4576c8724e3bfd70ebc92fc11914cd4", 0xb4}, {&(0x7f00000025c0)="96cb9dfd0c61d5ed863c5a35109d427201da53416c37631f95451a170fdb734214157996b04630903a7ad20aca669b5120871c47c6ef4e5975222b9676223895144ae5c2898ba0e94642e43e374bf9515c7e840e62021f25181401bda4c4d2d77867390c0a05af019adabfe896d7824f0dcb1724c64da40478808059ea83fa60145e108809ca25edf6ab820f23a5ce2b1779aa8c037a26d99df56f39ff5beca1c1e0cbfd69e415971a02f5115f6da0ba6da9be9772efa870aa6b62774ce009e7bcca4b4a7a910aab97e7f3da899eaaf573ac8a926a7be9b5875b3bb707ae9124ead39e70948bcf654b6b4342043f756323494e4ec559866c5a480c3b156c0427f1cc1d373b77424ea38e3697e36dcefd261575e5516bfcedc7baa8cbebed0ce49dd27e6291dd6f968eaf37f13313ba0bd22b6a63496be04a42df10fef87386434103b5ef819a969e8792a7765dc52c310fbe89851eaf8b2eabcf27bd487f817d48a54b0c7e8b151f0941a6f4adcf6a4486f96f8d18a2928829db333ec08bffe029f4840fdc0433d75157e80b33c3041f193e5c3fb1b7c13d1d7d7a8fe3122ddef181a6534232731c8f91dae42d9a66b9c2e0c6de6da74c24752b53d344b3c9a48ed62705c3e93f7e346c0379a6ec672b3a73dcfc159a79a77bd7b9edd013e3e9832d4dca6f9f973d63d5d235c7e22822e012e4181e102e68b03bdec323db739968061a7ba6fcf9589bd2975520fe9f1b44e52489bf5f5b0125b14bc894f4ff1ad2ba817dad6ab1654a2cacce1cc5160ea4bf3d7011cbf16ad0389b6511448c4186da0a7a55be54031a6d2773ac33aab5d533e7bb213309193f2ca3970e8fffc2fdacbc96e6f49c116b0505385a8bf282589be6b844e2aaaa652459b5d021127f59009020d34932cd03fbe5fea45bdc1f68463c4afe2b5ea8f97dee5e2e6b58196aff00e5ca51a0087f02bcb1dbdd638a5c7590095561578c30904f7ea80072de21fcedd0e41da8e7fe3514eaabc603d770a6fbed5367edb7feb5c5edfda04c7b8a4bfce5c73b876f52fde7dc929f3ffa632eb9514596793533d20fd191b484e902ab104dfc34a8486ba64d3e31c495e043279d8d6b4e6ca3c3fd4ae43529e55be690309e1bc90af2e9188cd5673eea73c75d4decf8972039c086e4b47caee900e1422fd2fbe0303dd5147a9fa487a7b08ad529d0d3db2bae4b26a83de0b15b9b82f26b23336481aca875c48605dc8d25d872920d01e2e163cc13d1f026666f8f54d6fe7895b47939599d168dc98a2de4aac463d98cb39375ac13fadd722b9f1e221d35bde594c9e53aa0f34b235a9d68d8f4841f9455804cd8a7bf05315c5bab2fa8820e956a8161cdd685fc4e1344f9d89189057376a5d1c23273d475aaa72ccbf4b5d8f2863f3f0fe7c0f8b001c065bae68aad9d8878a5edcd8dcbeec07d317c0a81fc84b8b208c60db73c6cf86d46cac98a7df449581d74be7991f1fa6924b76a2d6077aacca10fc777f0d09c5420cfc38c4638957086c9a2065ce94a286da01527bd8b8fd5830f93bcab97a4d0ca13c55b4ee32a49e078b4d79e7b17200fb6a550cfcccd33c681e37bc83c7fcda081a67c2a828e65a75df33e587a05f75fe05aef4078b3482c9078e2edb63c74134f92461044871e4a71f40228d156cbb3beb53eb898e0b6ade2d486a7111ce074510ad957f0eeae0812dd3802db231d9a15948a6b133167eb51dde0199023dfb3471661c7f13f14e786278c551d60929ef969b15d4ea544a9cda830183052ca1072083fb304502f38bcfd46ef64091a2a64bacc55ff3e91f8a7a97f69a9524bdaa60c14d75ddb44e399158c603cded78f42b79a6e9b9c30575289a92558f4d1d9cbb35780c86462cb56d5b474901c17df6ccba95481c004c384b17f99fb29458c9c59666c5305c508561e654d5f1b8ed375231358828b73b487c5f3096211f863375333bb1d3970f7c4cbc7b0f122dbb330b24498f38d804ec0e9c8a5976578bfbc2e46e8d898ec08b3742d5f9ba03d56567f6541f075c4f45eec94a6af78065689e8851294c48f02d48b1266586db86266bd2d0cbb729b567ed7643edf6849f50ca7a28b4ef59433ff22ce0680ffb3348a458ff77b6a796e849cb456df4b443d625d423d10e21bf0bcc785a243cf70ed2ea7c52548cd366ad9af486a4a0171f21ee9d961aa808a69a066aeb0c605fe7a83291ba942df3d11ba1e12da7381d7af20ccbd0de5416ef389c65d1fd0ff209dce808c490707a371b317ce65765082d1c5f67846ddfa65f291117d6e5a795ac2961d56eb24060d8b160d5bd146cd61589c00a108a1dba9e8730157e403cc35b0cd64b3aa66eada80be3bbb974d4642aa76bdf87c2d63134af1c646b1f0bfd218d4e4ebd277ad1cfc9b6f20c4036c6a511cb1ce486c3a563ca9368b10bed088bcfcdab752e0c78a10e550544ee6250d3908e3e7b09b2119f94abc2fdf43d7c82a4ffce81a3f962124ace1108443f41202c6d055d37e99b4eb6287c485acabff03f3a115db1ec790fdc5436e97bf2443c2f707ffb513f6d6494812b2238d679c8787a854ec92126bdc4681803ed4a5b84590e4f00ce956c6c3394773303b0620d118d2290cb229ea3b9bb9de8d719a0f92a50d34909a363f5f6ff906326f917be78c914c78846ef30c9b107b26c0a55401ceabf5b3c669eaa7a1a36d97b01d5da410366e3da5d232fb711d26afd9d4a5016425e47c0ec9b6305673af4cb46526af752011793c322797fb706042da364b6e723b513fd73db6721b00bd80e0923fe075300951d4dfefdd029c3fed21b734bf102f96d58b50bf4edcad014670c2d93eeb4d7bda3d1b70d9e21262c644bb96855895e4c0b32c9ed599d940ac24814b69812c124648428e13d7f72d74feb30288eb78b4a99fadc96589d8a9c7047787aa802514ba28af4d5520ac50928cd75ca92e2934a2e126456bfe1587003e87d9428b1fdb6b7662c44a5fee9d537b7f43822e5b103aeece1aa603215c215de2873e3a6b327c5ed0a0190fb7645034e1839ad165f3f7f80fd793734ac1412bbe20d82aea543792047ba5c5b37ee11988cd7e71cd43547e13c6bbc1ce3cf6aff9727381f06feb83b23b694724d9259d3736eba6ee66ee73a224b8a978debbbc35f8e28cc8267646e5c8cd8076d2044d41eadce01738ab2c7dc763de5a8042b957680223c4d9fdbf65d17e8998444e8db36c50fbe3c9a83e506661a029c4538617d46b6a43675c6dcf283a45b99e44188fd2681a50747e819e7f37496207ec448670fe62a3cb94712abeafb5dd2690ec12b18f8d67d5b0db41a897124f8b94695501aba517447338034bf14d0f99cbf5518aa013e1f35a052b4d27d1247349ff7a83362444372f017fcbdfe972b91c46a0a57f4639204673341ae92bc2dbf2b8d1680b432552850964eb1e14f38995e7e404b1bd1bf63d8d58c7b4ec38e3b9e73959e6509ad9f67d684f62759f5cae90bf8c1781b5800922c312aa634e5748b6181fc37df267eb5c66afc0c9249f9f601136c78d817beddf308c6970ee0e8221abe6fa124f55de7e5e78398004095a175f58cc270840e8c6759627f139e4f9b3b362e2700c5d06da66e862d1016c9f89d18646a6bb823f992342433b03397ed7586f489824a1495d707c81d3885029a47845802ef97856e530789a5cb7239752c6509cdd094212cb4b1b8baa7416cf5000db59418ad7f7a0d7d8e4cb8ebbbe4c40ba0ccc25283b9c933e251fff9871fc01026fafd8eed7ddcbe454b79339be93cd4b25a55af449f5c0893a957c5468c9147a973478c834ac4ecfea339cf3", 0xa9b}], 0x7}}], 0x300, 0x0) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x1}}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_PORTS(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x70bd28, 0x25dfdbfe}, 0x1c}}, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042, 0x3}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001980)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xfff1}, {0x2, 0x3}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0xe, '\x00', 0x401, 0x1, 0x6, 0x2}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40098}, 0x4004004) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x1, 0xfffffffb}}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x3, {{0x42, 0x2}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4c004) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x4, 0x8000007, 0x3, 0x180, 0x2, 0xc, 0xf1, 0xfab3, 0x5, 0x5, 0x0, 0xd, 0x0, 0x6, 0x0, 0xbd9], 0x1000, 0x43102}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 18m7.981577365s ago: executing program 0 (id=466): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_VDPA_GET_DEVICE_ID(r0, 0x8004af70, &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x4050}, 0x9) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), r1) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x40, r2, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7ff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9c3}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000801}, 0x40010) (fail_nth: 3) r3 = openat$full(0xffffffffffffff9c, 0x0, 0x800, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000003c0)) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000400)={'ip_vti0\x00', 0x0, 0x77, 0x7, 0xffffffff, 0x3, {{0x5, 0x4, 0x0, 0x2, 0x14, 0x64, 0x0, 0x10, 0x6, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0xe}}}}}) ioctl$TIOCGSID(r3, 0x5429, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, r1) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, 0x0, 0x24008001) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r5, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000940)={0x30, r2, 0x8, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0xc0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000a00)={0x400, r0}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000a80), r5) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={0x0}, 0x1, 0x0, 0x0, 0x2000c814}, 0x40800) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, &(0x7f0000000c40)) r6 = syz_genetlink_get_family_id$devlink(0x0, r0) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x38, r6, 0x8, 0x70bd27, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000e00), 0xffffffffffffffff) 18m7.580515852s ago: executing program 0 (id=468): set_mempolicy(0x3, &(0x7f0000000080)=0x6, 0x5) (async) r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) (async, rerun: 64) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, 0x0) (async, rerun: 64) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'trusted:', '\x918s\x89X', 0x20, 0xffd}, 0x2f, 0x0) (async, rerun: 32) r1 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) (rerun: 32) keyctl$read(0xb, r1, &(0x7f0000000240)=""/112, 0x349b7f55) (async, rerun: 32) getsockopt(0xffffffffffffffff, 0xe8d, 0x8, &(0x7f0000000000)=""/90, &(0x7f00000000c0)=0x5a) (async, rerun: 32) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) (async) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='\x00', 0x274) (async, rerun: 32) r6 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0xe7d42f9f9704d9c1}, 0x4000) 18m6.973318142s ago: executing program 0 (id=472): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_VDPA_GET_DEVICE_ID(r0, 0x8004af70, &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x4050}, 0x9) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), r1) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000ddc321fcf014ebf8851e0032fdf1c6233761e011b84b2c9bf84f3ce93bae27bafa3ad7a7fe89ae11", @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf250f000000240007800c000400070000000000000008000200ff0700000c000300c3090000000000000800068004000500"], 0x40}, 0x1, 0x0, 0x0, 0x4000801}, 0x40010) r3 = openat$full(0xffffffffffffff9c, 0x0, 0x800, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000003c0)) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000400)={'ip_vti0\x00', 0x0, 0x77, 0x7, 0xffffffff, 0x3, {{0x5, 0x4, 0x0, 0x2, 0x14, 0x64, 0x0, 0x10, 0x6, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0xe}}}}}) ioctl$TIOCGSID(r3, 0x5429, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, r1) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, 0x0, 0x24008001) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r5, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000940)={0x30, r2, 0x8, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0xc0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000a00)={0x400, r0}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000a80), r5) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000b40)={0x0}, 0x1, 0x0, 0x0, 0x2000c814}, 0x40800) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, &(0x7f0000000c40)) r6 = syz_genetlink_get_family_id$devlink(0x0, r0) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x38, r6, 0x8, 0x70bd27, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000e00), 0xffffffffffffffff) 18m6.720080489s ago: executing program 0 (id=473): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='illinois', 0x8) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e22, @rand_addr=0x64010100}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000200)="2cf924f84439dcb17d41f943889d93fe0060d7566f2f08baf086711b0376f179559066d8a1abd422d7c5a83d70c0bc656f35992e5d74ff0c49e4f896c2ca055ef240ad7b2d500e59e99c28b5d430c9d11f039ae8f4c4cf387f39a433d36ea883e5c86ccc3be3965a30ad23b5ca8474391aaff950119ff84a63d78aaeda28e962cb6111e6b8db7f09a72930db4adc26f95c0600a69fa8c4505b7f7e4f0d977c0f27ebfdc013aa732c0b5a782338535f8f97ddee7b967fdb5cca03a0d14845a342588db78100000000000000", 0xfffffffffffffeaf, 0xb, 0x0, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @multicast1}, 0x10) 18m6.471425004s ago: executing program 32 (id=473): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='illinois', 0x8) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e22, @rand_addr=0x64010100}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000200)="2cf924f84439dcb17d41f943889d93fe0060d7566f2f08baf086711b0376f179559066d8a1abd422d7c5a83d70c0bc656f35992e5d74ff0c49e4f896c2ca055ef240ad7b2d500e59e99c28b5d430c9d11f039ae8f4c4cf387f39a433d36ea883e5c86ccc3be3965a30ad23b5ca8474391aaff950119ff84a63d78aaeda28e962cb6111e6b8db7f09a72930db4adc26f95c0600a69fa8c4505b7f7e4f0d977c0f27ebfdc013aa732c0b5a782338535f8f97ddee7b967fdb5cca03a0d14845a342588db78100000000000000", 0xfffffffffffffeaf, 0xb, 0x0, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @multicast1}, 0x10) 17m37.735740675s ago: executing program 4 (id=616): r0 = openat$drirender128(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r0, 0x40106410, &(0x7f0000002100)={0x0, 0x0}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ptrace$ARCH_GET_UNTAG_MASK(0x1e, 0xffffffffffffffff, &(0x7f0000000140), 0x4001) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a98000000060a010400000000000000000a0004050900010073797a30000000006c000480680001800a000100696e6e6572000000580002800800014000000000340005800c0001007061796c6f61640024000280080003400000009208000440000000240800014000000014080002400000000208000340000000020800024000000084080003400000000c0900020073797a3200000000140000001100010000000000000000000100000a257e7369cd889f0d8fc076c921c8eccce7b5166a6ef538e652947a8d3a770c791045517fcff76514bcdb74e39fecab6a0e74005d2def12652778c488fd065710d1453404403bf6f0cdf7c09054dce0fa7284796e"], 0xc0}, 0x1, 0x0, 0x0, 0x48890}, 0x24000000) recvfrom(r5, &(0x7f0000000080)=""/37, 0x25, 0x12020, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) splice(r6, 0x0, r4, 0x0, 0x100000000001, 0x0) read$watch_queue(r3, &(0x7f0000000540)=""/222, 0xe80) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x300000c) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b040000000000000000020000004000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000001308000340000000150900010073797a30000000000900020073797a32"], 0x94}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020afc000700000028bd7000fedbdf2505001a0000000000000000000000006401010000000000000000000000002c003000006d0c066ead"], 0x38}}, 0x40408c0) ioctl$KVM_SET_SREGS2(0xffffffffffffffff, 0x4140aecd, &(0x7f0000000480)={{0xe566c797b7515b9, 0xffff1000, 0x10, 0x9, 0x81, 0xb7, 0x81, 0xff, 0x0, 0x2, 0x0, 0xb}, {0xeeef0000, 0x7000, 0xe, 0x3, 0x3, 0x63, 0x6, 0x6, 0x1, 0x0, 0xfa, 0x2}, {0xf000, 0x8000000, 0x4, 0x4, 0x10, 0x0, 0xdb, 0x13, 0x5, 0x4, 0x92, 0x80}, {0x10000, 0xeeef0000, 0xe, 0x7, 0x1, 0x40, 0x2, 0x0, 0xfd, 0x29, 0x9, 0x9}, {0xeeee8000, 0xdddd0000, 0xc, 0x9, 0x5, 0x2, 0x7, 0xf1, 0x2, 0x3, 0x2, 0x2}, {0x7000, 0xdddd1000, 0xa, 0x2, 0xad, 0x2, 0x5, 0x5, 0x1, 0xe, 0x4, 0xa}, {0x10000, 0x4000, 0x0, 0x0, 0xcd, 0x5, 0x5, 0x26, 0x8, 0x6, 0xff, 0x6}, {0x1, 0xf000, 0xe, 0xe, 0x13, 0x40, 0x3, 0xa4, 0x7f, 0x1, 0xfe, 0x9}, {0x0, 0x5}, {0xc000, 0xff81}, 0x80000003, 0x0, 0x6000, 0x31, 0x5, 0x3100, 0x6000, 0x1, [0x2, 0x2, 0x8, 0x3]}) 17m36.763227583s ago: executing program 4 (id=619): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYRES8], 0x0) (async) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) (async) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x480a8, 0x0, 0x21, 0x0, 0x0) (async) r3 = inotify_init1(0x80800) inotify_add_watch(r3, &(0x7f0000000180)='./file0\x00', 0x800007a1) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) (async) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000140)={0x454203, 0x5b4}, 0x18) (async) ioctl$INCFS_IOC_PERMIT_FILL(r3, 0x40046721, &(0x7f0000000080)={r3}) (async) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, 0x0, 0xe) (async) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="40000600000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17m35.986973231s ago: executing program 4 (id=623): mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2, 0x8031, 0xffffffffffffffff, 0xffffd000) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x4000) ioctl$SNDRV_TIMER_IOCTL_TREAD64(r0, 0x400454a4, &(0x7f0000000180)=0x1) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) getsockopt$inet_mptcp_buf(r2, 0x11c, 0x3, &(0x7f0000000080)=""/49, &(0x7f00000000c0)=0x31) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x24040084) syz_open_dev$sndpcmp(&(0x7f0000000040), 0x5, 0x420040) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000800)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x4, 0xa}, {}, {0xffe0, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0x6}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 17m35.002175592s ago: executing program 4 (id=631): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=ANY=[@ANYBLOB="340000000002010300000000000000000200001004000a801c000a050000008014000180080001000a01010108000200ac1414aa"], 0x34}, 0x1, 0x0, 0x0, 0x40810}, 0x0) (async) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=ANY=[@ANYBLOB="340000000002010300000000000000000200001004000a801c000a050000008014000180080001000a01010108000200ac1414aa"], 0x34}, 0x1, 0x0, 0x0, 0x40810}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0xffffffffffffffe0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000010000104004000000101000000000000", @ANYRES32=0x0, @ANYBLOB="09000200010000001c0012800900010069706970000000000c000282080002007f00000500001f0008000000"], 0x44}, 0x1, 0x0, 0x0, 0x4014}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0xffffffffffffffe0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000010000104004000000101000000000000", @ANYRES32=0x0, @ANYBLOB="09000200010000001c0012800900010069706970000000000c000282080002007f00000500001f0008000000"], 0x44}, 0x1, 0x0, 0x0, 0x4014}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x40007, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0x4000ff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x9, 0x200b398, 0x8001, 0x1, 0x4, 0x20001c, 0x7, 0xfffffffd, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x407, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x7, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xd, 0x5, 0x9, 0x5, 0x3, 0x9, 0x0, 0x2000c7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x1, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x7, 0x5, 0x80000001, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/mdstat\x00', 0x0, 0x0) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000000500)='/proc/mdstat\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') (async) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000000)='./file0/../file0/../file0/../file0/file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) (async) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="21000000000000002c00128009000100626f6e64000000001c00028005002100010400080500010004"], 0x4c}}, 0x40) r9 = dup(r7) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x600, &(0x7f0000000080)=[{&(0x7f00000000c0)="d8000000180081084e81f783db4cb9040a07080006007c09e8fc55a10a0015000600142603600e120800020081000401a8000100fcc0ffff000000fd035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbaceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace0d81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/216, 0xd8}], 0x1}, 0x0) (async) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x600, &(0x7f0000000080)=[{&(0x7f00000000c0)="d8000000180081084e81f783db4cb9040a07080006007c09e8fc55a10a0015000600142603600e120800020081000401a8000100fcc0ffff000000fd035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbaceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace0d81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/216, 0xd8}], 0x1}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) 17m34.048075605s ago: executing program 4 (id=636): setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r0 = socket$tipc(0x1e, 0x2, 0x0) connect$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x5}}, 0x10) sendmmsg$inet(r0, &(0x7f0000006740), 0x0, 0x0) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x1}}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_PORTS(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x70bd28, 0x25dfdbfe}, 0x1c}}, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042, 0x3}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001980)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xfff1}, {0x2, 0x3}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0xe, '\x00', 0x401, 0x1, 0x6, 0x2}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40098}, 0x4004004) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x1, 0xfffffffb}}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x3, {{0x42, 0x2}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4c004) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x4, 0x8000007, 0x3, 0x180, 0x2, 0xc, 0xf1, 0xfab3, 0x5, 0x5, 0x0, 0xd, 0x0, 0x6, 0x0, 0xbd9], 0x1000, 0x43102}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 17m33.784522755s ago: executing program 4 (id=637): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x3ffd, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xffe0}, {0xffff, 0xffff}, {0x14, 0x1}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000}, 0x40004) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4008091) 17m33.364205119s ago: executing program 33 (id=637): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x3ffd, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x2) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xffe0}, {0xffff, 0xffff}, {0x14, 0x1}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x2000}, 0x40004) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4008091) 13.023854018s ago: executing program 6 (id=4932): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x2c91, 0x4) sendmsg$sock(r0, &(0x7f0000000540)={&(0x7f0000000580)=@in6={0xa, 0x4e20, 0x81, @mcast1, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000000240)=[@mark={{0x18, 0x1, 0x51, 0x10a}}], 0x18}, 0x4000040) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000002640)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="200e023b1f28425cca62182326937ed7082aad3c52be33b9b0f00ebc6fce01c98b3458fc0162f75edf0098352d6d5bf09540aeffff7e43575aaf9373cd44538a54bca1901476f0d4b939450d43449f994a7c084d61127a01bd4dcb027641a749", @ANYRESHEX=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000001680)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0x2, "33fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$packet(0x11, 0x3, 0x300) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_mptcp(0xa, 0x1, 0x106) close(0x3) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x2f, 0x9, 0x70bd25, 0x0, {0x4}, [@typed={0x8, 0xc, 0x0, 0x0, @u32=0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42014}, 0x4080040) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, &(0x7f00000009c0)=ANY=[@ANYBLOB="001602"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r1, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000200)={0x40, 0x12, 0x1, '\b'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) ioctl$INCFS_IOC_CREATE_FILE(0xffffffffffffffff, 0xc058671e, 0x0) 9.648487846s ago: executing program 1 (id=4947): socketpair$unix(0x1, 0xbc51861ca70c2d00, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000280)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r2, 0x7}}, 0x48) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000280)=0x1, r4, 0x0, 0x1, 0x4}}, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r4, 0x7}}, 0x48) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x42060680) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000406010300000000360000000500000805000100070000eca777215e4970a1310000000005871a5b3c55a2036b3490585c8680d4b90f1c3ed86347cb095d855e535e8551c5e04cf293080401c8c49835ef06562f55db747575e3fe1c0f65c6a0ac39891ddac621f9bd3cbf328be4e17c86a5259ec1a6047bbf319f921e8fda1750034a2203b596e2fc59496e0e879997f964597aacc05792ab67cf827cb072f775265d29cfb0a33b436fd1ac72246a98f4305d3babfaf3a8fce40f1be2bda116b1d34e47473f39aa995a813a710dae914618c4d6fe5ba44aca3e0570dd32977ed521baedf6801196e24f18640f84add06d5a3d091db19c0afcfc4fe365e11e5c9b82d02b079c934b9324386f08f8f13b68e630f47ac96b480f000000000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x408c0}, 0x4000000) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0x4000000a00}) socket(0x15, 0x6, 0x5) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)) timer_create(0x0, 0x0, &(0x7f0000bbdffc)=0x0) socket$inet6_udp(0xa, 0x2, 0x0) timer_settime(r6, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x80, 0x2, 0x0, 0x0, 0xffffeffa) r7 = userfaultfd(0x801) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r7, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 9.644336892s ago: executing program 6 (id=4949): syz_usb_connect(0x2, 0x47, 0x0, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r2, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x10a942, 0x9f667fd378a54ed4) write$P9_RREADLINK(r3, &(0x7f0000000040)={0x10, 0x17, 0x2, {0xffffffffffffffc1, './file0'}}, 0xfffffdab) (async) close(0xffffffffffffffff) (async) madvise(&(0x7f00008d8000/0x3000)=nil, 0x3000, 0x64) (async) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) r4 = userfaultfd(0x80801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x111}) (async) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2041}, 0x1}) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0xfffffffffffffffe, 0xab7, 0x1035, 0x280000000006, 0x40000000, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0xbf4, 0x6, 0x8000000000005, 0x800000068], 0x2000, 0x80cd4}) (async) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CAP_X2APIC_API(r8, 0x4068aea3, &(0x7f0000000080)={0x81, 0x0, 0x3}) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) (async) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) ioctl$KVM_SET_LAPIC(r7, 0x4400ae8f, &(0x7f0000000840)={"96398d2fd9b43f86d912e46b79bc31220f8763754c201a0392a16210166895317c919effe306379c8bfc6deabd7ce27fdec0c16a77e7fd5f6f96a3e3a2c53ff467d7965124bed66f2d8df224e357d27c36b9b6df92a82b83fb54fcfa10c6a32d5f2e7fcdda12fac3c3518498e23bf6af290a0bda5a9a003cfceed707d0108f33d7c1ebe7d0adc55f36f0b756c05951bff0bb3e54ea276103ce9cb1ca20fdead019b2b1ea4c45fdb7b296d171fb1bea1c28759ef6cd0548b8f6c7e13743026fd78553a6c921e9109aecef7eeea9e2e8904d62e8af2a0eabb6fd0a638e9559ca96f85c7fc303f2992e75261d6f4dacb14180333080274fe22f47efb609802d3f0866ded623740181cc626e81157af8d758c8385e97998604ef132535aa1c2df0a88b3e01c0aa6b401329d757126da4ed7a1edc34b00f91613b57fff7024ca4706b4c79de16e8e1caa8624be0f02d2d76fa0f27f3a51556a00cd21ed0402a543fbc89a6f2636316f13ac1b98284f30efcfbe74c67a7c46549accfddf12fe25ccb9aa6d18a28e4c63c1a2a134786a646f3e7432cc1e477454d8839679a7a9da6c923622cc2ec748b2337fec8187b03c94721c1607ef7f305e718a004d01af6b23a0834c2cc8e6bf75b574786d1468baceaa70f58d444d97cffc3a7d9ffb54ca3a0500c6499018d07f3b9e82ee0ba7eb94ca949e4da9ab0c71edfff53e703adfafb5e2bfcac165fe483dc04620d18fb3f46741dc32ad9887dbc3fe53d47fac34b72156b7a4366bc717a7f3dafae82026fde89cbfbcf22bcb3768ba51c4a29984c4ec5334c9aee894b8256c45d85149688bef7ade6dbd483cadba1e87506a32b84e80d339c56cd5955dd7a1eb7894afd5b774f44ec1c3e847d1a83db24ca98ec893f798d854c4aadfc02d4a93dc7aeacc4dcaa5b683b0110e226acb1cdf6ea4ce53a5abeda7de6a34eb47b152c8c7dd26f2300dd180c5595a00e1e8cfbc22842a6f7a750402d5909edc8ab69249cb256ec6263123f9d26296b3358461e8da2561be0c269fa3fa4f29fdc36b35e2fbf0e9d62900c4ab98328ee0bc15599f800b8688a655bfbcf26e0ae7fd175d1c4e31e981623d3c9f27a1ca89d79a4e599501b6a16cbc7c38d4bc29817a92f642bf0dcacdbc07753296e7568287889a03e43dccd05d6e54bbfd21455e2ebb1c38b97d5498ecff863cdc13e6c7aca467b660542d69024d5830a4fd505973d0f6a8a809c03ddb0459133f0535d44f0a05462a577ed03038d45acc6aac491435a3336373dda045e55c2365bdc0e375ad4a03f14531d302924397e23e3da8b88f791be2418c2e04981b27f933d435a8799e66db6d2112baca6cf7c6f6b87dacfd80e7fb6373ea2def3b7e7f2bf539a98885b537f0f218608349d6782ed66855e6b8ea533e8490224ee2bdfb7e93f27169d4dd9cc66d8c1c5"}) (async) ioctl$KVM_SET_IRQCHIP(r8, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0xffff1000, 0x2, 0x9, 0xffffffff, 0x0, [{0x80, 0x1, 0x2, '\x00', 0xff}, {0x6, 0x3, 0x5, '\x00', 0xcf}, {0x1, 0x2, 0x91, '\x00', 0x6}, {0x4, 0xfd, 0x8, '\x00', 0x97}, {0x9, 0xb, 0x80, '\x00', 0x8}, {0xfa, 0x6, 0xf, '\x00', 0x4}, {0x7, 0x15, 0x4, '\x00', 0xcf}, {0x7, 0x5a, 0xf, '\x00', 0x1}, {0x98, 0x9, 0x4, '\x00', 0xff}, {0x1, 0x1, 0xfb, '\x00', 0x9}, {0xd, 0xfd, 0x8, '\x00', 0x40}, {0x2, 0x25, 0x10, '\x00', 0x5}, {0xf, 0x4, 0x8, '\x00', 0x7f}, {0x6, 0x1, 0x8, '\x00', 0x8}, {0x81, 0x10, 0x4, '\x00', 0x85}, {0x1, 0xe, 0x2, '\x00', 0x20}, {0x0, 0x0, 0x20, '\x00', 0x5}, {0x20, 0x40, 0x8, '\x00', 0xfc}, {0xb, 0x3, 0x5, '\x00', 0x4}, {0xf9, 0x5, 0x9, '\x00', 0x8}, {0x1, 0x2e, 0x5, '\x00', 0xa}, {0xb, 0x5, 0x1, '\x00', 0x21}, {0x5, 0xec, 0xc0}, {0x6, 0x25, 0x0, '\x00', 0xb}]}}) (async) r9 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r9, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000400)="b8b13a54c40f23d00f21f835000000050f23f8ea7e3fe5c5ff0065660f3881123e3e66f30f217f8fc978dbd8660f1600f74e00068b000066baf80cb84815b280ef66bafc0c66b8010066ef0f01cf670f23c6", 0x52}], 0x1, 0x41, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f000074f000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000380)="650f22ddb9bb020000b8a9270000ba000000000f30660f38801f0fc76d39f30f300f20d835200000000f22d80fc7b38c0000003e67861dc7442400ac22139bc744240241670000c7442406000000000f011424ff1a", 0x55}], 0x1, 0x43, 0x0, 0x0) (async) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4400ae8f, &(0x7f0000000200)=@arm64={0x3, 0x5, 0x9c, '\x00', 0x1bd}) (async) ioctl$KVM_RUN(r9, 0xae80, 0x0) 8.841433448s ago: executing program 2 (id=4953): r0 = open(&(0x7f0000000300)='.\x00', 0x2800, 0x0) flock(r0, 0x6) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000000)={0x0, 0x2ece2c58, 0x4, 0x5, 0x5, 0x9, 0x0, 0x0, {0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x3, 0x9, 0xb, 0x7fff, 0x4}}, &(0x7f00000000c0)=0xb0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={r1, 0x6}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x7c, 0x10, 0x421, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x17, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8}, @IFLA_GRE_OKEY={0x8}, @IFLA_GRE_ENCAP_SPORT={0x6}, @IFLA_GRE_ERSPAN_DIR={0x5}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x7c}}, 0x0) open(&(0x7f0000000300)='.\x00', 0x2800, 0x0) (async) flock(r0, 0x6) (async) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000000)={0x0, 0x2ece2c58, 0x4, 0x5, 0x5, 0x9, 0x0, 0x0, {0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x3, 0x9, 0xb, 0x7fff, 0x4}}, &(0x7f00000000c0)=0xb0) (async) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={r1, 0x6}, 0x8) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x7c, 0x10, 0x421, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x17, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8}, @IFLA_GRE_OKEY={0x8}, @IFLA_GRE_ENCAP_SPORT={0x6}, @IFLA_GRE_ERSPAN_DIR={0x5}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x7c}}, 0x0) (async) 8.558330301s ago: executing program 3 (id=4955): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe4", 0xc) accept4$alg(r1, 0x0, 0x0, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}}, 0x24}}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x20000254}, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xffffdffe, 0x34f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x100, 0x0, 0x1f0, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x200, 0x2, 0x252, 0x0, r2}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) ioctl$BLKRASET(0xffffffffffffffff, 0x1262, &(0x7f0000000040)=0x7f) pwritev(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) 8.383402149s ago: executing program 2 (id=4956): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r0, 0x26, &(0x7f00000000c0)={0x1, 0x1, 0x2, 0x73e9}) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000240)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000440)={r0, 0x20, &(0x7f0000000400)={&(0x7f00000002c0)=""/237, 0xed, 0x0, &(0x7f00000003c0)=""/55, 0x37}}, 0x10) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) sched_setscheduler(0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r3, &(0x7f0000000b00)={'syz0\x00', {0x5, 0x7, 0x3, 0x7}, 0x50, [0x2, 0x9, 0x0, 0x1, 0x8, 0xea45, 0xe, 0x1, 0x63, 0x1, 0x6, 0xc, 0x400002, 0x4009, 0x1, 0x4, 0x451a9660, 0x7fffffff, 0x51, 0x8, 0x401, 0xa4d, 0x3ff, 0x4, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0xc, 0x9, 0x4, 0x2, 0x1, 0x5, 0x4, 0x1, 0x4, 0xa, 0x8, 0x3, 0x9, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x0, 0x2, 0x4, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x402, 0x2a, 0x1, 0x23], [0x8, 0x20009, 0x9, 0x9, 0x80000005, 0x12, 0x800, 0x2c, 0x0, 0x2329, 0xa, 0x3, 0x7, 0x5, 0x0, 0x24a, 0x6, 0xfffffff7, 0x1ff, 0x3, 0x5, 0x4009, 0x80, 0xb, 0x8001, 0x40, 0xa1, 0x4, 0xffffffff, 0x5, 0x10004, 0x9e, 0xffffff00, 0x7ff, 0x6, 0x0, 0x0, 0x7, 0xffff3f16, 0xc, 0x2, 0x9, 0xa, 0x5, 0x1ff, 0x207, 0x800, 0x5, 0xc5, 0x3, 0x5, 0xd, 0x8, 0x3, 0xffff7ff7, 0x3, 0x24c, 0x1fe, 0x2a0, 0x5, 0x6, 0x9, 0x280007, 0x8], [0x20002, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x9, 0x1, 0x8, 0x7aae, 0x5, 0x2, 0x7ffffff7, 0x8000, 0x1, 0x1, 0x5, 0x400, 0x2, 0x2b0, 0x3, 0x97f82544, 0x8, 0x0, 0x0, 0x9, 0x5, 0x4, 0x10000, 0xc90, 0xffffff3c, 0x8b2, 0x10, 0x4, 0xff, 0x140, 0x2, 0x2, 0x1000000c, 0x0, 0x6, 0x7, 0x8007c12, 0x5, 0x9, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x0, 0xffffff00, 0x100, 0x3fff80, 0x1, 0x0, 0x8, 0xdd, 0x1, 0x9, 0xc3, 0x20ffff, 0x7a0], [0x9, 0x3a8d, 0xffff9a7f, 0x8000200, 0x6, 0x1, 0x1, 0xfffffff3, 0xd077, 0x2, 0x9b37, 0x1f, 0x81, 0xa, 0x6, 0x2, 0x200, 0x101, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x4, 0x5, 0x80000001, 0xffff, 0x101, 0x0, 0xfffffffd, 0x1, 0x10001, 0x61, 0x10, 0x1000, 0xc, 0x100, 0x8, 0x20000000, 0x8, 0x15, 0xb32a, 0xec000000, 0x8001, 0x1904, 0x0, 0xc, 0x8, 0x7ff, 0x280, 0x5, 0xfffffffb, 0x7, 0x8, 0x8, 0xc, 0x9371, 0x4f89, 0x7, 0x780, 0x2d1, 0x80, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000340)={{0x0, 0x1, 0x0, 0xffffffff, 'syz0\x00', 0x71}, 0x1, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="183400000300000000000000001900001843000197cd2a1effffffff00000000"], &(0x7f0000000080)='syzkaller\x00', 0x10001, 0xc9, &(0x7f0000000140)=""/201, 0x40f00, 0x1c, '\x00', 0x0, @fallback=0x28, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000280)={0x5, 0x8, 0x10000, 0x1}, 0x10, r1, r0, 0x5, &(0x7f0000000480)=[r0, r0, r0], &(0x7f00000004c0)=[{0x4, 0x3, 0x4, 0x3}, {0x4, 0x3, 0xe, 0x7}, {0x5, 0x2, 0x5, 0x4}, {0x2, 0x2, 0x1, 0x4}, {0x3, 0x5, 0xf, 0x8}], 0x10, 0xfffffffa}, 0x94) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x2000b, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000600), 0x50080, 0x0) syz_clone(0x20c000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r4, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee1768812003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) futex(&(0x7f000000cffc), 0x5, 0x0, 0x0, &(0x7f0000000000)=0x6, 0x25000001) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0xe0904111, 0x0, 0x0, 0x0, 0x0, 0x0) syz_create_resource$binfmt(0x0) semget(0x1, 0x3, 0x148) 7.552292936s ago: executing program 1 (id=4958): socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioprio_set$pid(0x1, 0x0, 0x2004) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, &(0x7f0000000180)={0xfffffffffffffffc, 0x0, 0x569, 0x1800, 0x4, 0x20000000, "5debca561a5fbf61048955f6f876b2ff", 0x0, 0xf0, 0x4, 0xc, 0xff, 0x0, 0x4}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b3, 0x0, 0x1, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280), &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, 0x0, r4, &(0x7f0000000580)={0x2e, 0x13, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYBLOB="0203ff030d0000002abd7000fbdbdf250300090058000000c19b3c4c497b4056a509e00000000000030006003c00000002004e22ac1414bb00006e000000000002000100000004d40000070300000000030005000000000002004e21ac1e010100000000000000008ee2b5"], 0x68}, 0x1, 0x7}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=@newtfilter={0xf0, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0xe, 0xe}, {0xd, 0xb}, {0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0xc0, 0x2, [@TCA_FLOWER_ACT={0xbc, 0x3, [@m_tunnel_key={0x60, 0x1, 0x0, 0x0, {{0xf}, {0x30, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x1, {{0x0, 0x3, 0x1}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x2, @rand_addr=0x64010100}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x3, @rand_addr=0x64010101}]}, {0x4}, {0xc}, {0xc}}}, @m_sample={0x58, 0x2, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0xa6}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0xe, 0x5, 0x2, 0x3, 0x7fff}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x4, 0x43}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0xf0}}, 0x0) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962", @ANYRES32, @ANYRES32], 0x50d8}}, 0xc000) close(r10) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f00000000c0)={'macvtap0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r13, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) syz_ublk_setup_queues(r7, r5, &(0x7f0000000500)={0x0, 0x9d24, 0x800, 0x3, 0x2000000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x994f, 0x400, 0x3, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf7ff, 0x1000, 0x1, 0x183}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7c10, 0x1000, 0x2, 0xe3, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29e7, 0x8000, 0x1, 0x20000392}}], 0x1, &(0x7f0000000340)={0x2e, 0x6f, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0xe0ffffff, {}, 0x1f, 0x0, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) 7.193936085s ago: executing program 3 (id=4959): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff1000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x214f, 0xc000, 0x3, 0x14b}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r1 = open(&(0x7f0000000280)='./file0\x00', 0x12a401, 0x11) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e21, 0x40, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c) r2 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0, 0x0, 0x50}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1d, 0x4, 0x6) unshare(0x26020480) setsockopt$packet_rx_ring(r3, 0x107, 0x5, 0x0, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r9, 0x7d4165c9) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000300)='illinois', 0x8) listen(r8, 0x0) 6.443324172s ago: executing program 6 (id=4960): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x128) fallocate(r0, 0x18, 0x2, 0x1ff) writev(r0, 0x0, 0x0) bind$xdp(r0, &(0x7f0000000140)={0x2c, 0x0, 0x0, 0x34}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'ip6erspan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r4 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280), 0x1c200, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f00000002c0)={@ipv4={""/10, ""/2, @remote}, 0x0}, &(0x7f0000000300)=0x14) ioctl$sock_inet6_SIOCDELRT(r5, 0x890c, &(0x7f0000000380)={@mcast1, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x22}}, 0x101, 0x2, 0x0, 0x0, 0x85de, 0x400a0002, r6}) r7 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0) shutdown(r4, 0x1) write$tun(r1, &(0x7f0000000680)={@val={0x8, 0x883e}, @val={0x0, 0x1, 0x6, 0xfdcd, 0x2f, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x28, 0x63, 0x0, 0x40, 0x11, 0x0, @private=0xa010104, @broadcast}, {0x4e26, 0x4e20, 0x14, 0x0, @gue={{0x2, 0x1, 0x3, 0x9}, "97ef8515"}}}}, 0x36) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, &(0x7f0000000000), 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipoib={{0xa}, {0x4}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x47f}]}, 0x3c}}, 0x0) 6.384967265s ago: executing program 2 (id=4961): r0 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"2ac78e02ff04856af9fb71f0d3fe13be", "3dfab043e15fad27a639f105b5e9f977", "47eb0b1889b90f105d66b3e5a7c94742"}, 0x4, 0x4}) r1 = syz_open_dev$video(&(0x7f0000000000), 0x6, 0xc8400) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000680001270000000000f0ff0000000000000000000f0001"], 0x2c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="60000000100001060000000000000000000000000000000000000000000000000d000300626172657564703000000000300012000c000100626172657564700020000200060001"], 0x60}}, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=@newlink={0x4c, 0x10, 0x1, 0x0, 0x3, {}, [@IFLA_VFINFO_LIST={0xc, 0x16, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN_LIST={0x4}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bridge_slave_0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x4c}, 0x1, 0x0, 0x0, 0x14}, 0x0) ioctl$VIDIOC_G_SELECTION(r1, 0xc040565e, &(0x7f0000000040)={0x2, 0x2, 0x0, {0x2, 0xf, 0x6, 0xfffffff7}}) r5 = fanotify_init(0x200, 0x0) syz_usb_connect(0x0, 0x5d, &(0x7f0000000fc0)={{0x12, 0x1, 0x110, 0xe, 0x73, 0x1b, 0x8, 0xf11, 0x1031, 0x2f8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4b, 0x1, 0x7, 0x95, 0x70, 0x1, "", [{{0x9, 0x4, 0x6b, 0x2, 0x3, 0xd6, 0xff, 0xd0, 0x81, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x3, 0xf800, 0x6, 0x3}}], [{{0x9, 0x5, 0x80, 0x2, 0x20, 0x7f, 0x8, 0x80}}, {{0x9, 0x5, 0x5, 0x10, 0x3ff, 0x77, 0x3, 0x3, [@generic={0x7, 0x5, "d75eef973c"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x20, 0x72, 0xff, 0x40}}]}}]}}]}}, 0x0) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r6, r6, r6}, &(0x7f0000000040)=""/47, 0x2f, &(0x7f0000000100)={&(0x7f0000000080)={'sha512\x00'}}) r7 = syz_open_dev$sg(&(0x7f0000000000), 0xf9ba, 0x501) ioctl$SG_SET_COMMAND_Q(r7, 0x2271, 0x0) fanotify_mark(r5, 0x132, 0x40001002, 0xffffffffffffffff, 0x0) r8 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r8, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"2ac78e02ff04856af9fb71f0d3fe13be", "3dfab043e15fad27a639f105b5e9f977", "47eb0b7c4fb9191024da8887f94ba4fb"}, 0x4, 0x5}) close_range(r0, r0, 0x0) 6.127707155s ago: executing program 3 (id=4962): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000640)=0xcde, 0x4) (async) listen(r0, 0x8001) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000e40), 0x1, 0x0) ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xfffff45c}, 0x8) (async) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) (async) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) (async) bind$inet(r2, &(0x7f0000000400)={0x2, 0x4e20, @empty}, 0x10) (async) listen(r2, 0x5) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r3, 0x0, 0x0, 0x20008001, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) accept4(r2, 0x0, 0x0, 0x0) (async) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000140)={&(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x80000, 0x0, 0xffffffffffffffff}) ioctl$HIDIOCGUSAGE(r6, 0xc018480b, &(0x7f00000001c0)={0x1, 0x2, 0x0, 0x3, 0x5, 0xdfef}) (async) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000004c0), 0x8800, 0x0) ioctl$PTP_PEROUT_REQUEST2(r7, 0x43403d0e, 0x0) (async) r8 = dup3(r5, r4, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4c, 0x0, &(0x7f0000000380)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000240)={@fd, @fd={0x66642a85, 0x0, r6}, @flat=@weak_binder={0x77622a85, 0x101}}, &(0x7f0000000300)={0x0, 0x18, 0x30}}}], 0x0, 0x1000000, 0x0}) (async) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000180)=[@decrefs], 0x0, 0x0, 0x0}) 4.843270553s ago: executing program 3 (id=4963): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) sendfile(r1, r0, 0x0, 0x1002000ff) cachestat(r0, 0x0, &(0x7f00000000c0), 0x0) 4.836922757s ago: executing program 6 (id=4964): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=@newqdisc={0x150, 0x24, 0x605, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_red={{0x8}, {0x124, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x20, 0x10, 0x80, 0x8, 0xe, 0x8, 0x8}}, @TCA_RED_STAB={0x104, 0x2, '\x00\x00\x00\x00 \x00'}, @TCA_RED_MARK_BLOCK={0x8}]}}]}, 0x150}}, 0x0) 4.739577143s ago: executing program 5 (id=4965): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000002c0)={0x4800, 0x3}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003900)={0x24, 0x16, 0xa01, 0x0, 0x0, {0xa}, [@typed={0x4, 0x3ffe}, @typed={0xc, 0xa, 0x0, 0x0, @u64}]}, 0x24}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) close(0xffffffffffffffff) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xfff3}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0xfffffffd, 0x5, 0xffffffff, 0xfffffff9}, 0x9}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0xc054}, 0x8080) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r4, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 4.162046068s ago: executing program 6 (id=4966): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f00000003c0)={0x0, 0x30b5, 0x0, 0x2, 0x1000158}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) 3.972530033s ago: executing program 5 (id=4967): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8, 0x4000000}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8, 0x0, 0x2010000}, {0x7, 0x0, 0x0, 0x7}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r0}, {}, {0x46, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0}, 0x94) 3.581196413s ago: executing program 2 (id=4968): socketpair$unix(0x1, 0xbc51861ca70c2d00, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010400000000000000000a0000000900010073797a31000000000900030073797a310000000034000000030a010400000000000000000a0000000900010073797a31000000000900030073797a320000000008000a000000000440000000060a010400000000000000000a0000000900010073797a31000000000900020073797a320000000014000480100001800c000100636f756e746572006c000000060a010400000000000000000a0000000900010073797a31000000000900020073797a3100000000400004803c0001800e000100696d6d6564696174650000002800028008000100000000001c0002801800028008000100fffffffd"], 0x15c}}, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) r2 = syz_io_uring_setup(0x4443, &(0x7f0000000200)={0x0, 0x4b58, 0x80, 0x2, 0x159}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000340)) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x1, @loopback, 0x10}, {0xa, 0x4e1e, 0x800000d, @mcast1}, r4, 0x5}}, 0x48) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) close_range(r2, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$vsock_stream(0x28, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000400), 0xb04e, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000000)={0x0, 0x30314752, 0x2, @discrete={0x2, 0x40}}) unshare(0x42060680) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000000406010300000000360000000500000805000100070000eca777215e4970a1310000000005871a5b3c55a2036b3490585c8680d4b90f1c3ed86347cb095d855e535e8551c5e04cf293080401c8c49835ef06562f55db747575e3fe1c0f65c6a0ac39891ddac621f9bd3cbf328be4e17c86a5259ec1a6047bbf319f921e8fda1750034a2203b596e2fc59496e0e879997f964597aacc05792ab67cf827cb072f775265d29cfb0a33b436fd1ac72246a98f4305d3babfaf3a8fce40f1be2bda116b1d34e47473f39aa995a813a710dae914618c4d6fe5ba44aca3e0570dd32977ed521baedf6801196e24f18640f84add06d5a3d091db19c0afcfc4fe365e11e5c9b82d02b079c934b9324386f08f8f13b68e630f47ac96b480f000000000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x408c0}, 0x4000000) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0x4000000a00}) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000500)={[&(0x7f0000000300)='$)/6\x00', &(0x7f0000000340)='\x00', &(0x7f0000000380)='{$\xff', &(0x7f00000003c0), &(0x7f0000000400)=',*\x80\x02\x00\x00', &(0x7f0000000440)='({\x00', &(0x7f0000000480)='.):,}#-\'&^\x00', &(0x7f00000004c0)='\x00']}, &(0x7f0000000700)) socket(0x15, 0x6, 0x5) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r7, 0x8932, &(0x7f0000000480)={'ip6_vti0\x00', 0x0}) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)) timer_create(0x0, 0x0, &(0x7f0000bbdffc)=0x0) socket$inet6_udp(0xa, 0x2, 0x0) timer_settime(r8, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x80, 0x2, 0x0, 0x0, 0xffffeffa) userfaultfd(0x801) 3.499057737s ago: executing program 5 (id=4969): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000000880)=[{{&(0x7f0000000140)={0x2, 0x0, @rand_addr=0xac1414bb}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}, {{&(0x7f0000000180)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000000)="b9", 0x1}], 0x1}}], 0x2, 0x800) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x7fffffff, 0x1, 0x1, 0x1, 0x6}, 0x20) 3.495118132s ago: executing program 3 (id=4970): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) io_setup(0x5, &(0x7f0000000140)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xb3c6}, 0x0) keyctl$restrict_keyring(0x4, 0x0, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000700000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000000340), 0x7ff, r5}, 0x38) r6 = eventfd2(0x0, 0x0) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, r7}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r8, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc1, 0x0, 0x0, 0xffffffffffffff60, 0x0, 0x0, 0x1b, 0x7ffffffd, 0x8, 0xfffffffffffffce4, 0x0}}, 0x425d96f8b1ae7597) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x3, &(0x7f0000000880)=ANY=[@ANYBLOB="850000001400000018260000", @ANYRES32=r5, @ANYBLOB="000000000400000057c26f3504e4a9059540ebcd5329f389fcf2c80a4ba84935489f15e31cb0d01c474d4138b796ebb8526714ef4526a3a3a9601aa44f2c7e64d4b08be4c45f6d32a4125d8195453c8e4b36f4be7254de94c9bb10ec93ac3dc66525617e3c028089ca4f7ba72a2e401f1ea69e4be3d5bdda2d54674651e484b54802d4387b41d2d99e5b9875a90474a585b908cc4a4d5a7d168ad1185a1e50602b70006ed0bf5dacf849f3cd14c067dbe472809fd2a19da0208478811316416eda0b31be0b5b7be1ce1897dfc842b38a6ffee74e6a0edf2a"], &(0x7f0000000200)='GPL\x00', 0x9456, 0x2, &(0x7f0000000240)=""/2, 0x40f00, 0x10, '\x00', r9, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x6, 0x2}, 0x8, 0x10, &(0x7f0000000340)={0x1, 0xd, 0xffffa423, 0x1}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000380)=[{0x1, 0x5, 0xa, 0x8}], 0x10, 0xd}, 0x94) ioctl$KVM_GET_API_VERSION(r2, 0xae00, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r10, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)=ANY=[@ANYBLOB="a8000000030105000000000000000000030000085400188008000240fffffffb08000340000000060800014000000000080002400000000908000140000001010800034000000006080041b531e5267002400000ffff08000240000000060800034000000006080002400000000208001a400000000308000c40000000001c0019800800020004000000080001001d08000008000200010500000400188008001540000000040800a76078712ba1dbfa5e4c329d10f0251e2f917e0962ee468b6ae9a85e4d28df16380c51634b24fb83646240d0ea60fd6d6bcc6a45c9e282dede72649d5d2ba3930d0f47dbc42ada60c62468570936b03de9c02aed7410710209"], 0xa8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) io_submit(r1, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x8000, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r6}]) ppoll(&(0x7f0000000040)=[{r0, 0x35e5}, {r6, 0xd399}], 0x2, 0x0, 0x0, 0x0) shutdown(r0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x20) r11 = syz_io_uring_setup(0xf04, &(0x7f0000000400)={0x0, 0x595f, 0x2000, 0x0, 0x48}, &(0x7f0000000140)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r12, r13, r14, &(0x7f0000000280)=@IORING_OP_EPOLL_WAIT={0x3b, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002180)=[{0x20000000}], 0x1, 0x0, 0x1}) io_uring_enter(r11, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) 3.213876948s ago: executing program 5 (id=4971): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@getnexthop={0x18, 0x76, 0xb0d, 0x4, 0x25dfdbfd, {0x3}}, 0x18}, 0x1, 0x0, 0x0, 0x40080}, 0x4040000) r3 = open(&(0x7f0000000040)='./file0\x00', 0x2002, 0x104) dup3(r1, r3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="f31fbd0d660f2a630066b8000000000f23d80f21f86635000000000f23f8b80d008ed82e667c75f364b646660fc735b800008ee866b9ff03000066ba000000000f3066b9bb0800000f32", 0x4a}], 0x1, 0x55, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$KVM_SET_NESTED_STATE(r4, 0x4080aebf, &(0x7f0000005700)=@vmx={0x100, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0xfffffffffffffffe}, {'\x00', "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe2d1f2b6255614c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c955000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3.042820324s ago: executing program 6 (id=4972): syz_open_dev$vim2m(0x0, 0x0, 0x2) r0 = socket(0x10, 0x3, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x2, 0x1, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x28}}, 0x0) syz_usb_connect$uac2(0x2, 0x9a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000200c201810400001020301090288000301018008080b0001010c200609040000000101200009240103000428000408240a05004000020c24030207030503050303001424060305"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) socket$netlink(0x10, 0x3, 0x0) syz_clone3(&(0x7f00000004c0)={0x80000, 0x0, 0x0, 0x0, {0x15}, 0x0, 0x0, 0x0, &(0x7f0000000480)=[0xffffffffffffffff, 0x0, 0x0], 0x3}, 0x58) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) socket(0x2, 0x80805, 0x0) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000080)=@req={0x800000, 0x1, 0x1000, 0x800}, 0x10) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f00000001c0)={r2, 0xd, 0x9, 0x7}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) unshare(0x22020600) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x401}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000a00)='/sys/kernel/profiling', 0x2a41, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0xd232d720960b9930, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000001500)=@newqdisc={0x6c, 0x24, 0xe0b, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x1ff, 0x4, 0x0, 0x0, 0xfffffffd, 0x8}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_LOSS={0x18, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0xffffffff, 0x8000, 0x8, 0x7fffffff}}]}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x810}, 0x0) sendto$packet(r5, &(0x7f0000000080)="0422b9dd9210b75f1359c130211f", 0xe, 0x20000090, &(0x7f00000000c0)={0x11, 0x86dd, r8, 0x1, 0x9, 0x6, @multicast}, 0x14) write$cgroup_subtree(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="2d68756760799aa0b9d51e983b34a94c696d8d79b5b3ea65"], 0x9) 2.863320444s ago: executing program 1 (id=4973): syz_emit_ethernet(0x66, &(0x7f0000000100)={@multicast, @local, @val={@void, {0x8100, 0x4, 0x0, 0x4}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0xfffffffffffffe69, 0x2c, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @mcast2, {[@dstopts={0x29, 0x3, '\x00', [@calipso={0x7, 0x18, {0xf5ff, 0x4, 0x5, 0x2, [0x9, 0x3068]}}]}], @echo_reply={0x81, 0x0, 0x0, 0x0, 0x20, "491a4d9ba9947974008f3f8b30bd47fcfd1a30d5e85447c54b5604b71dd0311e95a940d38c7de1ab10aecc82f957eb2b8f25af91838660a214d2d08ae0663b4ae18c9776e0b5a03416c07c96435e3d740884b411ed020076c4d8f7adf41744c36441221bbe19f6d3f193fe67a08371f55b929e2c97b83944bbe26a660ecc0bae175cac1fb7db1b25ea2ff4f503d2dcc1eede1a77e26a12a25800a6d4faa9e259c4e75f6ada3a7448becdb78fb3792c05c266061f9434ecc943e8daac340ec5fb60686d1feff58539cdea5bbbf0ff63232fb500acc922547a3c6bcfd37f0cbab442d8f97bfa5baace6ba38346a02a2b9eb301770000"}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x64}]}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}}, 0x8040) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r1, &(0x7f0000004300)="00e7a0633e84380001000000000000f32e296a0a01dc194d649b6fa26d6d5e63bac4a04baeeb8aacb22c6eec461b67db6a737737c6d2687acb00572f92e3fdb5d0cb2f11121c557a943020200755bcab77b39c406b733239e2bb1175b9322ba39dc7d67da8f77aed1714dae2e6c24c3ea96be9d151c6ab7b3c54bbe507b8b2461fb4be8dc90042184af6d48f8ace16abb5e3fc943cf61cdb75624a259bdb5f7829b9775820f85f2d1a6ee6c6c2af4fd41ab8a41ecb2612abf13cd2c6f9f3e6db505e4bbe68cc000cf5fa6d5636191a4b366ab59af52132a3f9678d4ed1bd577bacffb3b52850804005eebf3dfa4763168ff30490a11acdbbf4c3312a45f30139f6b72b1e7cdec185006bb30e0e8fa88da2cefc718cae7e9830f7ca101e4e23c6bd16bfacf4a9927fb13af4b79c86ab999beda4ad396abdda354a42fb4ef21d6749175dc21a0cf9191aa4f90d274b50370a580ad8dcd166d2b06c0d8b071973c3fde30f7e2bc371a51ca5866bf8b24eaac75bf482dd4436b214ff62d32e20df223b0b680ede28b3a49e66e330a8a3ecace0db9855d235d5ff23765e742d1a739c2ac8743f4c62664a3b347279da55a1a5b16e1e2828b584a013577d50f890e3894d9e8d6bfccdfb2b70221f12a7fac24b7a8818edce72b65f622c77bf1312771a2c0d805ec9a25c536c91868762032255be78903b77b2c1a773a03996fabba69214e76f5df6df0375b592692a2c3c86c75a3be56fe598ddaea0b9901d20db7e43e128e04e5509283f833c24c625887288459db5727210ba9a301fb8c934dd875e5851098100c3cd42544ed90bb55b58d20a501fabbc485d148c615a3b070fa0520da2ed68ee115a4411d5418b47f3d95616096f67a7a36d68f1e8df82eca8ef96fb4a96b3422fe046a37ea5f5967513a559bd770fecab7228b0692f439765c9e9c6ea4fc608e0b27f9b49064dd2f9ac06f83f6d87ebc61fa3a29bb5ed39641245ce8cf43770df32a84838802b0827ca5a40e2003915e2ed108a005637bb028d29bd2cfd28a1bd55e67ed1b6b7b72163c27c4b0e36d1b134d6dfdb165a66fb46498fc04bb8053b84098af5b18758631d1318d625a6fa4d3ce5a4d3a90e10c6363a26b5ae96c2d56f87ad21a6118af6847d041f88f852ddc3f250c088ef5cb31198f3ac81cff9a5bab26ed56c09f8416188974e08349f7da28fc754b98c1ac4ea0060af1e1b1c49f7dbadbc59254b265dc418cab9ac14e2bbecc4c3103543e37984efb1f61315e10d2b422732217d3a9b0cfe4561f3765d3bda60be239e02bdc164dd631582e8c87dd8fa60d63dcf9e7f3dadc4ce5e4433a42425b8ee8cb8a2defab0bf9b6109c90b5655b79b18c06884f2670a985d454e08e54de69f645cb0cbb70620bd988ee717c310ae77b4abe81c01c6e7f47268ee20bc30b9062830917705682eba2c5ef966b877f33294aa5f8b29d3dd5ed92302087f34fa18d19a005de05f925e3e93c8c0f24507ff20cd23d9ae5452c32ff58c78ccdb1ab32c98edfaa6d2c3971934ca8f849ac360c286566eb72b0793f12cef84bd282368d533247ee750f18aeda484167f3d680e4aaa3aa0694441d4ff6a71531f1a30f87eeb71afd04c5d686e1f86f27586f4e2c8ff77c09612ba1af9b3fb93efd31af42f8e0498f35d07c662b743a08f2839cad8f95b90cbb4fc0ed2ca45dd093a549cde4c6ff08ce09a2cbc6f9f78b6f96643357f92f8f403202742057731fd3e343a87c0affe803cfdbddb8c2694ab63f2dc35da705624747e30a943000fc82c40f10e1975d2e2ec15aefd531b6dbc053606b054dc976f44d5b5a5f37e9c08532ce16cf8bca55ab6c814ceb855ab50b8b52620f8645a9dc25fcb732080d84bf39c3ebb235b4d96da527b64ec4b72f69e91d16a4efcaf76f2e1f968ca68a06f60b01ec7becc9ffd7877c0992cb0f80fb3daabc039513896bd7697843be06aba53e7761e11e075c61ef2d897d4d9f90041c14283746feeb3f0d456ba4be27843350fe43e7c1110b4439489139f6dae01c43f23ec71f08d3042663c65e059d368e4e2c6e49de45bf078d3182a1bc1208bc59379e705aa3309579947409f2a8b3d79099c8619f916e7a6fa333d2312a274247156b8c25cbcfcc59ef13339c700f56a8691dff39bd4338789001872c0d90929037dc0ad99b380a6ba73f331f73f9274f4c2bf5233d7482edf37bf6ffed4f2c0ee44a1d57cae0d644f25591dc03bf837571a82d0c31b61be7ff85a5b3843e8f96a50eaa43f5c137ecfc4e4530d08a2afa4ba02fcc50117a4ad0d5862302017639344c82749f673dbd650e49b35302d0acbab45c0973198291bb42b4cfcd3b0c252074341ea8eca19e122cd234da6d41bf5eedb706e16c17687ed8b84db67130796d26b94eac83bbcd785b603242bd6252c155711efd7dd22cc54e1eaf6d910d0f22c701f3d4da0314dd2829c6ee13bbcbd126558b47b8066bf0766c792a012315bd29bfeda8f28a2c1f4e638b701758e19a0e5bd5b4f19048b00a877d956292e345f8a3a8367892f955bcb5e50ca145ec5e2c9309e25941bd277e393aaad38f9b72a42514b27da6856223c37a1fc1327fa760551d3fdeb0b222ab180b16c9eea138cf4f327e88fdfee293c5b6b007028eb796a60772148282dcd17ffc1c90ed8b6540ede933545ed5a5301d6ff39734444ff3d85cda4ac3befa5083a4685e9e231eba4a91a35f4f7f48fd5ac2446c64c010e2a9f8e80691c95460e1995444466ec5f3cd71fe509a26ff0b7f3254bc8c3255e903834e841b37c70b267fb33deb0d1ed4ea84a869453ba508fc255b12cf847103d5195046c930ae4a75c956f22fcfe4186d547686b54bd7a534940d5d62216994eac0e8ed3bd2bd59354e6b9c6b5b10511d54a8b928040f1e13c4a423b0cf519fc6e9673df5c48c0778c7edb8fa8d8ace77463a77d2d6313160e1ee72742953e433b670400d59c93464fd91520847db238610ed0c289fc55647881a7d6257cf28090c75a6f19df079cfd35742a74a5ab270314f7c8039c20ff0f3f543d029b75a741b5dc6425241ac2ffabf1f96288e6d4ba34da09fb6049c2c8753fbd41fdb4bc68c57bf374ef4feb0df00c41319debb26afba2ff39e1799a1c2137f4e920ee5b02d93789b6b0c853e8143dae5b08ee85da2ea7c31803610ce797293ea95c16ade6dae2afb008e59d8b9505737f008b5227df5f1e4eb5d707f502698a17ead9b1f5ec09dff34248ff2fb153dc6df4812e39754a4baa42e1d8b77fbddef3ca091701ac28ae5fd422dbd8db5b122d3965383abc37a52d2fca5ce56eba974dba3d059cefe40e3c35c9daa8ae31198214303c1dcb90d58fc983ccfd504fa43925636f94b128d44e8aa5cd3ecfabd50a84062d03f7508a0575ab65ecc749d3ef566fdbc529a8139b7a7fb3a9bd784df52cddc6f2699044ba47615163fbbe19f3d88d38a8bf1fe52b2611ca74341429d1cef1a7e350545be29d2caa560e60352cab074c298c44ca2c07f9795ce52f10aa3e2fcdef371f24e309b19e52218881f25a4674527edbe3b3bd0b9b536d810c6f9500c0c81bcfd9a440dd91c1d35c52758d2b2ae1a8497bb394c4f09d3947cf777727b0d1daf5ac4fe4fa3c247a791702cb84b96321b7fec81bf549d4eb5d6dafe019b26187417c68b064e4308908535a3e77b6cd3e28caaf12d726f15590b7958e40134d045a38cbb689131a7e85532f1c63dd4bac9e4d00645cd7b2b71704563f3738b92044a8153f6ba717800ab7cb238175c376d7add2c5ec38e4c856f1ab9c3ee33f6ca6d576ae908dd290e4bae23470182e253765e04e8eb02a791c4396a511ef467879a9e2818b8a4b1b0b39a6c44e816e3ebf6e3be93929dfcb38d5dad7d20b60215447674d0608b8b02331ac20e57083cb9b4449fecbb149441aea0ad82f00a82d87d743fc80d410922bc20923516885440f43c9f32beb81ce148def6140952583a7825c2d2fe012d52d30ef66d32a8a0864ac5c1737e2506228d41ff0515ee80be4cf012927dde0fd2a07cac68eff8c4437f2844d4df07936fd8753e5909f962c5c767f8719cc295bdfa8a16f3f36ff56e34d7b14b6b8c46d5af248b04a9c5396f84990e23d145670950bce5f5638e5e2cea37c371a4483729338f1305cbb32fa1c05dd9d21d2a69e5fa3bbe9a2dad2237be20b4088393c04aa66cf13718de4bffac72f641a8c017a1d5568fa15a6a06e4dc833874ec95af6f115bdadf15179bfc8c4e3e64f26f1299e282c4ab397340934efc1e601afc630fe195e8ae7d8da1310568cab4f2fad085d0ec39710d8b7c812b3fd55c6f50925bcfc90fbcb35b8daa0f1e1f69d82fae2034039f7ad6921694ed48a55a68bc541e6d86f1e33c261a92d48b50eb58a03d8e31b2f6564a4ddc3ee988d0dc47b4b610a9a9dcb87571b5c1edb3362df0ec3d58872157e0f7247dfa8100b4478b705702a5620c9201010f40232327550db333e845dbecd6aadbd0a94c064862b1100b6dd45ece811b8c0275e3753e11b4bcd8bc5ed7668e72afa5bc5cc17b4c313273755f532ecfdefdf2d5c47999453a3b7c158d98332f0bd3a820cfb2c8c3bcd43197e7395a032cec6e41662079f2f654965aebc393e22b5c8516d9b8ad01e33ee481a4ac46a2df304dadeaa9e5274d340aaebe14dcea315fe1279f1a41a5c7aa8c94bf4b3d48757503171f53488e01210145e62c0de7c39737848dbdb1b207d4d33b8de180b020e8a76b1b521905e5e3ce97292f8558fb68efdee774681bfffcf1dc3eef35f660dd1659a32950de2d50e762313beee330d9c2a9fe8ce5e4e61ddd86378d3551335f6ef62053d3b248a8c33a11abdf3f3aa1975a15f4a6957a13d5b12a44d0f2b52b9a2d996e98c630c0f2abca80c7ae89efcf81ae284a0d19582cb1319d207077e5657d245533181ed6e07e0f7647123fc46c37bd75b4f4d181112b4a08acdcf445332cb9dde69a0923dd9244dd2ecd818b19588939922e3b2d8dd9d9fed95fa55b0e4564b38aca2c4d24eebc634664400177fbdeaeb278bb1d8eb11baf4be5c87d4f8d9a855bfa75df4c51fb4eec87a27c59df9a47d82523b08022a1c0fb22ff6f93c3d2cc22a4111a6ec5be428cba33617be65739c2240248f3a02d01ddf2d6aca9e537a2296b16d082d2b868504371dd5e41898885b03ebfaca73b40e8924ece83c1c80de6ce14943e1199c6f81bf359f44c3ed5ae3c6eacb730b1039f0b6555347bd566dfff45a7a2176420ab2b40916a73b66a3ad07af6e1ac5597393d203fa1ad34d4564af956a0a3e2997e27a4e5eff67dd89cce8875d995e00c1858234f149f6ad4cac2b8056966f726df57b8c4ee8f22f23097ba1471b1f1036e3a499400fccdb75b56eb13e9eca1407d5bff4b075b06d00fcbfcafc28431eb33156232e73c6577e3eca437330c494ede57b9609e1f40634918dea767338b5542197410cdc000143ace89ca0b7bf645b3267f74767d7c7fce05d2f59c137204e56bfa711f66903c511f681cf7a1b4f9fc0f42b7c438ff8957e1059375321df5b0c5c884f46d94c21686e1300582d34928bc398653118f79bfeea2e7cfbbf31a7718f4aab50fae57db94203d43e060365c9a7455241be03d82dffc3783d0f6aa170c0866eb0dad07485831526922d8348a7a16e2e9903a2ac93c58c6dce83127fab17703ec004a519ae5675baffb31bf4b52f9ca992a84017a44d68dc693abd829947342f277fdcbc87168bcc03c32b8b1e81a1915af2517c464af07d52b79d1b0e53164c82ba049f81e92ed1dc20a88fd72e9ce7aa4b22a7cc57dc5527d14f62bc29cfc9d57ed26fd523cac39ac00ba12d3a49d694709924275fc0793d56acf9558818dc9eb210749fa5307d45886b879257d627cee0542b51c2ce6ce134100efb47c92456ece5b73cdc051f570810a8d534222649eb56cf73a377162b753de6c282bcd4a25dda21dd10901bd8dfe8fd4ba8a70811c39707beded23dd60f23e2933372e3a6bce099899b07f0a4c4956fd98e956a8649622c77717de099463c0c6c9389ab4a1ae10f8ddd086d876af2943ee0b6b402ae5f89e09922e8c510ec0caa0a83e366e916400bfec88a52ab457037a35ddc6a8e2289c33684a5915c37bf5d227cbc65a737b52bdcb4fbbb7b4e7f965db116b46044d0870846c730dce12e120b1fe6dd5798ced24cad72c59a3f44de4978b8bc05a1dbeb766be6e2abf6ef46c67a58a370e54e92d89e5f44525e82b94a388d8d0cb20c3469a258c1633c9dddb6854aee255f93f59435ff317622f6899250aa185c207644275278580c5d32401741fe264a2e03b80f442ed58fd0704ebac923ac6a5abb7f0c695252f82e3fbcf2b99d721589a8fe3fad4d5926aee3d7bfafb6739e525faae3d25b12841fa2cc61dddc44d36acb9a8b72d60ecdd9c8cf04f9bac341b5e0f9bc59042db8126324888b07afe72b18cce36d61eec975b6b4ef5dc4a16ac14440cf770599bd4db630bd110eb63a03a80cd95c16d314a4de60cc5115bf0754cb7ab84a827ecefafa96069c721a5979f227fdc2467b4cd1975dafb5b28e1d6f3c1c3a2816ad831dd98c1378a03798c128f176426eaa0e361571e758d54bf4ec2c988355f016e16d6cd5cf97bb4891ab33f5623b7e796af313cc7a9e2f9510cd2bead1ea5dd080d9de1f595b2629ebccf69a0feaed3963ae8a6c89edd66fbf6e566379898185828925f8669668d6bddff961b08aaedbbe7fc196931a887ec740da6bcdab8f826a34aa2aa1e406a258558f3baf022a64222df4d6ee8726c79ba3dd6e11a19e4b4bb49b4a8cd99c189e6392f08ad731e415b65d0ccb919dca46efe9f79e21437111ab09e926d3038182044ae047bf1cc92e2d2644c528985719667a1a8abaf65d0f211172ea789b2fa016e1a88325d1ed706239da4dbb9e2079e3598b4ae5885667587ba1e0921c9ba55d7a3be4c47bc2f2f3547ce9efe32e5a22855f761bd4cbe1cd9337eda4bd7d82a918084d7e116b656104ca87e64b1b8c62323c3c296c5b5b98051feb607b872edf9f789744aff710c4b7279711182bcac6b76c05f5cd982f52f451e7e29046550e012e01d8cdd3e305427030f4247488c9136303084c12175c5c781cdd08aede5a356ea0ccdd05a460be3c7b4bfd62c3ce9ab68e285a36c1546d0b18edad71f69f5bedb340772e1bbb035514b085067259e39f59dc292a12557350c66904b253efee29a5eb7a6920f583c899dc46a1d3e2af2db3a3d1a0e8d1f98722a16c6cc1e401058d60c8c436d8f1166ba53bdde5810f9d0288528affd486c266546a864c92af3df8abd451cc1e0d6bfea534865cea9d49b3ea5e390fa823118df8a61e31022f5fbb8ceee870bf2e60890263c4d14e24d053d0fddf665ff80a66fa00a5957f8a30fe82a4b82cf2f6b4d49def98f66bfcdaa0aef13314e950ca9f3849b1edf3b82eaf74a0dbcf45c3dba9bd2d853281a78484f1efaf4150da1207ec3cb61fbcbf759f8182b7052b28d7164b73197b0a440759fe9d5ddf827f1897a174e82fb968a9a07c61bee44bc1f7f9ee5c6de04c02d57735c5fab741b36aec7c8642e56cba932a08b8e8a9d3eb066a4ee7cbf22e5abbd4346de59eca1f24ad9f7f9ff7621e5f30dd08f4cddda8e80e496908109f5212a72bab1378d1237def07bdda4178719975346c68405de15153031fb17535894e5e3c1de6fdd507333f0226b78ba7cae509cfb48d6735ede9392650bf85ac1db919b1e9fe0a823119d8253204dbb2f7a8f524be6d419f3a45c5051a7a88ef0bd41586d90c11a894d647f03895f671a6e19f1c70e32668653aba8366a3d372522f49844081a9637db080663ab02f4a8af502955d5411461b62f85308c91852f8fb9f0bdddd500b4a1337afd3a2f91a82dc4b09f5ad2196a9172ab0cd3fafe7266e9f6d159110d99ca8da8a34b17be17a04ad4509a9fffab1e45e10f10e0cf9cfbd9c761ad044064c07e473fdc626289cfb88b13a11455c069b70aa02426d9119ac878a14c9483be9c0d5bcbb5fa76c8d06531f59c7cf7c26372e750e2f332418ca769e5e7fbeb3ada7bb58b573a0635e2e3ad9a53ddb809ea01086a3fa993ad57e89da6f9c5e61bd0f8ba69212a386b2aa1ae17520d7fb989dbe14021885eb50fa3048aebd42c861a09a308b660d382c0480ead8a52a1e14927c7c77957f94bb59ccfd557f8c4a7af23360a298a603d20ebc386db041d8c306b3e32b0bff541bdec5ff75c3b40950815cf9f89d48a382f67e44c409d046c01fb1262aca0df6f5238a3c3c09977261494f7361ba326815d6e23f49e4d6d4b54665081067332265fff59cf54af9da0db9d19bc611cbcb6e6f3f1e2e1ffb6cdd6253578d78d06a2ff5f9250f1994c5749e3ce49231fbd63bba28e948f9150933e3ae31299babaa41043b181a100882e613b4b4b8f49ceeb742d22f860853a9b917f5a323a8a1fb1f3363a7be4407fba44b408f259b5db79a055b92ce3d7a0649cc59f4afa2b1f69959d5c6f5eef1fa7987a47bee4491f685c52e9db1ee1a231ab5a4bae1019c97868a409dd0d57b32525394a233023c4a7ac429808bbcb57a34b41883202744c3bdebc0a637773273f19c2be6e806bef7fc1002846db762ee4e16867773808c5477987d5851d5b1641d070feabc203cb3d7943ffb206272fcac1bccb616352d85975f5a22c0f247548535ad9fb83fb2be17689453f10691143c060cd964df63c3c70e7b1cfc7e2b468015f327f9869353477bfeeed330b03ddd9e4e0a2441182244da283d7a59d2b2b20e6de3e3a47c26aeef4944c1190bba674523a6c3c4ed6bac53b9edffcb0e9fb19d8bf36949d03ef6a7e59eb903a00d9614f642d1932c766421906f5b177963c71e881453560e3ffcec792e8dc46b1832a8fcb2ab2268a9c1fb648d1c6fa1c8cbd50d5a2d8264fbc6c063e6daac5519d362da389dcd3d12c8039f991de91e728abf5bab95c3aef66dd8cc36c60e73cb10afb02eff6df20ff12c59b142b07fc48fe94612de80b8b958f78256fd7cf3c6f79a83867f3bb5f70da392957badadecefdf7b6e4ebd39ff945397c7d302ca0a5a3918d8abb893cd9cdd680916a50fe19699ff0476ad82e6ba46523f26ccc5eb65313c1df1077c8876d2b73bf86ba311862d12b0c557a92ef827197121512e87f817167d4b17c7e225a48b3f8fbbf4187438e0e9b78e905cdbeb72e80dfb37ec0104f5186b39b4ff34f0cdf4b74dc915acd3f98874cd6a67308d0ad9697121ac477550b1affe004f433705933f9647522be65cb5a7471120ec942aeb956f195be0c1783102cf7d842f2968222ae1a7fa6513f200d3fa85d71724956ed697f0673ee3b40a4d46ba4850439ec125b708ed52b52b9f72906477d520c90a9f5dd49a7a33a328137a183f439895532b78ae451a8c3db789bc862fbc37241d523027e1a008629c969380f6eb55f9cf3f0675bca6851f00df6aaf90de9f62d5c179945ef81d1073850301f97e379ea415d830e3f3751cf83e2dba541cb6cdf3dd418d534ada6469a5b3bca5b7cfbdfdd6df4abaf77d4520d0311e801145c91b52586a56086e663841b702f52cef9fff8cfb7b33dfa125688ba6b4fadd1dca8defaf4259ca85323b23d3bbb45933562c25af3e8d7bc6ad4a50ae974f8d207994b3bd74a6812ab6a40fcaf96bb4e17bd20d742b14c72226caef3e0f5c56c4930071e9f9a894f18650fbb785c6f707605c86b634c9722c8690cf3a954f68d7c2db3a257339ade67a41259f6f878dd0ab7876deffa77f6f00819282a8f4c4da84c6cf4f335cd0410770a2b1a1fbb3f85f4489eeceb78bbfddb2d1866c57b41f6ed179a0bc3750a486403d23473f2feef43ebc5af1018d9c20089e277d77fb9c34f425c8f8af4c49864b57572fa8c232e61ef37194251a1ddc2f73ffecd57e638751cb72bcb2c40d22540166ca1e8588f24b010c9fbd962e3a2c23a7e93f131df61b8703ce326ed80cc87912d3c6aaa27574bbe8d65bcaecd660c31cead132a44b1d0e4a53cacc0b82a263c4e7783944af0af08ea9e68e8e25ed9111cfef841f1b2fd24164f9097f70efe09b1109e5cb91fe68a2760381fd63a7fd422dd578a60661abc9ee565db1c2cde2fb21f2040f1ed3fc27b99e254256949d0560e8b98fa028fca50768caa951a87bf8969af498d50a9ee773c9caa7d9f7d8e1955506013f198cda316d79b177e59f233b98f727afd2494fc18642f0015adab756ea6742690c7d00f28655b915ce4eb8b3ba2e8559ba23e1ff1ccc9f79ae2df85f924459c56715dec78ef4592352eb1a850cd65ecd36e1a9121e888586b7b2fa84da920b8cf44480433e61ab076b10171c0537524bb170a4b99b0b0c437418a665b7ef909652b6483b20362e557c1480c2a2a0efa221fc59054a48122b52d38245f9bd026001635be5b155f5c766a59306fbde231fa72b4d74449a2fe8fb969496ee26af5881adaafb4189b439877ab8f78709cfd32c10ea576a010bfc137b7a4aae137ea3d29070ce3bc8dbe6655e967115ca3461ad9d28b9cf8af07441e68a54ec5e889846f3978f07ba51f7d5af5da78c5c675dc5d0c1a4a399ff4247203573a46fb903eaf7bc886e6cbd3126fa4a3fe3bb13bbdfea7da871f6563aa750f6ad7895b34b2809563dcf5ed30f1c60cef4138aa49d4f55e396534ed10cf4d857723a2b442f47d79de162c30ec6c4daf939b4c88649494e3682d1da81b4a5928d8e18a16c46707a685305e592589acb484e28e9d5af89c44b6e563d125ec97c0155410527406d94b90bc9576a662db99da1cb82b04d610d02187ce08f22ea0e8fd31919d53fa6aaf980e31ca7f8610e695a41919c24136a8406c62d5f15fca365892a2b54ece17664b5247583ad60d863f283f3c288946139575dcaedc978762e85f534e56334ef0221c34ffae054ddf79339b8f08701e9699b11041df8f518dd33203363c8198fbefb01555bcc2542422777b38d8dff11b15aadb0c251ce2c5b32f8735b3cb784f2e5731b48feb5a0e791a1106abdea0f7d1f087737cbe7fdf523fa14c9be2a2987511004c5b7ac1814ef6961db16799698242452c469a07c30e4a1f73193c74a41bdd88aef50035e4648bc9dfa276951798420a45e4085932bdb9381af3cc4678bd962af616549e4020d2c9fd25e2117a6d8934fde2218273d7833d60ea492e251417a27e7fb32012a940a6b6487af4b64958bf05f1b1107732149d227eeda5ca5a43cf583dc297d66072a1acd75e93a7caefd36a0d581e21d5cb08654c4ecef46ebac5391546e0b7d2a6418548d8f816446bcf237f676e873e6bae9107234abe5ab24c53ea472ad10653cef068fd9f4e729fc0d526e489f8df13af5575f1e70e0ec22899728b0659d70fc2dd509d9df3ec170638f89e540f4d3f02aa9b1b1819f84da596e0d7b45a5818061728f8eeccd2bea0f460dd7e18cb95f2364c50e351f0690e184eb63ebbb14a0b4b2117e44f3b2b300", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x130, 0x0, 0x8, {0x4, 0xfffffff7, 0x0, '\x00', {0x1, 0x5, 0xadf, 0xc, r2, r3, 0x8000, '\x00', 0x100000007, 0x8, 0xffffffff, 0x7, {0x100000000008, 0x27}, {0x7, 0x6}, {0x0, 0x7}, {0x1000000003, 0xa00}, 0xb, 0xb, 0x5, 0x9}}}}) setgid(r3) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x9, 0x5, 0x20ffd}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x12, r4, 0x100040000) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000001000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) 2.281555945s ago: executing program 1 (id=4974): sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000300), 0x4) getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x21, &(0x7f0000000080)=0x253, 0x4) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_PIT(r6, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x2, 0xd8, 0x0, 0x0, 0x88, 0x0, 0x0, 0x5, 0xff, 0x1f}, {0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfd, 0xff, 0x4, 0x20, 0x1, 0x1000000}], 0x2}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xe0}, 0x1, 0x0, 0x0, 0x4010}, 0x20000814) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2.079319407s ago: executing program 5 (id=4975): r0 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000003, 0x12, r0, 0x0) syz_clone(0x648e7000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000000)=0x1) 1.223449823s ago: executing program 1 (id=4976): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0c", 0xe) accept4$alg(r1, 0x0, 0x0, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}}, 0x24}}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x20000254}, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xffffdffe, 0x34f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x100, 0x0, 0x1f0, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x200, 0x2, 0x252, 0x0, r2}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) ioctl$BLKRASET(0xffffffffffffffff, 0x1262, &(0x7f0000000040)=0x7f) pwritev(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x3) 1.143167192s ago: executing program 2 (id=4977): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000002c0)={0x4800, 0x3}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003900)={0x24, 0x16, 0xa01, 0x0, 0x0, {0xa}, [@typed={0x4, 0x3ffe}, @typed={0xc, 0xa, 0x0, 0x0, @u64}]}, 0x24}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) close(0xffffffffffffffff) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, 0x0, 0x8080) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r4, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 374.033907ms ago: executing program 5 (id=4978): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xc1b}, 0x28) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmmsg$inet6(r0, &(0x7f0000000800), 0x0, 0x4000840) 305.832558ms ago: executing program 2 (id=4979): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000000)=[@in6={0xa, 0x4e22, 0x5, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, @in6={0xa, 0x4e21, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}], 0x38) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000040)=0xfffffffd, 0x4) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$SNDCTL_DSP_GETOPTR(r2, 0x800c5012, &(0x7f0000000100)) fcntl$setlease(r1, 0x400, 0x0) ioctl$SNDCTL_DSP_GETIPTR(r2, 0x800c5011, &(0x7f0000000140)) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000001c0)=@security={'security\x00', 0xe, 0x4, 0x420, 0xffffffff, 0x160, 0x0, 0x260, 0xffffffff, 0xffffffff, 0x350, 0x350, 0x350, 0xffffffff, 0x4, &(0x7f0000000180), {[{{@ipv6={@mcast2, @mcast2, [0xff, 0xff, 0xffffff00], [0xffffffff, 0xff, 0x0, 0xff000000], 'tunl0\x00', 'vxcan1\x00', {}, {0xff}, 0x3b, 0x8, 0x2, 0x34}, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x62, 0x1, 0x4, 0x1, 0x2, @mcast1, @private0, @local, [0xff, 0xff, 0xffffffff, 0xff], [0xff, 0x0, 0x0, 0xff000000], [0xffffff00, 0xffffff00, 0x1ffffff01], 0x280, 0x623}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x7ff, 0x1, 0x1}}}, {{@uncond, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@srh={{0x30}, {0x15, 0xff, 0x8, 0x9, 0x70, 0x1, 0x880}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x7, 0xfff0, 0x1}}}, {{@ipv6={@mcast2, @mcast2, [0xff000000, 0xff, 0xffffffff, 0xffffffff], [0x0, 0xffffff00, 0xff, 0xffffffff], 'dummy0\x00', 'veth1\x00', {}, {}, 0x84, 0x10, 0x8, 0x49f3e6d411edb58a}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private1, 'veth0_to_bridge\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x480) lsetxattr$trusted_overlay_redirect(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680), &(0x7f00000006c0)='./file0\x00', 0x8, 0x1) ioctl$TUNSETLINK(r2, 0x400454cd, 0x339) getsockname$packet(r2, &(0x7f0000000700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000740)=0x14) setsockopt$MRT_DEL_VIF(0xffffffffffffffff, 0x0, 0xcb, &(0x7f0000000780)={0x0, 0x1, 0x0, 0x5, @vifc_lcl_ifindex=r3, @broadcast}, 0x10) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f00000007c0)='pim6reg\x00') ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r2, 0xc08c5336, &(0x7f0000000800)={0xa7c, 0x9, 0x0, 'queue1\x00', 0x62fb}) sendmsg$nl_xfrm(r2, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)=@newae={0x88, 0x1e, 0x100, 0x70bd28, 0x25dfdbff, {{@in=@multicast1, 0x4d2, 0xa, 0x47}, @in=@multicast2, 0x0, 0x3500}, [@XFRMA_SET_MARK={0x8}, @iptfs_drop_time={0x8, 0x24, 0x3}, @XFRMA_SET_MARK={0x8, 0x1d, 0x8000}, @encap={0x1c, 0x4, {0xffffffffffffffff, 0x4e21, 0x4e22, @in=@dev={0xac, 0x14, 0x14, 0x2b}}}, @coaddr={0x14, 0xe, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x14) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000a40)='team_slave_0\x00') ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000a80)) openat$audio(0xffffffffffffff9c, &(0x7f0000000ac0), 0x80800, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000b00)={0x0, 0x7e, 0x5, [0x9, 0x7, 0x86, 0x5, 0x2]}, &(0x7f0000000b40)=0x12) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000b80)={r4, 0x30, "d9d519b7cb6d219616bc5247c17fb48cafaf7fa5e57c9877c342bc0b105e376e73bc2e0110138c7e4b9c233f6f22fe41"}, &(0x7f0000000bc0)=0x38) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000c00)=@sack_info={r4, 0x3, 0xffffffff}, &(0x7f0000000c40)=0xc) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000c80)={'wlan0\x00'}) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d00)={0x70, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xffffffc0}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x8}, @IPSET_ATTR_CADT_FLAGS={0x8}]}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x80}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x33}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000800}, 0x4805) ioctl$KDSETLED(r2, 0x4b32, 0x0) ioctl$BTRFS_IOC_SPACE_INFO(r2, 0xc0109414, &(0x7f0000000e00)={0xc3a, 0xffffffffffffffff, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) file_setattr(r2, &(0x7f0000013380)='./file0\x00', &(0x7f00000133c0)={0x400, 0x9a96, 0x4, 0x2, 0x2}, 0x18, 0x100) syz_open_dev$dri(&(0x7f0000013400), 0x8000000000000000, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(r2, 0x82307201, &(0x7f0000013440)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 33.884937ms ago: executing program 1 (id=4980): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) sendfile(r1, r0, 0x0, 0x1002000ff) cachestat(r0, 0x0, &(0x7f00000000c0), 0x0) 0s ago: executing program 3 (id=4981): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x63, 0x86, 0x35, 0x10, 0xcf3, 0x1010, 0x3687, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x4, 0x50, 0x0, "", [{{0x9, 0x4, 0x7c, 0xb, 0x0, 0xa4, 0xca, 0xd4}}]}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000140)=@l={0x92, 0x0, 0xe0}) preadv(r1, &(0x7f0000000280)=[{&(0x7f0000000180)=""/232, 0xe8}], 0x1, 0x1000000, 0x1ff) syz_usb_disconnect(r0) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000e00)=ANY=[], 0x0) kernel console output (not intermixed with test programs): fragment MTU (-320) [ 1161.931443][T22872] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1161.934679][T22872] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1161.938230][T22872] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1161.951085][T22872] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1161.953734][T22872] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1162.160568][T22881] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4603'. [ 1162.184588][T22872] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1162.703647][ T4986] Dev loop3: unable to read RDB block 7 [ 1162.709799][ T4986] loop3: unable to read partition table [ 1162.710039][ T4986] loop3: partition table beyond EOD, truncated [ 1162.870218][T22872] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1162.980903][T22872] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1163.135517][T22872] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1163.135573][T22872] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1163.161255][T22872] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1163.165818][T22872] veth1_vlan: left promiscuous mode [ 1163.168781][T22872] veth0_vlan: left promiscuous mode [ 1163.186081][T22872] veth0_vlan: entered promiscuous mode [ 1163.195021][T22872] veth1_vlan: entered promiscuous mode [ 1163.241798][T22872] veth1_macvtap: left promiscuous mode [ 1163.257025][T22872] veth0_macvtap: left promiscuous mode [ 1163.259938][T22872] veth0_macvtap: entered promiscuous mode [ 1163.270909][T22872] veth1_macvtap: entered promiscuous mode [ 1163.281016][T22872] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1163.308961][T22872] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1163.361195][T22872] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1163.365511][T22872] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1163.388015][T22872] batadv_slave_1: entered promiscuous mode [ 1163.388069][T22872] batadv_slave_1: entered allmulticast mode [ 1163.453561][ T7829] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1163.491777][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 1163.491940][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1163.522141][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 1163.522290][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1163.617835][T22727] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1163.626987][T22727] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1163.638802][T22900] tipc: Enabled bearer , priority 0 [ 1163.728208][T22901] syzkaller0: entered promiscuous mode [ 1163.728307][T22901] syzkaller0: entered allmulticast mode [ 1163.785849][T22904] tipc: Resetting bearer [ 1163.946033][T22895] tipc: Resetting bearer [ 1164.079350][T22895] tipc: Disabling bearer [ 1164.114513][ T203] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1164.417870][ T4986] Dev loop3: unable to read RDB block 7 [ 1164.417949][ T4986] loop3: unable to read partition table [ 1164.418194][ T4986] loop3: partition table beyond EOD, truncated [ 1164.463903][T11940] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1164.636196][T11940] usb 3-1: Using ep0 maxpacket: 16 [ 1164.649666][T11940] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1164.671582][T11940] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 1164.671689][T11940] usb 3-1: config 0 has no interface number 0 [ 1164.673361][T11940] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1164.716900][T11940] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1164.723108][T11940] usb 3-1: Product: syz [ 1164.723167][T11940] usb 3-1: SerialNumber: syz [ 1164.755646][T11940] usb 3-1: config 0 descriptor?? [ 1164.770180][T22915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1164.781285][T22915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1164.821080][T11940] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input92 [ 1164.917971][T22915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1164.919447][T22915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1164.980767][T22915] loop5: detected capacity change from 0 to 7 [ 1165.006162][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1165.019833][T22915] Dev loop5: unable to read RDB block 7 [ 1165.019910][T22915] loop5: unable to read partition table [ 1165.020490][T22915] loop5: partition table beyond EOD, truncated [ 1165.020559][T22915] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1165.028216][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1165.029654][T11940] usb 3-1: USB disconnect, device number 2 [ 1165.043810][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1165.043896][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1165.192648][T11940] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1165.723497][ T4986] Dev loop3: unable to read RDB block 7 [ 1165.729239][ T4986] loop3: unable to read partition table [ 1165.735409][ T4986] loop3: partition table beyond EOD, truncated [ 1166.094135][T22928] netlink: 132 bytes leftover after parsing attributes in process `syz.6.4616'. [ 1166.225496][T22927] bond1: option ad_user_port_key: mode dependency failed, not supported in mode balance-tlb(5) [ 1166.240512][T22927] bond1 (unregistering): Released all slaves [ 1166.453599][T22942] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4615'. [ 1166.453648][T22942] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4615'. [ 1167.053934][T22931] sit1: left allmulticast mode [ 1167.054917][T22931] vxlan1: left promiscuous mode [ 1167.055287][T22931] ipip0: left allmulticast mode [ 1167.243660][T22727] net_ratelimit: 60 callbacks suppressed [ 1167.243761][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1167.530915][T22956] x_tables: ip_tables: length.0 match: invalid size 8 (kernel) != (user) 24 [ 1167.634386][T22958] ip_tables: iptables: counters copy to user failed while replacing table [ 1167.649448][T22962] x_tables: ip_tables: length.0 match: invalid size 8 (kernel) != (user) 24 [ 1167.753416][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1168.015463][ T4986] Dev loop3: unable to read RDB block 7 [ 1168.015666][ T4986] loop3: unable to read partition table [ 1168.033035][ T4986] loop3: partition table beyond EOD, truncated [ 1168.265019][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1168.433815][ T4986] Dev loop3: unable to read RDB block 7 [ 1168.433882][ T4986] loop3: unable to read partition table [ 1168.434129][ T4986] loop3: partition table beyond EOD, truncated [ 1168.631863][T22974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1168.652594][T22974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1168.670072][T22975] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1168.671027][T22975] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1168.783189][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1169.293113][ T7829] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1169.477745][ T4986] Dev loop3: unable to read RDB block 7 [ 1169.477828][ T4986] loop3: unable to read partition table [ 1169.478413][ T4986] loop3: partition table beyond EOD, truncated [ 1169.674219][T22991] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4632'. [ 1169.804286][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1170.046700][T22994] bond2: option ad_user_port_key: mode dependency failed, not supported in mode balance-tlb(5) [ 1170.083357][T22994] bond2 (unregistering): Released all slaves [ 1170.173874][T23001] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4634'. [ 1170.173923][T23001] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4634'. [ 1170.314101][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1170.583395][T23004] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1170.645550][ T4986] Dev loop3: unable to read RDB block 7 [ 1170.649853][ T4986] loop3: unable to read partition table [ 1170.650413][ T4986] loop3: partition table beyond EOD, truncated [ 1170.824619][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1170.972049][T23007] bond3: option ad_user_port_key: mode dependency failed, not supported in mode balance-tlb(5) [ 1171.006615][T23007] bond3 (unregistering): Released all slaves [ 1171.244469][T23007] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4636'. [ 1171.244529][T23007] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4636'. [ 1171.333884][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1171.752172][ T4986] Dev loop3: unable to read RDB block 7 [ 1171.752240][ T4986] loop3: unable to read partition table [ 1171.759808][ T4986] loop3: partition table beyond EOD, truncated [ 1171.885173][T23027] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1171.895273][T23027] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1171.928841][T23027] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1172.353847][T22728] net_ratelimit: 1 callbacks suppressed [ 1172.353915][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1172.553134][T11946] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 1172.677542][ T4986] Dev loop3: unable to read RDB block 7 [ 1172.677611][ T4986] loop3: unable to read partition table [ 1172.678207][ T4986] loop3: partition table beyond EOD, truncated [ 1172.703268][T11946] usb 6-1: Using ep0 maxpacket: 16 [ 1172.705600][T11946] usb 6-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1172.707211][T11946] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1172.707264][T11946] usb 6-1: config 0 has no interface number 0 [ 1172.711826][T11946] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1172.711864][T11946] usb 6-1: Product: syz [ 1172.711901][T11946] usb 6-1: Manufacturer: syz [ 1172.711926][T11946] usb 6-1: SerialNumber: syz [ 1172.772248][T11946] usb 6-1: config 0 descriptor?? [ 1172.796751][T11946] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1172.863695][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1173.056165][T23045] bond2: option ad_user_port_key: mode dependency failed, not supported in mode balance-tlb(5) [ 1173.084832][T23045] bond2 (unregistering): Released all slaves [ 1173.312739][T11946] gspca_spca1528: reg_w err -110 [ 1173.324321][T11946] spca1528 6-1:0.1: probe with driver spca1528 failed with error -110 [ 1173.374260][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1173.389937][T23045] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4647'. [ 1173.389963][T23045] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4647'. [ 1173.880692][ T4986] Dev loop3: unable to read RDB block 7 [ 1173.888079][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1173.903682][ T4986] loop3: unable to read partition table [ 1173.903943][ T4986] loop3: partition table beyond EOD, truncated [ 1174.068587][ T4986] Dev loop3: unable to read RDB block 7 [ 1174.068651][ T4986] loop3: unable to read partition table [ 1174.068881][ T4986] loop3: partition table beyond EOD, truncated [ 1174.165563][T23060] autofs4:pid:23060:validate_dev_ioctl: path string terminator missing for cmd(0xc018937e) [ 1174.234256][T11928] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1174.393460][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1174.430417][T11928] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1174.447391][T11928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1174.448616][T11928] usb 3-1: Product: syz [ 1174.454346][T11928] usb 3-1: Manufacturer: syz [ 1174.454400][T11928] usb 3-1: SerialNumber: syz [ 1174.913308][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1174.944268][T11928] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1174.956344][T11928] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1175.423567][ T59] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1175.950765][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1176.440533][T11946] usb 6-1: USB disconnect, device number 95 [ 1176.478128][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1177.093683][ T4986] Dev loop3: unable to read RDB block 7 [ 1177.101544][ T4986] loop3: unable to read partition table [ 1177.108466][ T4986] loop3: partition table beyond EOD, truncated [ 1177.286174][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.286367][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.476390][T11928] net_ratelimit: 1 callbacks suppressed [ 1177.477194][T11928] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000118. ret = -EPROTO [ 1177.477838][T11928] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1177.479675][T11928] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1177.559553][T11928] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 1177.567846][T11946] usb 6-1: new full-speed USB device number 96 using dummy_hcd [ 1177.568515][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1177.640970][T11928] usb 3-1: USB disconnect, device number 3 [ 1177.748019][T11946] usb 6-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 1177.763314][T11946] usb 6-1: config 0 has an invalid interface number: 231 but max is 0 [ 1177.763366][T11946] usb 6-1: config 0 has no interface number 0 [ 1177.763440][T11946] usb 6-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1177.802101][T11946] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1177.802151][T11946] usb 6-1: Product: syz [ 1177.802187][T11946] usb 6-1: Manufacturer: syz [ 1177.802208][T11946] usb 6-1: SerialNumber: syz [ 1177.857812][T11946] usb 6-1: config 0 descriptor?? [ 1177.863996][T23089] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1177.895097][T23091] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1177.896179][T23091] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1177.954220][T11946] plusb 6-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.5-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 12:64:b8:c9:62:d7 [ 1177.954420][T23095] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4657'. [ 1178.102780][ T7829] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1178.455431][T11945] usb 6-1: USB disconnect, device number 96 [ 1178.501088][T11945] plusb 6-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.5-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 1178.628954][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1178.718369][ T4986] Dev loop3: unable to read RDB block 7 [ 1178.725017][ T4986] loop3: unable to read partition table [ 1178.731058][ T4986] loop3: partition table beyond EOD, truncated [ 1178.968259][T23120] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1179.150440][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1179.204623][T11945] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1179.322671][T23119] bond4: option ad_user_port_key: mode dependency failed, not supported in mode balance-tlb(5) [ 1179.336758][T23119] bond4 (unregistering): Released all slaves [ 1179.363980][T11945] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 1179.374639][T11945] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1179.386874][T11945] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1179.403814][T11945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1179.412148][T11945] usb 3-1: Product: syz [ 1179.416508][T11945] usb 3-1: Manufacturer: syz [ 1179.421245][T11945] usb 3-1: SerialNumber: syz [ 1179.501770][T23131] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4659'. [ 1179.501818][T23131] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4659'. [ 1179.696672][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1179.822610][T11945] usb 3-1: USB disconnect, device number 4 [ 1180.012067][ T4986] Dev loop3: unable to read RDB block 7 [ 1180.020856][ T4986] loop3: unable to read partition table [ 1180.028015][ T4986] loop3: partition table beyond EOD, truncated [ 1180.215344][ T7829] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1180.529165][ T4986] Dev loop3: unable to read RDB block 7 [ 1180.531815][ T4986] loop3: unable to read partition table [ 1180.532447][ T4986] loop3: partition table beyond EOD, truncated [ 1180.734715][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1180.942294][ T4986] Dev loop3: unable to read RDB block 7 [ 1180.955874][ T4986] loop3: unable to read partition table [ 1180.962284][ T4986] loop3: partition table beyond EOD, truncated [ 1181.133808][T23154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1181.145470][T23154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1181.177277][T23154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1181.186662][T23154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1181.254022][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1181.914619][T23170] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4671'. [ 1182.039182][ T4986] Dev loop3: unable to read RDB block 7 [ 1182.045061][ T4986] loop3: unable to read partition table [ 1182.051164][ T4986] loop3: partition table beyond EOD, truncated [ 1182.466291][T23185] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4673'. [ 1182.793289][T22728] net_ratelimit: 3 callbacks suppressed [ 1182.793960][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1182.941930][T23197] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4675'. [ 1183.304515][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1183.592435][ T4986] Dev loop3: unable to read RDB block 7 [ 1183.592506][ T4986] loop3: unable to read partition table [ 1183.592741][ T4986] loop3: partition table beyond EOD, truncated [ 1183.646820][ T30] audit: type=1326 audit(1788337231.362:6762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.672649][ T30] audit: type=1326 audit(1788337231.392:6763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.697982][ T30] audit: type=1326 audit(1788337231.422:6764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.722775][ T30] audit: type=1326 audit(1788337231.442:6765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=269 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.748134][ T30] audit: type=1326 audit(1788337231.472:6766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.783427][ T30] audit: type=1326 audit(1788337231.492:6767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.808148][ T30] audit: type=1326 audit(1788337231.502:6768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.808216][ T30] audit: type=1326 audit(1788337231.502:6769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.808265][ T30] audit: type=1326 audit(1788337231.502:6770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.808314][ T30] audit: type=1326 audit(1788337231.502:6771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23209 comm="syz.3.4680" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7efe8c39e159 code=0x7ffc0000 [ 1183.833694][ T5681] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 1183.838173][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1183.845433][T23210] tipc: Enabling of bearer rejected, failed to enable media [ 1183.855756][T23210] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4680'. [ 1183.991826][ T4986] Dev loop3: unable to read RDB block 7 [ 1183.998412][ T4986] loop3: unable to read partition table [ 1183.999096][ T4986] loop3: partition table beyond EOD, truncated [ 1184.033063][ T5681] usb 3-1: Using ep0 maxpacket: 16 [ 1184.039512][ T5681] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1184.051928][ T5681] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1184.060778][ T5681] usb 3-1: config 0 has no interface number 0 [ 1184.070224][ T5681] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1184.078747][ T5681] usb 3-1: Product: syz [ 1184.078770][ T5681] usb 3-1: Manufacturer: syz [ 1184.078788][ T5681] usb 3-1: SerialNumber: syz [ 1184.107220][ T5681] usb 3-1: config 0 descriptor?? [ 1184.116532][ T5681] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1184.155018][T23213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1184.164529][T23213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1184.345315][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1184.633361][ T5681] gspca_spca1528: reg_w err -110 [ 1184.653276][ T5681] spca1528 3-1:0.1: probe with driver spca1528 failed with error -110 [ 1184.853177][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1184.939213][ T4986] Dev loop3: unable to read RDB block 7 [ 1184.939376][ T4986] loop3: unable to read partition table [ 1184.943599][ T4986] loop3: partition table beyond EOD, truncated [ 1185.151396][T23232] PKCS7: Unknown OID: [4] 2.19.16263.96.12508(bad) [ 1185.159400][T23232] PKCS7: Only support pkcs7_signedData type [ 1185.179960][T23218] autofs4:pid:23218:validate_dev_ioctl: path string terminator missing for cmd(0xc018937e) [ 1185.194832][T23233] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4684'. [ 1185.372581][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1185.808637][T23239] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4686'. [ 1185.885907][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1185.993231][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993280][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993310][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993326][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993340][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993355][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993370][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993385][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993399][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993414][T23241] tc action pedit offset must be on 32 bit boundaries [ 1185.993441][T23241] 0: reclassify loop, rule prio 0, protocol 800 [ 1186.420278][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1186.780589][ T4986] Dev loop3: unable to read RDB block 7 [ 1186.780793][ T4986] loop3: unable to read partition table [ 1186.793772][ T4986] loop3: partition table beyond EOD, truncated [ 1186.917822][T23255] FAULT_INJECTION: forcing a failure. [ 1186.917822][T23255] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1186.924694][T23255] CPU: 1 UID: 0 PID: 23255 Comm: syz.3.4691 Tainted: G L syzkaller #0 PREEMPT(full) [ 1186.924791][T23255] Tainted: [L]=SOFTLOCKUP [ 1186.924812][T23255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1186.924845][T23255] Call Trace: [ 1186.924867][T23255] [ 1186.924901][T23255] dump_stack_lvl+0xe8/0x150 [ 1186.925005][T23255] should_fail_ex+0x410/0x560 [ 1186.925135][T23255] _copy_from_iter+0x4ff/0x1660 [ 1186.925275][T23255] ? __pfx__copy_from_iter+0x10/0x10 [ 1186.925379][T23255] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1186.925456][T23255] skb_copy_datagram_from_iter+0xe6/0x720 [ 1186.925536][T23255] ? __lock_acquire+0x6df/0x2e50 [ 1186.925590][T23255] ? get_pid+0x52/0x80 [ 1186.925752][T23255] ? skb_put+0x112/0x210 [ 1186.925804][T23255] unix_stream_sendmsg+0x5ce/0xde0 [ 1186.925921][T23255] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1186.926001][T23255] ? aa_sock_msg_perm+0x129/0x210 [ 1186.926076][T23255] ? apparmor_socket_sendmsg+0x98/0x360 [ 1186.926169][T23255] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1186.926231][T23255] sock_sendmsg_nosec+0x13a/0x180 [ 1186.926323][T23255] ____sys_sendmsg+0x54e/0x850 [ 1186.926412][T23255] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1186.926514][T23255] ? import_iovec+0x73/0xa0 [ 1186.926585][T23255] ___sys_sendmsg+0x2a5/0x360 [ 1186.926646][T23255] ? __lock_acquire+0x6df/0x2e50 [ 1186.926709][T23255] ? __pfx____sys_sendmsg+0x10/0x10 [ 1186.926855][T23255] ? __fget_files+0x2a/0x420 [ 1186.926917][T23255] ? __fget_files+0x3a2/0x420 [ 1186.927012][T23255] __x64_sys_sendmsg+0x1b1/0x290 [ 1186.927091][T23255] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1186.927185][T23255] do_syscall_64+0x166/0x520 [ 1186.927268][T23255] ? trace_irq_disable+0x3b/0x140 [ 1186.927321][T23255] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1186.927382][T23255] ? clear_bhb_loop+0x70/0xc0 [ 1186.927453][T23255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1186.927507][T23255] RIP: 0033:0x7efe8c39e159 [ 1186.927566][T23255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1186.927617][T23255] RSP: 002b:00007efe8a5f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1186.927680][T23255] RAX: ffffffffffffffda RBX: 00007efe8c626090 RCX: 00007efe8c39e159 [ 1186.927722][T23255] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000003 [ 1186.927762][T23255] RBP: 00007efe8a5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1186.927796][T23255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1186.927842][T23255] R13: 00007efe8c626128 R14: 00007efe8c626090 R15: 00007efe8c74fa48 [ 1186.927933][T23255] [ 1186.973239][ T59] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1187.394948][ T4986] Dev loop3: unable to read RDB block 7 [ 1187.395243][ T4986] loop3: unable to read partition table [ 1187.395818][ T4986] loop3: partition table beyond EOD, truncated [ 1187.518502][T23261] netdevsim netdevsim1: Firmware load for '..' refused, path contains '..' component [ 1187.571012][T11928] usb 3-1: USB disconnect, device number 5 [ 1187.755181][T10079] IPVS: starting estimator thread 0... [ 1187.853589][T23270] IPVS: using max 39 ests per chain, 93600 per kthread [ 1187.983520][T10079] net_ratelimit: 1 callbacks suppressed [ 1187.983977][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1188.504103][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1188.560393][ T4986] Dev loop3: unable to read RDB block 7 [ 1188.560458][ T4986] loop3: unable to read partition table [ 1188.560687][ T4986] loop3: partition table beyond EOD, truncated [ 1188.709639][T23275] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4696'. [ 1188.829292][T23277] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1188.854409][T23277] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1188.916376][T23277] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1188.971465][T23277] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1188.997760][T11928] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1189.029727][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1189.164102][T11928] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1189.210048][T11928] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1189.213042][T11928] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1189.213200][T11928] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1189.257711][T23276] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1189.302141][T11928] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1189.387274][T11940] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 1189.553205][T22728] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1189.567765][T11940] usb 6-1: Using ep0 maxpacket: 16 [ 1189.597586][T11940] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1189.618289][ T4986] Dev loop3: unable to read RDB block 7 [ 1189.623133][ T4986] loop3: unable to read partition table [ 1189.623763][ T4986] loop3: partition table beyond EOD, truncated [ 1189.679828][T11940] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1189.679992][T11940] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1189.748954][T11928] usb 3-1: USB disconnect, device number 6 [ 1189.763890][T23288] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4698'. [ 1189.788780][T11940] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1189.790705][T11940] usb 6-1: Product: syz [ 1189.791171][T11940] usb 6-1: Manufacturer: syz [ 1189.791222][T11940] usb 6-1: SerialNumber: syz [ 1189.843511][T11940] usb 6-1: config 0 descriptor?? [ 1189.896757][T11940] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1189.896891][T11940] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1190.074726][ T59] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1190.110089][T23295] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1190.487362][T11940] em28xx 6-1:0.0: chip ID is em2884 [ 1190.583126][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1190.681441][T23301] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4701'. [ 1190.707271][T11940] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1190.719621][T11940] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 1190.719753][T11940] em28xx 6-1:0.0: No AC97 audio processor [ 1190.757236][T11940] usb 6-1: USB disconnect, device number 97 [ 1190.784926][T11940] em28xx 6-1:0.0: Disconnecting em28xx [ 1190.852795][T11940] em28xx: Freeing device [ 1191.094664][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1191.388475][T23319] xt_hl: Unknown Hop Limit match mode: 206 [ 1191.406227][T23316] FAULT_INJECTION: forcing a failure. [ 1191.406227][T23316] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1191.406374][T23316] CPU: 1 UID: 0 PID: 23316 Comm: syz.6.4704 Tainted: G L syzkaller #0 PREEMPT(full) [ 1191.406407][T23316] Tainted: [L]=SOFTLOCKUP [ 1191.406416][T23316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1191.406431][T23316] Call Trace: [ 1191.406441][T23316] [ 1191.406451][T23316] dump_stack_lvl+0xe8/0x150 [ 1191.406490][T23316] should_fail_ex+0x410/0x560 [ 1191.406532][T23316] _copy_from_iter+0x3b0/0x1660 [ 1191.406580][T23316] ? __pfx__copy_from_iter+0x10/0x10 [ 1191.406622][T23316] ? __pfx__copy_from_iter+0x10/0x10 [ 1191.406665][T23316] copy_page_from_iter+0x219/0x2d0 [ 1191.406705][T23316] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1191.406747][T23316] unix_stream_sendmsg+0x5ce/0xde0 [ 1191.406793][T23316] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1191.406825][T23316] ? aa_sock_msg_perm+0x129/0x210 [ 1191.406855][T23316] ? apparmor_socket_sendmsg+0x98/0x360 [ 1191.406892][T23316] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1191.406919][T23316] sock_sendmsg_nosec+0x13a/0x180 [ 1191.406953][T23316] ____sys_sendmsg+0x54e/0x850 [ 1191.406984][T23316] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1191.407027][T23316] ? import_iovec+0x73/0xa0 [ 1191.407055][T23316] ___sys_sendmsg+0x2a5/0x360 [ 1191.407079][T23316] ? __lock_acquire+0x6df/0x2e50 [ 1191.407107][T23316] ? __pfx____sys_sendmsg+0x10/0x10 [ 1191.407168][T23316] ? __fget_files+0x2a/0x420 [ 1191.407198][T23316] ? __fget_files+0x3a2/0x420 [ 1191.407238][T23316] __x64_sys_sendmsg+0x1b1/0x290 [ 1191.407267][T23316] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1191.407314][T23316] do_syscall_64+0x166/0x520 [ 1191.407348][T23316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1191.407372][T23316] ? clear_bhb_loop+0x70/0xc0 [ 1191.407401][T23316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1191.407424][T23316] RIP: 0033:0x7f0ee5b9e159 [ 1191.407446][T23316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1191.407466][T23316] RSP: 002b:00007f0ee699d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1191.407492][T23316] RAX: ffffffffffffffda RBX: 00007f0ee5e25fa0 RCX: 00007f0ee5b9e159 [ 1191.407510][T23316] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000003 [ 1191.407524][T23316] RBP: 00007f0ee699d090 R08: 0000000000000000 R09: 0000000000000000 [ 1191.407539][T23316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1191.407552][T23316] R13: 00007f0ee5e26038 R14: 00007f0ee5e25fa0 R15: 00007f0ee5f4fa48 [ 1191.407587][T23316] [ 1191.620424][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1191.703278][T11945] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 1191.854387][T11945] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1191.869356][T11945] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1191.869425][T11945] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1191.869482][T11945] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1191.907721][T23319] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1191.929892][T11945] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1192.123642][T22727] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1192.165600][T11945] usb 3-1: USB disconnect, device number 7 [ 1192.644589][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1193.173333][T21145] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1193.495311][ T4986] Dev loop3: unable to read RDB block 7 [ 1193.496771][ T4986] loop3: unable to read partition table [ 1193.497038][ T4986] loop3: partition table beyond EOD, truncated [ 1193.565043][T23348] loop5: detected capacity change from 0 to 7 [ 1193.572567][T23348] Dev loop5: unable to read RDB block 7 [ 1193.572614][T23348] loop5: AHDI p1 p2 [ 1193.572641][T23348] loop5: partition table partially beyond EOD, truncated [ 1193.572835][T23348] loop5: p1 size 150995456 extends beyond EOD, truncated [ 1193.666802][ T4986] Dev loop3: unable to read RDB block 7 [ 1193.666868][ T4986] loop3: unable to read partition table [ 1193.667105][ T4986] loop3: partition table beyond EOD, truncated [ 1193.711168][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1193.862399][ T5630] udevd[5630]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1194.103145][T11945] usb 6-1: new low-speed USB device number 98 using dummy_hcd [ 1194.122087][ T4986] Dev loop3: unable to read RDB block 7 [ 1194.122146][ T4986] loop3: unable to read partition table [ 1194.128111][ T4986] loop3: partition table beyond EOD, truncated [ 1194.243606][T11945] usb 6-1: device descriptor read/64, error -71 [ 1194.246915][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1194.483037][T11945] usb 6-1: new low-speed USB device number 99 using dummy_hcd [ 1194.613030][T11945] usb 6-1: device descriptor read/64, error -71 [ 1194.723580][T11945] usb usb6-port1: attempt power cycle [ 1194.761977][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1195.076390][T11945] usb 6-1: new low-speed USB device number 100 using dummy_hcd [ 1195.106280][T11945] usb 6-1: device descriptor read/8, error -71 [ 1195.161969][ T4986] Dev loop3: unable to read RDB block 7 [ 1195.167867][ T4986] loop3: unable to read partition table [ 1195.168098][ T4986] loop3: partition table beyond EOD, truncated [ 1195.289016][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1195.310902][T23367] FAULT_INJECTION: forcing a failure. [ 1195.310902][T23367] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1195.310971][T23367] CPU: 1 UID: 0 PID: 23367 Comm: syz.3.4718 Tainted: G L syzkaller #0 PREEMPT(full) [ 1195.311002][T23367] Tainted: [L]=SOFTLOCKUP [ 1195.311030][T23367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1195.311077][T23367] Call Trace: [ 1195.311099][T23367] [ 1195.311135][T23367] dump_stack_lvl+0xe8/0x150 [ 1195.311248][T23367] should_fail_ex+0x410/0x560 [ 1195.311351][T23367] _copy_from_iter+0x3b0/0x1660 [ 1195.311462][T23367] ? __pfx__copy_from_iter+0x10/0x10 [ 1195.311563][T23367] ? __pfx__copy_from_iter+0x10/0x10 [ 1195.311665][T23367] copy_page_from_iter+0x219/0x2d0 [ 1195.311766][T23367] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1195.311869][T23367] unix_stream_sendmsg+0x5ce/0xde0 [ 1195.311986][T23367] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1195.312066][T23367] ? aa_sock_msg_perm+0x129/0x210 [ 1195.312132][T23367] ? apparmor_socket_sendmsg+0x98/0x360 [ 1195.312209][T23367] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1195.312278][T23367] sock_sendmsg_nosec+0x13a/0x180 [ 1195.312360][T23367] ____sys_sendmsg+0x54e/0x850 [ 1195.312433][T23367] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1195.312515][T23367] ? import_iovec+0x73/0xa0 [ 1195.312584][T23367] ___sys_sendmsg+0x2a5/0x360 [ 1195.312638][T23367] ? __lock_acquire+0x6df/0x2e50 [ 1195.312721][T23367] ? __pfx____sys_sendmsg+0x10/0x10 [ 1195.312871][T23367] ? __fget_files+0x2a/0x420 [ 1195.312941][T23367] ? __fget_files+0x3a2/0x420 [ 1195.313040][T23367] __x64_sys_sendmsg+0x1b1/0x290 [ 1195.313105][T23367] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1195.313215][T23367] do_syscall_64+0x166/0x520 [ 1195.313305][T23367] ? trace_irq_disable+0x3b/0x140 [ 1195.313357][T23367] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1195.313416][T23367] ? clear_bhb_loop+0x70/0xc0 [ 1195.313486][T23367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1195.313539][T23367] RIP: 0033:0x7efe8c39e159 [ 1195.313589][T23367] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1195.313638][T23367] RSP: 002b:00007efe8d17e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1195.313697][T23367] RAX: ffffffffffffffda RBX: 00007efe8c625fa0 RCX: 00007efe8c39e159 [ 1195.313742][T23367] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000003 [ 1195.313781][T23367] RBP: 00007efe8d17e090 R08: 0000000000000000 R09: 0000000000000000 [ 1195.313819][T23367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1195.313863][T23367] R13: 00007efe8c626038 R14: 00007efe8c625fa0 R15: 00007efe8c74fa48 [ 1195.313955][T23367] [ 1195.403405][T11945] usb 6-1: new low-speed USB device number 101 using dummy_hcd [ 1195.462755][T11945] usb 6-1: device descriptor read/8, error -71 [ 1195.576641][T11945] usb usb6-port1: unable to enumerate USB device [ 1195.618034][ T4986] Dev loop3: unable to read RDB block 7 [ 1195.618095][ T4986] loop3: unable to read partition table [ 1195.618335][ T4986] loop3: partition table beyond EOD, truncated [ 1195.803303][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1196.325676][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1196.602733][ T4986] Dev loop3: unable to read RDB block 7 [ 1196.608795][ T4986] loop3: unable to read partition table [ 1196.609037][ T4986] loop3: partition table beyond EOD, truncated [ 1196.661843][T23381] loop5: detected capacity change from 0 to 7 [ 1196.669063][T23381] Dev loop5: unable to read RDB block 7 [ 1196.675170][T23381] loop5: AHDI p1 p2 [ 1196.679261][T23381] loop5: partition table partially beyond EOD, truncated [ 1196.686755][T23381] loop5: p1 size 150995456 extends beyond EOD, truncated [ 1196.748987][ T4986] Dev loop3: unable to read RDB block 7 [ 1196.757869][ T4986] loop3: unable to read partition table [ 1196.760002][ T4986] loop3: partition table beyond EOD, truncated [ 1196.857558][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1196.888219][T23385] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1196.998416][T23387] binder_alloc: 23386: binder_alloc_buf, no vma [ 1197.114616][T23390] fuse: Unknown parameter 'Cs%5 [ 1197.114616][T23390] [ 1197.114616][T23390] |Gp$Qm: ' [ 1197.377837][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1197.731537][ T4986] Dev loop3: unable to read RDB block 7 [ 1197.733166][ T4986] loop3: unable to read partition table [ 1197.733767][ T4986] loop3: partition table beyond EOD, truncated [ 1197.772797][T23405] FAULT_INJECTION: forcing a failure. [ 1197.772797][T23405] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1197.786445][T23405] CPU: 0 UID: 0 PID: 23405 Comm: syz.3.4730 Tainted: G L syzkaller #0 PREEMPT(full) [ 1197.786481][T23405] Tainted: [L]=SOFTLOCKUP [ 1197.786490][T23405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1197.786504][T23405] Call Trace: [ 1197.786512][T23405] [ 1197.786522][T23405] dump_stack_lvl+0xe8/0x150 [ 1197.786559][T23405] should_fail_ex+0x410/0x560 [ 1197.786599][T23405] _copy_from_iter+0x3b0/0x1660 [ 1197.786642][T23405] ? __pfx__copy_from_iter+0x10/0x10 [ 1197.786679][T23405] ? __pfx__copy_from_iter+0x10/0x10 [ 1197.786720][T23405] copy_page_from_iter+0x219/0x2d0 [ 1197.786758][T23405] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1197.786795][T23405] unix_stream_sendmsg+0x5ce/0xde0 [ 1197.786840][T23405] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1197.786868][T23405] ? aa_sock_msg_perm+0x129/0x210 [ 1197.786895][T23405] ? apparmor_socket_sendmsg+0x98/0x360 [ 1197.786929][T23405] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1197.786953][T23405] sock_sendmsg_nosec+0x13a/0x180 [ 1197.786985][T23405] ____sys_sendmsg+0x54e/0x850 [ 1197.787015][T23405] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1197.787056][T23405] ? import_iovec+0x73/0xa0 [ 1197.787080][T23405] ___sys_sendmsg+0x2a5/0x360 [ 1197.787098][T23405] ? __lock_acquire+0x6df/0x2e50 [ 1197.787138][T23405] ? __pfx____sys_sendmsg+0x10/0x10 [ 1197.787184][T23405] ? __fget_files+0x2a/0x420 [ 1197.787208][T23405] ? __fget_files+0x3a2/0x420 [ 1197.787238][T23405] __x64_sys_sendmsg+0x1b1/0x290 [ 1197.787260][T23405] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1197.787296][T23405] do_syscall_64+0x166/0x520 [ 1197.787324][T23405] ? trace_irq_disable+0x3b/0x140 [ 1197.787341][T23405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1197.787360][T23405] ? clear_bhb_loop+0x70/0xc0 [ 1197.787382][T23405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1197.787400][T23405] RIP: 0033:0x7efe8c39e159 [ 1197.787417][T23405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1197.787434][T23405] RSP: 002b:00007efe8d17e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1197.787453][T23405] RAX: ffffffffffffffda RBX: 00007efe8c625fa0 RCX: 00007efe8c39e159 [ 1197.787470][T23405] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000003 [ 1197.787482][T23405] RBP: 00007efe8d17e090 R08: 0000000000000000 R09: 0000000000000000 [ 1197.787493][T23405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1197.787505][T23405] R13: 00007efe8c626038 R14: 00007efe8c625fa0 R15: 00007efe8c74fa48 [ 1197.787532][T23405] [ 1198.087996][ T4986] Dev loop3: unable to read RDB block 7 [ 1198.093775][ T4986] loop3: unable to read partition table [ 1198.093995][ T4986] loop3: partition table beyond EOD, truncated [ 1198.315685][T23408] sctp: [Deprecated]: syz.3.4731 (pid 23408) Use of int in maxseg socket option. [ 1198.315685][T23408] Use struct sctp_assoc_value instead [ 1198.413150][T23333] net_ratelimit: 1 callbacks suppressed [ 1198.413212][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1198.461012][T23395] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4726'. [ 1198.707275][T23419] loop5: detected capacity change from 0 to 7 [ 1198.715497][T23419] Dev loop5: unable to read RDB block 7 [ 1198.721349][T23419] loop5: AHDI p1 p2 [ 1198.721377][T23419] loop5: partition table partially beyond EOD, truncated [ 1198.721578][T23419] loop5: p1 size 150995456 extends beyond EOD, truncated [ 1198.943554][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1198.996482][T23424] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4735'. [ 1199.046352][ T5630] udevd[5630]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1199.138952][T23423] SET target dimension over the limit! [ 1199.146583][T23423] netlink: 'syz.5.4735': attribute type 1 has an invalid length. [ 1199.195097][T23423] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1199.236753][T23423] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4735'. [ 1199.246083][T23423] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4735'. [ 1199.292820][ T4986] Dev loop3: unable to read RDB block 7 [ 1199.293485][ T4986] loop3: unable to read partition table [ 1199.294002][ T4986] loop3: partition table beyond EOD, truncated [ 1199.463140][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1199.475205][T23433] loop8: detected capacity change from 0 to 16384 [ 1199.539360][T23439] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4739'. [ 1199.550502][T23439] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4739'. [ 1199.778721][T23450] fuse: Bad value for 'group_id' [ 1199.784387][T23450] fuse: Bad value for 'group_id' [ 1199.835201][T23436] loop8: detected capacity change from 16384 to 16383 [ 1199.928815][T23451] FAULT_INJECTION: forcing a failure. [ 1199.928815][T23451] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1199.952217][T23451] CPU: 0 UID: 0 PID: 23451 Comm: syz.5.4741 Tainted: G L syzkaller #0 PREEMPT(full) [ 1199.952255][T23451] Tainted: [L]=SOFTLOCKUP [ 1199.952264][T23451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1199.952279][T23451] Call Trace: [ 1199.952288][T23451] [ 1199.952298][T23451] dump_stack_lvl+0xe8/0x150 [ 1199.952337][T23451] should_fail_ex+0x410/0x560 [ 1199.952378][T23451] _copy_from_iter+0x3b0/0x1660 [ 1199.952426][T23451] ? __pfx__copy_from_iter+0x10/0x10 [ 1199.952466][T23451] ? __pfx__copy_from_iter+0x10/0x10 [ 1199.952509][T23451] copy_page_from_iter+0x219/0x2d0 [ 1199.952548][T23451] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1199.952589][T23451] unix_stream_sendmsg+0x5ce/0xde0 [ 1199.952635][T23451] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1199.952665][T23451] ? aa_sock_msg_perm+0x129/0x210 [ 1199.952694][T23451] ? apparmor_socket_sendmsg+0x98/0x360 [ 1199.952735][T23451] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1199.952760][T23451] sock_sendmsg_nosec+0x13a/0x180 [ 1199.952793][T23451] ____sys_sendmsg+0x54e/0x850 [ 1199.952824][T23451] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1199.952865][T23451] ? import_iovec+0x73/0xa0 [ 1199.952893][T23451] ___sys_sendmsg+0x2a5/0x360 [ 1199.952916][T23451] ? __lock_acquire+0x6df/0x2e50 [ 1199.952942][T23451] ? __pfx____sys_sendmsg+0x10/0x10 [ 1199.953003][T23451] ? __fget_files+0x2a/0x420 [ 1199.953030][T23451] ? __fget_files+0x3a2/0x420 [ 1199.953070][T23451] __x64_sys_sendmsg+0x1b1/0x290 [ 1199.953099][T23451] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1199.953146][T23451] do_syscall_64+0x166/0x520 [ 1199.953180][T23451] ? trace_irq_disable+0x3b/0x140 [ 1199.953202][T23451] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1199.953225][T23451] ? clear_bhb_loop+0x70/0xc0 [ 1199.953254][T23451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1199.953278][T23451] RIP: 0033:0x7fd7a3f9e159 [ 1199.953299][T23451] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1199.953319][T23451] RSP: 002b:00007fd7a4dc3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1199.953345][T23451] RAX: ffffffffffffffda RBX: 00007fd7a4225fa0 RCX: 00007fd7a3f9e159 [ 1199.953363][T23451] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000003 [ 1199.953378][T23451] RBP: 00007fd7a4dc3090 R08: 0000000000000000 R09: 0000000000000000 [ 1199.953393][T23451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1199.953407][T23451] R13: 00007fd7a4226038 R14: 00007fd7a4225fa0 R15: 00007fd7a434fa48 [ 1199.953442][T23451] [ 1200.022809][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1200.104573][ T4986] Dev loop3: unable to read RDB block 7 [ 1200.104694][ T4986] loop3: unable to read partition table [ 1200.105267][ T4986] loop3: partition table beyond EOD, truncated [ 1200.136955][ T5681] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 1200.273245][T23459] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4743'. [ 1200.323995][ T5681] usb 3-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 1200.334596][ T5681] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1200.348201][ T5681] usb 3-1: config 0 descriptor?? [ 1200.397880][ T5681] pwc: Philips SPC 900NC USB webcam detected. [ 1200.408978][T23462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1200.419859][T23462] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1200.523225][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1200.838664][T23466] loop5: detected capacity change from 0 to 7 [ 1200.846558][T23466] Dev loop5: unable to read RDB block 7 [ 1200.846605][T23466] loop5: AHDI p1 p2 [ 1200.856611][T23466] loop5: partition table partially beyond EOD, truncated [ 1200.856810][T23466] loop5: p1 size 150995456 extends beyond EOD, truncated [ 1200.938954][ T5630] udevd[5630]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1201.033543][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1201.321257][ T4986] Dev loop3: unable to read RDB block 7 [ 1201.321321][ T4986] loop3: unable to read partition table [ 1201.324800][ T4986] loop3: partition table beyond EOD, truncated [ 1201.507763][T23473] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4747'. [ 1201.573204][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1202.069652][ T4986] Dev loop3: unable to read RDB block 7 [ 1202.069718][ T4986] loop3: unable to read partition table [ 1202.070596][ T4986] loop3: partition table beyond EOD, truncated [ 1202.101047][T10079] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1202.160920][T23482] sg_write: data in/out 1309908170/1 bytes for SCSI command 0xc1-- guessing data in; [ 1202.160920][T23482] program syz.5.4749 not setting count and/or reply_len properly [ 1202.420474][ T5681] pwc: Failed to set LED on/off time (-71) [ 1202.421178][ T5681] pwc: send_video_command error -71 [ 1202.421219][ T5681] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1202.421500][ T5681] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 1202.444806][ T5681] usb 3-1: USB disconnect, device number 8 [ 1202.538367][ T4986] Dev loop3: unable to read RDB block 7 [ 1202.538427][ T4986] loop3: unable to read partition table [ 1202.538998][ T4986] loop3: partition table beyond EOD, truncated [ 1202.624811][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1202.658750][T23488] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1202.737764][T23489] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 1202.897391][T23499] netlink: del zone limit has 4 unknown bytes [ 1203.469993][T23509] fuse: Unknown parameter 'I46*m~ׅ\>֔{.M)Eco D%' [ 1203.653095][T21144] net_ratelimit: 1 callbacks suppressed [ 1203.653175][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1204.005300][T23516] FAULT_INJECTION: forcing a failure. [ 1204.005300][T23516] name failslab, interval 1, probability 0, space 0, times 0 [ 1204.005367][T23516] CPU: 0 UID: 0 PID: 23516 Comm: syz.1.4756 Tainted: G L syzkaller #0 PREEMPT(full) [ 1204.005399][T23516] Tainted: [L]=SOFTLOCKUP [ 1204.005419][T23516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1204.005433][T23516] Call Trace: [ 1204.005467][T23516] [ 1204.005498][T23516] dump_stack_lvl+0xe8/0x150 [ 1204.005606][T23516] should_fail_ex+0x410/0x560 [ 1204.005756][T23516] should_failslab+0xa8/0x100 [ 1204.005840][T23516] __kmalloc_cache_noprof+0xa3/0x600 [ 1204.005939][T23516] ? alloc_fs_context+0x66/0xd00 [ 1204.006064][T23516] ? alloc_fs_context+0x66/0xd00 [ 1204.006149][T23516] ? __get_fs_type+0x21/0x280 [ 1204.006235][T23516] alloc_fs_context+0x66/0xd00 [ 1204.006318][T23516] ? __get_fs_type+0x267/0x280 [ 1204.006393][T23516] ? __get_fs_type+0x21/0x280 [ 1204.006505][T23516] do_new_mount+0x17f/0xdc0 [ 1204.006589][T23516] ? __pfx_do_new_mount+0x10/0x10 [ 1204.006663][T23516] ? ns_capable+0x89/0xe0 [ 1204.006738][T23516] ? path_mount+0x647/0x1050 [ 1204.006812][T23516] ? user_path_at+0xd4/0x160 [ 1204.006906][T23516] __se_sys_mount+0x31d/0x420 [ 1204.007006][T23516] ? __pfx___se_sys_mount+0x10/0x10 [ 1204.007132][T23516] ? __x64_sys_mount+0x20/0xc0 [ 1204.007204][T23516] do_syscall_64+0x166/0x520 [ 1204.007290][T23516] ? trace_irq_disable+0x3b/0x140 [ 1204.007351][T23516] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1204.007418][T23516] ? clear_bhb_loop+0x70/0xc0 [ 1204.007492][T23516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1204.007575][T23516] RIP: 0033:0x7fb6a679e159 [ 1204.007629][T23516] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1204.007681][T23516] RSP: 002b:00007fb6a76f9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1204.007748][T23516] RAX: ffffffffffffffda RBX: 00007fb6a6a26090 RCX: 00007fb6a679e159 [ 1204.007784][T23516] RDX: 0000200000002100 RSI: 0000200000000480 RDI: 0000000000000000 [ 1204.007819][T23516] RBP: 00007fb6a76f9090 R08: 0000200000002140 R09: 0000000000000000 [ 1204.007861][T23516] R10: 0000000000810005 R11: 0000000000000246 R12: 0000000000000002 [ 1204.007901][T23516] R13: 00007fb6a6a26128 R14: 00007fb6a6a26090 R15: 00007fb6a6b4fa48 [ 1204.007990][T23516] [ 1204.183244][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1204.684218][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1204.919286][T23530] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4760'. [ 1205.195507][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1205.470603][ T4986] Dev loop3: unable to read RDB block 7 [ 1205.470674][ T4986] loop3: unable to read partition table [ 1205.471507][ T4986] loop3: partition table beyond EOD, truncated [ 1205.727201][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1205.802004][T23534] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4762'. [ 1206.183214][ T5681] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 1206.233333][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1206.335314][ T5681] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1206.348521][ T5681] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1206.348590][ T5681] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 1206.372006][ T5704] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 1206.382774][ T5681] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1206.382821][ T5681] usb 3-1: SerialNumber: syz [ 1206.437488][ T5681] cdc_ether 3-1:1.0: missing cdc ether descriptor [ 1206.515500][ T4986] Dev loop3: unable to read RDB block 7 [ 1206.515571][ T4986] loop3: unable to read partition table [ 1206.516160][ T4986] loop3: partition table beyond EOD, truncated [ 1206.536807][ T5704] usb 6-1: device descriptor read/64, error -71 [ 1206.689121][T11940] usb 3-1: USB disconnect, device number 9 [ 1206.772843][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1206.826755][ T5704] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 1206.983367][ T5704] usb 6-1: device descriptor read/64, error -71 [ 1207.095651][ T5704] usb usb6-port1: attempt power cycle [ 1207.266774][T23568] geneve3: entered promiscuous mode [ 1207.284635][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1207.304298][T21144] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1207.304377][T21144] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1207.304501][T21144] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1207.304626][T21144] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1207.433249][ T5704] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1207.500851][ T4986] Dev loop3: unable to read RDB block 7 [ 1207.508446][ T4986] loop3: unable to read partition table [ 1207.514334][ T4986] loop3: partition table beyond EOD, truncated [ 1207.793333][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1207.823266][T11928] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 1207.900796][ T5704] usb 6-1: device descriptor read/8, error -71 [ 1208.008736][T11928] usb 3-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 1208.018953][T11928] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1208.019091][T11928] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1208.147020][T23583] FAULT_INJECTION: forcing a failure. [ 1208.147020][T23583] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1208.147077][T23583] CPU: 0 UID: 0 PID: 23583 Comm: syz.5.4774 Tainted: G L syzkaller #0 PREEMPT(full) [ 1208.147111][T23583] Tainted: [L]=SOFTLOCKUP [ 1208.147120][T23583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1208.147136][T23583] Call Trace: [ 1208.147145][T23583] [ 1208.147156][T23583] dump_stack_lvl+0xe8/0x150 [ 1208.147195][T23583] should_fail_ex+0x410/0x560 [ 1208.147236][T23583] _copy_from_iter+0x3b0/0x1660 [ 1208.147321][T23583] ? __pfx__copy_from_iter+0x10/0x10 [ 1208.147456][T23583] ? __pfx__copy_from_iter+0x10/0x10 [ 1208.147568][T23583] copy_page_from_iter+0x219/0x2d0 [ 1208.147671][T23583] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1208.147767][T23583] unix_stream_sendmsg+0x5ce/0xde0 [ 1208.147896][T23583] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1208.147980][T23583] ? aa_sock_msg_perm+0x129/0x210 [ 1208.148055][T23583] ? apparmor_socket_sendmsg+0x98/0x360 [ 1208.148155][T23583] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 1208.148219][T23583] sock_sendmsg_nosec+0x13a/0x180 [ 1208.148303][T23583] ____sys_sendmsg+0x54e/0x850 [ 1208.148378][T23583] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1208.148463][T23583] ? import_iovec+0x73/0xa0 [ 1208.148534][T23583] ___sys_sendmsg+0x2a5/0x360 [ 1208.148590][T23583] ? __lock_acquire+0x6df/0x2e50 [ 1208.148670][T23583] ? __pfx____sys_sendmsg+0x10/0x10 [ 1208.148829][T23583] ? __fget_files+0x2a/0x420 [ 1208.148924][T23583] ? __fget_files+0x3a2/0x420 [ 1208.149018][T23583] __x64_sys_sendmsg+0x1b1/0x290 [ 1208.149089][T23583] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1208.149192][T23583] do_syscall_64+0x166/0x520 [ 1208.149280][T23583] ? trace_irq_disable+0x3b/0x140 [ 1208.149333][T23583] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1208.149396][T23583] ? clear_bhb_loop+0x70/0xc0 [ 1208.149469][T23583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1208.149530][T23583] RIP: 0033:0x7fd7a3f9e159 [ 1208.149582][T23583] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1208.149628][T23583] RSP: 002b:00007fd7a4dc3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1208.149691][T23583] RAX: ffffffffffffffda RBX: 00007fd7a4225fa0 RCX: 00007fd7a3f9e159 [ 1208.149740][T23583] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000003 [ 1208.149773][T23583] RBP: 00007fd7a4dc3090 R08: 0000000000000000 R09: 0000000000000000 [ 1208.149813][T23583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1208.149845][T23583] R13: 00007fd7a4226038 R14: 00007fd7a4225fa0 R15: 00007fd7a434fa48 [ 1208.149929][T23583] [ 1208.305352][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1208.580000][T11928] wacom 0003:056A:033B.003E: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 1208.594785][T11928] wacom 0003:056A:033B.003E: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.2-1/input0 [ 1208.631508][T11928] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/0003:056A:033B.003E/input/input93 [ 1208.681729][T23591] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4776'. [ 1208.814961][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1208.853995][ T4986] Dev loop3: unable to read RDB block 7 [ 1208.854069][ T4986] loop3: unable to read partition table [ 1208.854663][ T4986] loop3: partition table beyond EOD, truncated [ 1208.997651][ T5681] usb 3-1: USB disconnect, device number 10 [ 1209.048896][T23594] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4777'. [ 1209.248880][ T4986] Dev loop3: unable to read RDB block 7 [ 1209.248953][ T4986] loop3: unable to read partition table [ 1209.249538][ T4986] loop3: partition table beyond EOD, truncated [ 1209.323272][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1209.353250][T23599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1209.367278][T23599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1209.401548][T23602] netlink: 'syz.5.4779': attribute type 2 has an invalid length. [ 1209.797549][ T5681] psmouse serio4: Failed to reset mouse on : -5 [ 1209.855961][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1209.877634][T23601] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1210.364360][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1210.411220][T23612] netlink: 4748 bytes leftover after parsing attributes in process `syz.2.4781'. [ 1210.625750][T23621] netlink: 'syz.6.4782': attribute type 13 has an invalid length. [ 1210.878204][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1211.145174][T23624] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4783'. [ 1211.278094][T23630] netlink: 'syz.2.4785': attribute type 1 has an invalid length. [ 1211.384009][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1211.894299][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1212.063275][T23648] fuse: Invalid gid '0x0000000000000003' [ 1212.069152][T23648] fuse: Unknown parameter 'f]Q" V./ʐt4G{t뭹P#JE\ x2E@NȌ|G}Gb>02^Osrk\' [ 1212.405492][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1212.543059][T11945] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1212.671845][T23653] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4792'. [ 1212.694509][T11945] usb 6-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 1212.706246][T11945] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1212.706520][T11945] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1212.913910][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1213.187581][T11945] wacom 0003:056A:033B.003F: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 1213.244443][T11945] wacom 0003:056A:033B.003F: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.5-1/input0 [ 1213.291231][T11945] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/0003:056A:033B.003F/input/input98 [ 1213.333604][ T5681] misc userio: Buffer overflowed, userio client isn't keeping up [ 1213.426288][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1213.553794][T23658] fuse: Invalid uid '00000000000000000003' [ 1213.655532][T11945] usb 6-1: USB disconnect, device number 106 [ 1213.934473][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1214.214865][T23666] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4796'. [ 1214.291976][T23668] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4797'. [ 1214.446076][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1214.614349][ T5681] input: PS/2 Generic Mouse as /devices/serio4/input/input96 [ 1214.873734][ T5681] psmouse serio4: Failed to enable mouse on [ 1214.954683][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1215.218718][ T4986] Dev loop3: unable to read RDB block 7 [ 1215.218785][ T4986] loop3: unable to read partition table [ 1215.219028][ T4986] loop3: partition table beyond EOD, truncated [ 1215.362785][T23677] bridge0: port 1(bridge_slave_1) entered blocking state [ 1215.364933][T23677] bridge0: port 1(bridge_slave_1) entered disabled state [ 1215.365406][T23677] bridge_slave_1: entered allmulticast mode [ 1215.374303][T23677] bridge_slave_1: entered promiscuous mode [ 1215.392315][T23677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1215.399840][T23678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1215.400313][T23678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1215.406441][T23677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1215.449010][T23677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1215.449996][T23677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1215.464036][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1215.573290][ T5681] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1215.703034][ T5681] usb 6-1: device descriptor read/64, error -71 [ 1215.943043][ T5681] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1215.973401][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1216.017769][ T4986] Dev loop3: unable to read RDB block 7 [ 1216.017841][ T4986] loop3: unable to read partition table [ 1216.018675][ T4986] loop3: partition table beyond EOD, truncated [ 1216.084664][ T5681] usb 6-1: device descriptor read/64, error -71 [ 1216.175517][T23684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1216.188862][T23684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1216.194364][ T5681] usb usb6-port1: attempt power cycle [ 1216.207875][T23684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1216.219433][T23684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1216.238214][T23684] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4801'. [ 1216.251615][T23684] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4801'. [ 1216.263240][T23684] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1216.483367][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1216.533215][ T5681] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1216.553744][ T5681] usb 6-1: device descriptor read/8, error -71 [ 1216.793317][ T5681] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1216.813721][ T5681] usb 6-1: device descriptor read/8, error -71 [ 1216.924039][ T5681] usb usb6-port1: unable to enumerate USB device [ 1216.993120][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1217.073395][T23692] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1217.083732][T23692] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1217.148371][ T4986] Dev loop3: unable to read RDB block 7 [ 1217.148441][ T4986] loop3: unable to read partition table [ 1217.148904][ T4986] loop3: partition table beyond EOD, truncated [ 1217.334869][ T4986] Dev loop3: unable to read RDB block 7 [ 1217.334939][ T4986] loop3: unable to read partition table [ 1217.335413][ T4986] loop3: partition table beyond EOD, truncated [ 1217.503365][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1217.634724][ T4986] Dev loop3: unable to read RDB block 7 [ 1217.641634][ T4986] loop3: unable to read partition table [ 1217.650262][ T4986] loop3: partition table beyond EOD, truncated [ 1217.743213][T23706] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4808'. [ 1217.976504][ T4986] Dev loop3: unable to read RDB block 7 [ 1217.983170][ T4986] loop3: unable to read partition table [ 1217.989123][ T4986] loop3: partition table beyond EOD, truncated [ 1218.013182][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1218.029737][ T5704] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 1218.215027][ T5704] usb 3-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 1218.232368][ T5704] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1218.245571][ T5704] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1218.362201][ T4986] Dev loop3: unable to read RDB block 7 [ 1218.362359][ T4986] loop3: unable to read partition table [ 1218.363416][ T4986] loop3: partition table beyond EOD, truncated [ 1218.506920][T23733] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1218.527561][T23733] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1218.557211][T23736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1218.561267][T23736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1218.709787][ T5704] wacom 0003:056A:033B.0040: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 1218.749134][ T5704] wacom 0003:056A:033B.0040: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.2-1/input0 [ 1218.766174][ T5704] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/0003:056A:033B.0040/input/input101 [ 1219.036804][T23333] net_ratelimit: 1 callbacks suppressed [ 1219.036870][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1219.141267][ T5681] usb 3-1: USB disconnect, device number 11 [ 1219.553838][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1219.703651][T23749] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4817'. [ 1220.064146][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1220.481909][T23764] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4821'. [ 1220.573707][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1221.095102][T23333] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1221.563274][ T4986] Dev loop3: unable to read RDB block 7 [ 1221.563342][ T4986] loop3: unable to read partition table [ 1221.563928][ T4986] loop3: partition table beyond EOD, truncated [ 1221.624710][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1221.819173][T23787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1221.829314][T23787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1222.134141][T21144] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1222.250110][T23790] sctp: [Deprecated]: syz.6.4829 (pid 23790) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1222.250110][T23790] Use struct sctp_sack_info instead [ 1222.452584][ T4986] Dev loop3: unable to read RDB block 7 [ 1222.458386][ T4986] loop3: unable to read partition table [ 1222.467379][ T4986] loop3: partition table beyond EOD, truncated [ 1222.562690][T23797] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4833'. [ 1222.614619][ T4986] Dev loop3: unable to read RDB block 7 [ 1222.620338][ T4986] loop3: unable to read partition table [ 1222.626544][ T4986] loop3: partition table beyond EOD, truncated [ 1222.653199][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1222.830095][T23800] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4831'. [ 1223.175732][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1223.389426][ T4986] Dev loop3: unable to read RDB block 7 [ 1223.389487][ T4986] loop3: unable to read partition table [ 1223.389724][ T4986] loop3: partition table beyond EOD, truncated [ 1223.679414][T23811] nvme_tcp: malformed address passed: 127.0.0.1:44.0 [ 1223.691435][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1223.923197][ T30] kauditd_printk_skb: 56 callbacks suppressed [ 1223.929800][ T30] audit: type=1326 audit(1788337271.642:6828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23822 comm="syz.2.4840" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f114619e159 code=0x0 [ 1224.213591][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1224.447860][ T4986] Dev loop3: unable to read RDB block 7 [ 1224.453995][ T4986] loop3: unable to read partition table [ 1224.462245][ T4986] loop3: partition table beyond EOD, truncated [ 1224.724796][ T203] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1224.854842][ T4986] Dev loop3: unable to read RDB block 7 [ 1224.860590][ T4986] loop3: unable to read partition table [ 1224.864853][ T4986] loop3: partition table beyond EOD, truncated [ 1225.143975][T23836] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1225.158620][T23836] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1225.169355][T23840] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4845'. [ 1225.253363][T23343] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1225.678520][T23855] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4848'. [ 1225.763824][T23338] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1225.983694][T23864] batman_adv: batadv0: Interface deactivated: dummy0 [ 1225.983762][T23864] batman_adv: batadv0: Removing interface: dummy0 [ 1226.124210][T23864] bridge_slave_0: left allmulticast mode [ 1226.124263][T23864] bridge_slave_0: left promiscuous mode [ 1226.144363][T23864] bridge0: port 1(bridge_slave_0) entered disabled state [ 1226.200079][T23864] bridge_slave_1: left allmulticast mode [ 1226.200132][T23864] bridge_slave_1: left promiscuous mode [ 1226.205048][T23864] bridge0: port 2(bridge_slave_1) entered disabled state [ 1226.277877][T23864] bond0: (slave bond_slave_0): Releasing backup interface [ 1226.321939][T23864] bond0: (slave bond_slave_1): Releasing backup interface [ 1226.429121][T23864] team0: Port device team_slave_0 removed [ 1226.501216][T23864] team0: Port device team_slave_1 removed [ 1226.514442][T23864] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1226.514494][T23864] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1226.556556][T23864] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1226.569302][T23864] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1226.604848][T23864] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1227.656389][T23878] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4854'. [ 1228.092355][ T4986] Dev loop3: unable to read RDB block 7 [ 1228.099538][ T4986] loop3: unable to read partition table [ 1228.108255][ T4986] loop3: partition table beyond EOD, truncated [ 1228.405983][T23884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1228.406512][T23884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1228.586580][T23888] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.586814][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.586959][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.587112][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.587245][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.587578][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.587886][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.588174][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.615653][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.615811][T23887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1228.648515][T23884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1228.668464][T23884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1228.750645][T11945] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 1228.776884][T23892] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4859'. [ 1228.916567][T11945] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1228.940510][T11945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1228.940571][T11945] usb 3-1: Product: syz [ 1228.940616][T11945] usb 3-1: Manufacturer: syz [ 1228.940640][T11945] usb 3-1: SerialNumber: syz [ 1229.045003][ T5681] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1229.108806][T23896] lo: Caught tx_queue_len zero misconfig [ 1229.332569][T11945] usb 3-1: USB disconnect, device number 12 [ 1229.403443][ T4986] Dev loop3: unable to read RDB block 7 [ 1229.403677][ T4986] loop3: unable to read partition table [ 1229.404432][ T4986] loop3: partition table beyond EOD, truncated [ 1229.468061][ T5704] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 1229.489781][T23902] FAULT_INJECTION: forcing a failure. [ 1229.489781][T23902] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1229.489849][T23902] CPU: 0 UID: 0 PID: 23902 Comm: syz.3.4863 Tainted: G L syzkaller #0 PREEMPT(full) [ 1229.489882][T23902] Tainted: [L]=SOFTLOCKUP [ 1229.489891][T23902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1229.489905][T23902] Call Trace: [ 1229.489914][T23902] [ 1229.489924][T23902] dump_stack_lvl+0xe8/0x150 [ 1229.489965][T23902] should_fail_ex+0x410/0x560 [ 1229.490094][T23902] _copy_from_user+0x2d/0xb0 [ 1229.490175][T23902] ___sys_sendmsg+0x1c6/0x360 [ 1229.490246][T23902] ? __lock_acquire+0x6df/0x2e50 [ 1229.490326][T23902] ? __pfx____sys_sendmsg+0x10/0x10 [ 1229.490471][T23902] ? __fget_files+0x2a/0x420 [ 1229.490542][T23902] ? __fget_files+0x3a2/0x420 [ 1229.490643][T23902] __x64_sys_sendmsg+0x1b1/0x290 [ 1229.490711][T23902] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1229.490833][T23902] do_syscall_64+0x166/0x520 [ 1229.490919][T23902] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.490981][T23902] ? clear_bhb_loop+0x70/0xc0 [ 1229.491053][T23902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.491114][T23902] RIP: 0033:0x7efe8c39e159 [ 1229.491175][T23902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1229.491226][T23902] RSP: 002b:00007efe8d17e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1229.491288][T23902] RAX: ffffffffffffffda RBX: 00007efe8c625fa0 RCX: 00007efe8c39e159 [ 1229.491330][T23902] RDX: 0000000000000004 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1229.491370][T23902] RBP: 00007efe8d17e090 R08: 0000000000000000 R09: 0000000000000000 [ 1229.491402][T23902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1229.491441][T23902] R13: 00007efe8c626038 R14: 00007efe8c625fa0 R15: 00007efe8c74fa48 [ 1229.491543][T23902] [ 1229.711860][ T5704] usb 6-1: Using ep0 maxpacket: 32 [ 1229.739657][ T5704] usb 6-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2 [ 1229.739735][ T5704] usb 6-1: too many configurations: 17, using maximum allowed: 8 [ 1229.799785][ T5704] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1229.799853][ T5704] usb 6-1: config 0 has no interface number 0 [ 1229.800046][ T5704] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 51456, setting to 1024 [ 1229.800115][ T5704] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1229.832064][ T5704] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1229.832153][ T5704] usb 6-1: config 0 has no interface number 0 [ 1229.832289][ T5704] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 51456, setting to 1024 [ 1229.832352][ T5704] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1229.857626][ T5704] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1229.857663][ T5704] usb 6-1: config 0 has no interface number 0 [ 1229.857746][ T5704] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 51456, setting to 1024 [ 1229.857780][ T5704] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1229.880780][ T5704] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1229.880844][ T5704] usb 6-1: config 0 has no interface number 0 [ 1229.880893][ T5704] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 51456, setting to 1024 [ 1229.880942][ T5704] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1229.922140][ T5704] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1229.922215][ T5704] usb 6-1: config 0 has no interface number 0 [ 1229.922341][ T5704] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 51456, setting to 1024 [ 1229.922403][ T5704] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1229.994081][ T5704] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1229.994110][ T5704] usb 6-1: config 0 has no interface number 0 [ 1229.994157][ T5704] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 51456, setting to 1024 [ 1229.994188][ T5704] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1230.049557][ T5704] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1230.049588][ T5704] usb 6-1: config 0 has no interface number 0 [ 1230.049634][ T5704] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 51456, setting to 1024 [ 1230.049674][ T5704] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1230.118048][ T5704] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1230.118099][ T5704] usb 6-1: config 0 has no interface number 0 [ 1230.118163][ T5704] usb 6-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 51456, setting to 1024 [ 1230.118199][ T5704] usb 6-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1230.163248][ T5681] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1230.163495][ T5681] ath9k_htc: Failed to initialize the device [ 1230.172647][T11945] usb 3-1: ath9k_htc: USB layer deinitialized [ 1230.198976][ T5704] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1230.200489][ T4986] Dev loop3: unable to read RDB block 7 [ 1230.200592][ T4986] loop3: unable to read partition table [ 1230.201159][ T4986] loop3: partition table beyond EOD, truncated [ 1230.208383][ T5704] usb 6-1: Product: syz [ 1230.208456][ T5704] usb 6-1: Manufacturer: syz [ 1230.208508][ T5704] usb 6-1: SerialNumber: syz [ 1230.292853][ T5704] usb 6-1: config 0 descriptor?? [ 1230.303499][T23894] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1230.321112][ T5704] etas_es58x 6-1:0.2: Starting syz syz (Serial Number syz) [ 1230.361162][T23912] loop5: detected capacity change from 0 to 7 [ 1230.367984][T23912] buffer_io_error: 45 callbacks suppressed [ 1230.376199][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.384164][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.394137][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.402103][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.507154][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.510598][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.520335][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.520362][T23912] ldm_validate_partition_table(): Disk read failed. [ 1230.520413][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.528054][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.567923][T23911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1230.568502][T23912] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.586935][T23912] Dev loop5: unable to read RDB block 0 [ 1230.594325][T23912] loop5: unable to read partition table [ 1230.603078][T23911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1230.616554][T23912] loop5: partition table beyond EOD, truncated [ 1230.626633][T23912] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 1230.637583][T23894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1230.687012][T23894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1231.236999][ T30] audit: type=1326 audit(1788337278.952:6829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23920 comm="syz.1.4867" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb6a679e159 code=0x0 [ 1231.776643][T11928] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 1231.958047][ T5704] etas_es58x 6-1:0.2: could not retrieve the product info string [ 1231.975648][T11928] usb 3-1: Using ep0 maxpacket: 32 [ 1231.992123][T11928] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1232.043000][T11928] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 1232.043047][T11928] usb 3-1: config 0 has no interface number 0 [ 1232.070185][T11928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1232.070319][T11928] usb 3-1: Product: syz [ 1232.070410][T11928] usb 3-1: Manufacturer: syz [ 1232.070479][T11928] usb 3-1: SerialNumber: syz [ 1232.121896][T11928] usb 3-1: config 0 descriptor?? [ 1232.153552][T11928] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1232.267225][ T5704] usb 6-1: USB disconnect, device number 111 [ 1232.295479][ T5704] etas_es58x 6-1:0.2: Disconnecting syz syz [ 1232.396134][T11928] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB2 [ 1232.432340][T11928] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB3 [ 1232.545885][T23934] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4870'. [ 1232.701297][T23936] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4871'. [ 1233.025731][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1233.036245][T11928] usb 3-1: USB disconnect, device number 13 [ 1233.117224][T11928] quatech-serial ttyUSB2: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB2 [ 1233.144829][T11928] quatech-serial ttyUSB3: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB3 [ 1233.158568][T11928] quatech2 3-1:0.51: device disconnected [ 1233.520683][ T4986] Dev loop3: unable to read RDB block 7 [ 1233.521282][ T4986] loop3: unable to read partition table [ 1233.524487][ T4986] loop3: partition table beyond EOD, truncated [ 1233.871164][T23948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1233.871602][T23948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1234.020099][ T30] audit: type=1326 audit(1788337281.732:6830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f114619e159 code=0x7ffc0000 [ 1234.020186][ T30] audit: type=1326 audit(1788337281.732:6831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f114619e159 code=0x7ffc0000 [ 1234.158835][ T30] audit: type=1326 audit(1788337281.872:6832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f114619e159 code=0x0 [ 1234.168669][ T30] audit: type=1326 audit(1788337281.882:6833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f114619e159 code=0x7ffc0000 [ 1234.203815][ T30] audit: type=1326 audit(1788337281.912:6834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f114619e159 code=0x7ffc0000 [ 1234.203984][ T30] audit: type=1326 audit(1788337281.912:6835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f114619e159 code=0x7ffc0000 [ 1234.204097][ T30] audit: type=1326 audit(1788337281.912:6836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f114619e159 code=0x7ffc0000 [ 1234.224973][ T30] audit: type=1326 audit(1788337281.912:6837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f114619e159 code=0x7ffc0000 [ 1234.225124][ T30] audit: type=1326 audit(1788337281.932:6838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23950 comm="syz.2.4875" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f114619e159 code=0x7ffc0000 [ 1235.933127][ T5681] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1236.083355][ T5681] usb 6-1: Using ep0 maxpacket: 16 [ 1236.085147][ T5681] usb 6-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 1236.096107][ T5681] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1236.096221][ T5681] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1236.124691][ T5681] usb 6-1: config 0 descriptor?? [ 1236.403109][T23977] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4882'. [ 1236.533020][T23979] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4883'. [ 1236.564704][T23979] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1236.608731][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.608795][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.609534][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.609613][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.609690][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.609759][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.609823][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.611759][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.611884][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.611956][ T5681] samsung 0003:0419:0600.0041: unknown main item tag 0x0 [ 1236.634430][ T5681] samsung 0003:0419:0600.0041: hidraw0: USB HID v0.81 Device [HID 0419:0600] on usb-dummy_hcd.5-1/input0 [ 1236.812613][T11945] usb 6-1: USB disconnect, device number 112 [ 1236.867306][T23986] fido_id[23986]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 1236.906755][ T4986] Dev loop3: unable to read RDB block 7 [ 1236.906830][ T4986] loop3: unable to read partition table [ 1236.907412][ T4986] loop3: partition table beyond EOD, truncated [ 1236.993770][ T5681] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 1237.143098][ T5681] usb 3-1: Using ep0 maxpacket: 16 [ 1237.149746][ T5681] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1237.158466][ T5681] usb 3-1: New USB device found, idVendor=0e8d, idProduct=7102, bcdDevice=93.12 [ 1237.161947][ T5681] usb 3-1: config 7 has an invalid interface number: 201 but max is 0 [ 1237.162022][ T5681] usb 3-1: config 7 has no interface number 0 [ 1237.176107][ T5681] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1237.176186][ T5681] usb 3-1: Product: syz [ 1237.176227][ T5681] usb 3-1: Manufacturer: syz [ 1237.176267][ T5681] usb 3-1: SerialNumber: syz [ 1237.420465][ T5681] option 3-1:7.201: GSM modem (1-port) converter detected [ 1237.455111][ T5681] usb 3-1: USB disconnect, device number 14 [ 1237.463820][ T5681] option 3-1:7.201: device disconnected [ 1237.662403][T23997] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4886'. [ 1238.069307][T23999] gretap0: refused to change device tx_queue_len [ 1238.069593][T23999] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1238.265985][ T4986] Dev loop3: unable to read RDB block 7 [ 1238.266051][ T4986] loop3: unable to read partition table [ 1238.266618][ T4986] loop3: partition table beyond EOD, truncated [ 1238.728222][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.728417][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 1238.904966][T24015] kAFS: unable to lookup cell '' [ 1239.058748][T24022] usb usb7: usbfs: process 24022 (syz.1.4891) did not claim interface 0 before use [ 1239.059749][T24022] usb usb7: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1239.194310][ T4986] Dev loop3: unable to read RDB block 7 [ 1239.194384][ T4986] loop3: unable to read partition table [ 1239.195025][ T4986] loop3: partition table beyond EOD, truncated [ 1239.344031][T24024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1239.345099][T24024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1239.429469][T24026] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4893'. [ 1239.773419][T24028] netlink: 'syz.2.4894': attribute type 10 has an invalid length. [ 1240.080327][ T4986] Dev loop3: unable to read RDB block 7 [ 1240.080386][ T4986] loop3: unable to read partition table [ 1240.080865][ T4986] loop3: partition table beyond EOD, truncated [ 1240.313064][ T5681] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 1240.324147][T24035] FAULT_INJECTION: forcing a failure. [ 1240.324147][T24035] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1240.324214][T24035] CPU: 0 UID: 0 PID: 24035 Comm: syz.5.4897 Tainted: G L syzkaller #0 PREEMPT(full) [ 1240.324292][T24035] Tainted: [L]=SOFTLOCKUP [ 1240.324323][T24035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1240.324355][T24035] Call Trace: [ 1240.324384][T24035] [ 1240.324408][T24035] dump_stack_lvl+0xe8/0x150 [ 1240.324525][T24035] should_fail_ex+0x410/0x560 [ 1240.324620][T24035] _copy_to_user+0x31/0xb0 [ 1240.324692][T24035] simple_read_from_buffer+0xe1/0x170 [ 1240.324752][T24035] proc_fail_nth_read+0x1bb/0x230 [ 1240.324835][T24035] ? common_file_perm+0x20e/0x2b0 [ 1240.324907][T24035] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1240.325001][T24035] ? rw_verify_area+0x24a/0x4c0 [ 1240.325093][T24035] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1240.325176][T24035] vfs_read+0x213/0xa80 [ 1240.325279][T24035] ? __pfx___mutex_lock+0x10/0x10 [ 1240.325364][T24035] ? __pfx_vfs_read+0x10/0x10 [ 1240.325458][T24035] ? __fget_files+0x2a/0x420 [ 1240.325549][T24035] ? __fget_files+0x3a2/0x420 [ 1240.325615][T24035] ? __fget_files+0x2a/0x420 [ 1240.325715][T24035] ksys_read+0x150/0x270 [ 1240.325760][T24035] ? __pfx_ksys_read+0x10/0x10 [ 1240.325893][T24035] do_syscall_64+0x166/0x520 [ 1240.325975][T24035] ? trace_irq_disable+0x3b/0x140 [ 1240.326039][T24035] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1240.326091][T24035] ? clear_bhb_loop+0x70/0xc0 [ 1240.326157][T24035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1240.326220][T24035] RIP: 0033:0x7fd7a3f5e98e [ 1240.326279][T24035] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1240.326330][T24035] RSP: 002b:00007fd7a4da1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1240.326385][T24035] RAX: ffffffffffffffda RBX: 00007fd7a4da26c0 RCX: 00007fd7a3f5e98e [ 1240.326433][T24035] RDX: 000000000000000f RSI: 00007fd7a4da20a0 RDI: 0000000000000006 [ 1240.326467][T24035] RBP: 00007fd7a4da2090 R08: 0000000000000000 R09: 0000000000000000 [ 1240.326507][T24035] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1240.326541][T24035] R13: 00007fd7a4226128 R14: 00007fd7a4226090 R15: 00007fd7a434fa48 [ 1240.326633][T24035] [ 1240.443077][ T5681] usb 3-1: device descriptor read/64, error -71 [ 1240.705016][ T5681] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1240.722184][T24037] netlink: 'syz.3.4896': attribute type 13 has an invalid length. [ 1240.834103][ T5681] usb 3-1: device descriptor read/64, error -71 [ 1240.943396][ T5681] usb usb3-port1: attempt power cycle [ 1241.064255][ T5704] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1241.249093][ T5704] usb 6-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 1241.266869][ T5704] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1241.283402][ T5681] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 1241.301105][ T5704] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1241.314694][ T5681] usb 3-1: device descriptor read/8, error -71 [ 1241.321788][ T5704] usb 6-1: Product: syz [ 1241.321810][ T5704] usb 6-1: Manufacturer: syz [ 1241.321827][ T5704] usb 6-1: SerialNumber: syz [ 1241.392076][ T5704] usb-storage 6-1:1.0: USB Mass Storage device detected [ 1241.415707][ T5704] usb-storage 6-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 1241.424803][ T5704] scsi host1: usb-storage 6-1:1.0 [ 1241.482427][T24046] fuse: Unknown parameter '00000000000000000005' [ 1241.509124][T24046] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4899'. [ 1241.553988][ T5681] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 1241.578786][ T5681] usb 3-1: device descriptor read/8, error -71 [ 1241.685824][ T5681] usb usb3-port1: unable to enumerate USB device [ 1241.891907][T24041] bond2: option updelay: invalid value (18446744073256566793) [ 1241.891958][T24041] bond2: option updelay: allowed values 0 - 2147483647 [ 1241.911880][T24041] bond2 (unregistering): Released all slaves [ 1243.195811][T24061] fuse: Unknown parameter 'f`' [ 1243.445854][ T4986] Dev loop3: unable to read RDB block 7 [ 1243.445927][ T4986] loop3: unable to read partition table [ 1243.446170][ T4986] loop3: partition table beyond EOD, truncated [ 1243.593153][T24067] netlink: 'syz.3.4904': attribute type 11 has an invalid length. [ 1243.854088][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.854310][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.856036][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.856109][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.856188][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.856248][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.856301][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.856401][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.856474][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1243.856537][T24078] futex_wake_op: syz.2.4906 tries to shift op by 32; fix this program [ 1244.086089][ T5681] usb 6-1: USB disconnect, device number 113 [ 1244.680363][T24091] fuse: Unknown parameter '000000000000000000000060x0000000000000006' [ 1244.751454][ T4986] Dev loop3: unable to read RDB block 7 [ 1244.751523][ T4986] loop3: unable to read partition table [ 1244.761433][ T4986] loop3: partition table beyond EOD, truncated [ 1244.952213][T24095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1244.959368][T24095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1244.972665][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 1244.972730][ T30] audit: type=1326 audit(1788337292.682:6865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24093 comm="syz.3.4911" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efe8c39e159 code=0x0 [ 1245.134211][ T5681] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 1245.284889][ T5681] usb 3-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 1245.290537][ T5681] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1245.290836][ T5681] usb 3-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 1245.307279][ T5681] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1245.307350][ T5681] usb 3-1: Product: syz [ 1245.307386][ T5681] usb 3-1: Manufacturer: syz [ 1245.307426][ T5681] usb 3-1: SerialNumber: syz [ 1245.391794][T24102] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4911'. [ 1245.409802][T24102] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4911'. [ 1245.514210][T11946] usb 6-1: new high-speed USB device number 114 using dummy_hcd [ 1245.663092][T11946] usb 6-1: Using ep0 maxpacket: 32 [ 1245.665369][T11946] usb 6-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 1245.668948][T11946] usb 6-1: config 0 has an invalid interface number: 35 but max is 0 [ 1245.668975][T11946] usb 6-1: config 0 has no interface number 0 [ 1245.669229][T11946] usb 6-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1245.669262][T11946] usb 6-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1245.680359][T11946] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1245.680433][T11946] usb 6-1: Product: syz [ 1245.680525][T11946] usb 6-1: Manufacturer: syz [ 1245.680565][T11946] usb 6-1: SerialNumber: syz [ 1245.696688][T11946] usb 6-1: config 0 descriptor?? [ 1245.753313][ C0] usb 3-1: received EP1 urb->status = -2 [ 1245.753407][ T5681] usb 3-1: unable to init card! (ret=-110) [ 1245.754432][ T5681] snd-usb-caiaq 3-1:1.0: probe with driver snd-usb-caiaq failed with error -110 [ 1245.911958][T11946] radio-si470x 6-1:0.35: this is not a si470x device. [ 1245.959240][ T5704] usb 3-1: USB disconnect, device number 19 [ 1246.119868][T11946] radio-raremono 6-1:0.35: this is not Thanko's Raremono. [ 1246.146126][T11946] usb 6-1: USB disconnect, device number 114 [ 1246.575638][T24113] netlink: 'syz.6.4916': attribute type 10 has an invalid length. [ 1246.876598][T24123] loop5: detected capacity change from 0 to 7 [ 1246.888426][T24123] Dev loop5: unable to read RDB block 7 [ 1246.895848][T24123] loop5: AHDI p1 p2 [ 1246.899949][T24123] loop5: partition table partially beyond EOD, truncated [ 1246.900161][T24123] loop5: p1 size 150995456 extends beyond EOD, truncated [ 1247.214729][ T5630] udevd[5630]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1247.510096][T24134] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4922'. [ 1247.564808][T24132] pic_ioport_write: 146 callbacks suppressed [ 1247.564865][T24132] kvm: pic: single mode not supported [ 1247.564878][T24132] pic_ioport_write: 121 callbacks suppressed [ 1247.564912][T24132] kvm: pic: level sensitive irq not supported [ 1247.571593][T24132] kvm: pic: level sensitive irq not supported [ 1247.590687][T24132] kvm: pic: level sensitive irq not supported [ 1247.599427][T24132] kvm: pic: level sensitive irq not supported [ 1247.606596][T24132] kvm: pic: level sensitive irq not supported [ 1247.948747][ T4986] Dev loop3: unable to read RDB block 7 [ 1247.963040][ T4986] loop3: unable to read partition table [ 1247.969304][ T4986] loop3: partition table beyond EOD, truncated [ 1249.282829][ T4986] Dev loop3: unable to read RDB block 7 [ 1249.290277][ T4986] loop3: unable to read partition table [ 1249.290508][ T4986] loop3: partition table beyond EOD, truncated [ 1252.672819][ T4986] Dev loop3: unable to read RDB block 7 [ 1252.674622][ T4986] loop3: unable to read partition table [ 1252.675406][ T4986] loop3: partition table beyond EOD, truncated [ 1252.791186][T24159] netlink: 'syz.5.4929': attribute type 10 has an invalid length. [ 1252.831196][T24162] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4928'. [ 1252.942412][T24163] netlink: 'syz.3.4930': attribute type 4 has an invalid length. [ 1253.024799][T24164] netlink: 'syz.3.4930': attribute type 4 has an invalid length. [ 1253.190297][T24166] loop5: detected capacity change from 0 to 7 [ 1253.199653][T24166] Dev loop5: unable to read RDB block 7 [ 1253.207264][T24166] loop5: AHDI p1 p2 [ 1253.211484][T24166] loop5: partition table partially beyond EOD, truncated [ 1253.220720][T24166] loop5: p1 size 150995456 extends beyond EOD, truncated [ 1253.387031][ T5630] udevd[5630]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1253.809381][T24175] use of bytesused == 0 is deprecated and will be removed in the future, [ 1253.819704][T24175] use the actual size instead. [ 1254.125015][ T5681] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1254.160413][ T4986] Dev loop3: unable to read RDB block 7 [ 1254.166432][ T4986] loop3: unable to read partition table [ 1254.172426][ T4986] loop3: partition table beyond EOD, truncated [ 1254.283241][ T5681] usb 6-1: Using ep0 maxpacket: 16 [ 1254.290991][ T5681] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1254.299051][ T5681] usb 6-1: New USB device found, idVendor=12d1, idProduct=9634, bcdDevice=18.90 [ 1254.310136][ T5681] usb 6-1: config 251 has an invalid interface number: 33 but max is 0 [ 1254.320513][ T5681] usb 6-1: config 251 has an invalid descriptor of length 0, skipping remainder of the config [ 1254.320540][ T5681] usb 6-1: config 251 has no interface number 0 [ 1254.320574][ T5681] usb 6-1: config 251 interface 33 has no altsetting 0 [ 1254.356144][ T5681] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1254.356191][ T5681] usb 6-1: Product: syz [ 1254.356228][ T5681] usb 6-1: Manufacturer: syz [ 1254.356249][ T5681] usb 6-1: SerialNumber: syz [ 1254.388462][ T4986] Dev loop3: unable to read RDB block 7 [ 1254.388550][ T4986] loop3: unable to read partition table [ 1254.388834][ T4986] loop3: partition table beyond EOD, truncated [ 1254.587339][ T5681] qmi_wwan 6-1:251.33: probe with driver qmi_wwan failed with error -22 [ 1254.613015][ T5681] usb 6-1: USB disconnect, device number 115 [ 1254.623228][T11946] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 1254.774125][T11946] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1254.784936][T11946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1254.784988][T11946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1254.785055][T11946] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1254.821392][T11946] usb 3-1: config 0 descriptor?? [ 1255.437785][ T4986] Dev loop3: unable to read RDB block 7 [ 1255.437843][ T4986] loop3: unable to read partition table [ 1255.438119][ T4986] loop3: partition table beyond EOD, truncated [ 1255.472165][T11946] usb 3-1: language id specifier not provided by device, defaulting to English [ 1255.523792][T24188] netlink: 'syz.5.4941': attribute type 10 has an invalid length. [ 1255.807663][ T4986] Dev loop3: unable to read RDB block 7 [ 1255.807751][ T4986] loop3: unable to read partition table [ 1255.808037][ T4986] loop3: partition table beyond EOD, truncated [ 1255.879913][T24194] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4943'. [ 1255.899136][T24194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1255.914716][T24179] gre0: Caught tx_queue_len zero misconfig [ 1255.922156][T24194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1255.962579][T11946] uclogic 0003:256C:006D.0042: interface is invalid, ignoring [ 1255.992277][T24196] loop5: detected capacity change from 0 to 7 [ 1255.995472][T24196] Dev loop5: unable to read RDB block 7 [ 1255.995547][T24196] loop5: AHDI p1 p2 [ 1255.995622][T24196] loop5: partition table partially beyond EOD, truncated [ 1255.996952][T24196] loop5: p1 size 150995456 extends beyond EOD, truncated [ 1256.069044][ T5630] udevd[5630]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1256.573693][T24208] netlink: 'syz.5.4948': attribute type 1 has an invalid length. [ 1256.654906][T24218] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4947'. [ 1256.802819][T24214] ip_tables: iptables: counters copy to user failed while replacing table [ 1256.898993][ T5681] usb 3-1: USB disconnect, device number 20 [ 1257.032288][T24208] bridge2: entered promiscuous mode [ 1257.062320][T24208] bond2: (slave bridge2): making interface the new active one [ 1257.094190][T24208] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 1257.114933][T24224] netlink: 'syz.3.4952': attribute type 10 has an invalid length. [ 1257.149235][T24214] bridge3: entered promiscuous mode [ 1257.161923][T24214] bond2: (slave bridge3): Enslaving as a backup interface with an up link [ 1257.337557][T24229] netlink: 'syz.2.4953': attribute type 16 has an invalid length. [ 1257.345759][T24229] netlink: 'syz.2.4953': attribute type 17 has an invalid length. [ 1257.363329][T24229] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4953'. [ 1257.398936][T24229] netlink: 'syz.2.4953': attribute type 16 has an invalid length. [ 1257.399907][T24229] netlink: 'syz.2.4953': attribute type 17 has an invalid length. [ 1257.399967][T24229] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4953'. [ 1258.213090][T11945] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1258.363315][T11945] usb 6-1: Using ep0 maxpacket: 8 [ 1258.396195][T11945] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1258.396269][T11945] usb 6-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 1258.420767][T11945] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1258.431913][T11945] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1258.431945][T11945] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 1258.431974][T11945] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 1258.432001][T11945] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1258.432024][T11945] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 44 [ 1258.493916][T11945] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1258.493970][T11945] usb 6-1: Product: syz [ 1258.494004][T11945] usb 6-1: Manufacturer: syz [ 1258.494026][T11945] usb 6-1: SerialNumber: syz [ 1258.528471][T11945] usb 6-1: config 0 descriptor?? [ 1258.534835][T24245] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1258.535091][T24245] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1258.628478][T11945] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1258.775628][T24245] netlink: 'syz.5.4957': attribute type 3 has an invalid length. [ 1258.844943][ T30] audit: type=1326 audit(1788337306.562:6866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24244 comm="syz.5.4957" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd7a3f9e159 code=0x0 [ 1259.189052][T24262] netlink: zone id is out of range [ 1259.216089][T24262] netlink: zone id is out of range [ 1259.216156][T24262] netlink: zone id is out of range [ 1259.216171][T24262] netlink: zone id is out of range [ 1259.216184][T24262] netlink: zone id is out of range [ 1259.216197][T24262] netlink: zone id is out of range [ 1259.216519][T24262] netlink: zone id is out of range [ 1259.216537][T24262] netlink: zone id is out of range [ 1259.216550][T24262] netlink: zone id is out of range [ 1259.328710][T24257] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4958'. [ 1260.317643][T24276] netlink: 'syz.2.4961': attribute type 1 has an invalid length. [ 1260.402778][T24271] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4961'. [ 1260.562138][T24279] ip6erspan0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1260.683301][ T5681] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1260.833999][ T5681] usb 3-1: Using ep0 maxpacket: 8 [ 1260.836022][ T5681] usb 3-1: New USB device found, idVendor=0f11, idProduct=1031, bcdDevice=2f.8e [ 1260.861920][ T5681] usb 3-1: config 7 has an invalid interface number: 107 but max is 0 [ 1260.861973][ T5681] usb 3-1: config 7 has no interface number 0 [ 1260.862057][ T5681] usb 3-1: config 7 interface 107 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 1260.862138][ T5681] usb 3-1: config 7 interface 107 altsetting 2 endpoint 0x5 has invalid maxpacket 1023, setting to 64 [ 1260.862230][ T5681] usb 3-1: config 7 interface 107 altsetting 2 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 1260.862289][ T5681] usb 3-1: config 7 interface 107 altsetting 2 endpoint 0x87 has invalid maxpacket 38895, setting to 1024 [ 1260.928939][ T5681] usb 3-1: config 7 interface 107 altsetting 2 bulk endpoint 0x87 has invalid maxpacket 1024 [ 1260.928993][ T5681] usb 3-1: config 7 interface 107 altsetting 2 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1260.929026][ T5681] usb 3-1: config 7 interface 107 has no altsetting 0 [ 1260.971100][ T5681] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1260.971142][ T5681] usb 3-1: Product: syz [ 1260.971180][ T5681] usb 3-1: Manufacturer: syz [ 1260.971203][ T5681] usb 3-1: SerialNumber: syz [ 1261.028389][T24271] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1261.029864][T24271] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1261.289537][T11946] usb 6-1: USB disconnect, device number 116 [ 1261.751021][T24290] netlink: 'syz.5.4965': attribute type 10 has an invalid length. [ 1261.819669][ T5681] ldusb 3-1:7.107: Interrupt in endpoint not found [ 1261.886445][ T5681] usb 3-1: USB disconnect, device number 21 [ 1262.840195][T24302] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4968'. [ 1263.024614][T24306] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4968'. [ 1263.331851][T24305] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4970'. [ 1263.987643][T24317] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4974'. [ 1264.076444][T24319] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4974'. [ 1265.589189][T24334] netlink: 'syz.2.4977': attribute type 10 has an invalid length. [ 1266.243260][ T31] INFO: task kworker/1:1:44 blocked for more than 143 seconds. [ 1266.243391][ T31] Tainted: G L syzkaller #0 [ 1266.243450][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1266.243477][ T31] task:kworker/1:1 state:D stack:20400 pid:44 tgid:44 ppid:2 task_flags:0x4288060 flags:0x00080000 [ 1266.243621][ T31] Workqueue: usb_hub_wq hub_event [ 1266.243712][ T31] Call Trace: [ 1266.243738][ T31] [ 1266.243753][ T31] __schedule+0x17db/0x58f0 [ 1266.243877][ T31] ? __pfx___schedule+0x10/0x10 [ 1266.243942][ T31] ? schedule+0x90/0x2b0 [ 1266.244006][ T31] schedule+0x164/0x2b0 [ 1266.244065][ T31] schedule_timeout+0xc0/0x2c0 [ 1266.244135][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1266.244176][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 1266.244240][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1266.244309][ T31] ? wait_for_completion+0x272/0x5e0 [ 1266.244365][ T31] wait_for_completion+0x2ca/0x5e0 [ 1266.244465][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1266.244530][ T31] ? __flush_work+0x101/0xca0 [ 1266.244603][ T31] __flush_work+0xa63/0xca0 [ 1266.244661][ T31] ? __flush_work+0x101/0xca0 [ 1266.244753][ T31] ? __pfx___flush_work+0x10/0x10 [ 1266.244802][ T31] ? __pfx_wq_barrier_func+0x10/0x10 ** replaying previous printk message ** [ 1266.244802][ T31] ? __pfx_wq_barrier_func+0x10/0x10 [ 1266.244929][ T31] ? __cancel_work_sync+0x5c/0x110 [ 1266.244990][ T31] __cancel_work_sync+0xbf/0x110 [ 1266.245061][ T31] mmc_stop_host+0xd9/0x460 [ 1266.245287][ T31] mmc_remove_host+0x15/0x60 [ 1266.245357][ T31] vub300_disconnect+0x154/0x2f0 [ 1266.245473][ T31] usb_unbind_interface+0x295/0x9f0 [ 1266.245516][ T31] ? kernfs_remove_by_name_ns+0x101/0x140 [ 1266.245639][ T31] ? kernfs_remove_by_name_ns+0x101/0x140 [ 1266.245681][ T31] ? __pfx_usb_unbind_interface+0x10/0x10 [ 1266.245747][ T31] device_release_driver_internal+0x4f5/0x880 [ 1266.245904][ T31] bus_remove_device+0x444/0x560 [ 1266.271096][ T31] ? __pfx_bus_remove_device+0x10/0x10 [ 1266.271170][ T31] ? kernfs_remove_by_name_ns+0x101/0x140 [ 1266.271202][ T31] device_del+0x524/0x8f0 [ 1266.271321][ T31] ? __pfx_device_del+0x10/0x10 [ 1266.271354][ T31] ? kobject_put+0x516/0x550 [ 1266.271390][ T31] usb_disable_device+0x3d4/0x8d0 [ 1266.271423][ T31] usb_disconnect+0x346/0x9a0 [ 1266.271465][ T31] hub_event+0x1bbb/0x4d30 [ 1266.271486][ T31] ? __lock_acquire+0x6df/0x2e50 [ 1266.271523][ T31] ? register_lock_class+0x31/0x2e0 [ 1266.271556][ T31] ? irqentry_exit+0x218/0x910 [ 1266.271609][ T31] ? __pfx_hub_event+0x10/0x10 [ 1266.271640][ T31] ? rcu_is_watching+0x16/0xb0 [ 1266.271669][ T31] ? process_scheduled_works+0x97a/0x1630 [ 1266.271700][ T31] process_scheduled_works+0xc3d/0x1630 [ 1266.271761][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1266.271843][ T31] ? assign_work+0x3cf/0x5d0 [ 1266.271878][ T31] worker_thread+0xa47/0xfb0 [ 1266.271923][ T31] ? __kthread_parkme+0x71/0x1f0 [ 1266.271966][ T31] kthread+0x38b/0x480 [ 1266.271989][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1266.272018][ T31] ? __pfx_kthread+0x10/0x10 [ 1266.272041][ T31] ret_from_fork+0x514/0xb70 [ 1266.272068][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1266.272103][ T31] ? __switch_to+0xc89/0x1420 [ 1266.272136][ T31] ? __pfx_kthread+0x10/0x10 [ 1266.272159][ T31] ret_from_fork_asm+0x1a/0x30 [ 1266.272210][ T31] [ 1266.272263][ T31] INFO: task kworker/0:3:1846 blocked for more than 143 seconds. [ 1266.272302][ T31] Tainted: G L syzkaller #0 [ 1266.272316][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1266.272327][ T31] task:kworker/0:3 state:D stack:20608 pid:1846 tgid:1846 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1266.272404][ T31] Workqueue: events_freezable mmc_rescan [ 1266.272433][ T31] Call Trace: [ 1266.272442][ T31] [ 1266.272455][ T31] __schedule+0x17db/0x58f0 [ 1266.272515][ T31] ? __pfx___schedule+0x10/0x10 [ 1266.272583][ T31] ? schedule+0x90/0x2b0 [ 1266.290877][ T31] schedule+0x164/0x2b0 [ 1266.290990][ T31] schedule_timeout+0xc0/0x2c0 [ 1266.291068][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1266.291138][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 1266.291233][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1266.291295][ T31] ? wait_for_completion+0x272/0x5e0 [ 1266.291406][ T31] wait_for_completion+0x2ca/0x5e0 [ 1266.291527][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1266.291620][ T31] ? vub300_mmc_request+0x1000/0x1910 [ 1266.291715][ T31] ? trace_mmc_request_start+0x81/0x1e0 [ 1266.291795][ T31] mmc_wait_for_req_done+0x37/0x490 [ 1266.291865][ T31] ? mmc_start_request+0x202/0x2d0 [ 1266.291948][ T31] ? mmc_wait_for_req+0x1b5/0x240 [ 1266.292020][ T31] mmc_wait_for_cmd+0x183/0x2a0 [ 1266.292081][ T31] ? debug_object_free+0x29c/0x340 [ 1266.292285][ T31] ? __pfx_mmc_wait_for_cmd+0x10/0x10 [ 1266.292389][ T31] ? __pfx_mmc_wait_done+0x10/0x10 [ 1266.307148][ T31] ? ktime_get+0x1f5/0x220 [ 1266.307224][ T31] ? usleep_range_state+0x95/0x180 [ 1266.307315][ T31] mmc_go_idle+0x12c/0x2a0 [ 1266.307404][ T31] ? __pfx_mmc_go_idle+0x10/0x10 [ 1266.307500][ T31] ? mmc_power_up+0x5d/0x650 [ 1266.307591][ T31] mmc_rescan+0x6fe/0x1040 [ 1266.307708][ T31] ? process_scheduled_works+0x97a/0x1630 [ 1266.307799][ T31] process_scheduled_works+0xc3d/0x1630 [ 1266.307964][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1266.308060][ T31] ? assign_work+0x3cf/0x5d0 [ 1266.308162][ T31] worker_thread+0xa47/0xfb0 [ 1266.308365][ T31] kthread+0x38b/0x480 [ 1266.308451][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1266.308527][ T31] ? __pfx_kthread+0x10/0x10 [ 1266.308581][ T31] ret_from_fork+0x514/0xb70 [ 1266.320732][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1266.320892][ T31] ? __switch_to+0xc89/0x1420 [ 1266.320930][ T31] ? __pfx_kthread+0x10/0x10 [ 1266.320957][ T31] ret_from_fork_asm+0x1a/0x30 [ 1266.321011][ T31] [ 1266.322317][ T31] [ 1266.322317][ T31] Showing all locks held in the system: [ 1266.322358][ T31] locks held by pr/ttyS0/16: 2, last CPU#1: [ 1266.322408][ T31] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 1266.322575][ T31] #1: ffffffff9ad31098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 [ 1266.335324][ T31] locks held by khungtaskd/31: 1, last CPU#0: [ 1266.335388][ T31] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1266.335548][ T31] locks held by kworker/1:1/44: 5, on CPU#1: [ 1266.340298][ T31] #0: ffff888022efe940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1266.340371][ T31] #1: ffffc90000b47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1266.340435][ T31] #2: ffff8880295f61d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 1266.340519][ T31] #3: ffff88802605a1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 [ 1266.340582][ T31] #4: ffff88803525a1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 1266.340653][ T31] locks held by kworker/0:3/1846: 2, on CPU#0: [ 1266.340670][ T31] #0: ffff88801b06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1266.340730][ T31] #1: ffffc90006597c40 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1266.340817][ T31] locks held by getty/5375: 2, on CPU#0: [ 1266.340834][ T31] #0: ffff8880356960a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1266.341005][ T31] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 1266.341065][ T31] locks held by kworker/0:5/5681: 2, last CPU#0: [ 1266.341082][ T31] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1266.341152][ T31] #1: ffffc9000430fc40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1266.341229][ T31] locks held by kworker/u8:14/23333: 4, last CPU#0: [ 1266.341245][ T31] #0: ffff888032303940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1266.341305][ T31] #1: ffffc9000446fc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1266.341366][ T31] #2: ffff888043cd81c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule+0xd4/0xfc0 [ 1266.341516][ T31] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule+0x41f/0xfc0 [ 1266.341594][ T31] locks held by syz.2.4956/24249: 3, last CPU#0: [ 1266.341612][ T31] #0: ffff88802634a460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0x3766/0x4530 [ 1266.341671][ T31] #1: ffff88807f479078 (&mm->mmap_lock){++++}-{4:4}, at: dump_user_range+0x1c5/0x12c0 [ 1266.341722][ T31] #2: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: mt_find+0x186/0x630 [ 1266.341770][ T31] locks held by syz.6.4972/24311: 2, last CPU#0: [ 1266.341796][ T31] #0: ffff888035f0c378 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 1266.359980][ T31] #1: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 1266.360171][ T31] locks held by syz.5.4978/24336: 2, last CPU#0: [ 1266.360219][ T31] #0: ffff8880678b2928 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x27f/0xfd0 [ 1266.360408][ T31] #1: ffff8880428f6310 (&kvm->srcu){.+.+}-{0:0}, at: vcpu_run+0x28fd/0x79b0 [ 1266.371469][ T31] locks held by syz.1.4980/24344: 2, last CPU#0: [ 1266.371522][ T31] #0: ffffffff8f4ef978 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_check_open_permission+0x1d3/0x470 [ 1266.371728][ T31] #1: ffffffff8eeabc30 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 1266.371941][ T31] [ 1266.371962][ T31] ============================================= [ 1266.371962][ T31] [ 1266.371986][ T31] NMI backtrace for cpu 0 [ 1266.372036][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1266.372131][ T31] Tainted: [L]=SOFTLOCKUP [ 1266.372152][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1266.372209][ T31] Call Trace: [ 1266.372231][ T31] [ 1266.372246][ T31] dump_stack_lvl+0xe8/0x150 [ 1266.372343][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 1266.372510][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1266.372611][ T31] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 1266.372701][ T31] sys_info+0x135/0x170 [ 1266.372745][ T31] watchdog+0xfd7/0x1030 [ 1266.372786][ T31] ? watchdog+0x1c7/0x1030 [ 1266.372816][ T31] kthread+0x38b/0x480 [ 1266.372839][ T31] ? __pfx_watchdog+0x10/0x10 [ 1266.372860][ T31] ? __pfx_kthread+0x10/0x10 [ 1266.372884][ T31] ret_from_fork+0x514/0xb70 [ 1266.372909][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1266.372945][ T31] ? __switch_to+0xc89/0x1420 [ 1266.372979][ T31] ? __pfx_kthread+0x10/0x10 [ 1266.373003][ T31] ret_from_fork_asm+0x1a/0x30 [ 1266.373055][ T31] [ 1266.373207][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1266.373279][ C1] NMI backtrace for cpu 1 [ 1266.373296][ C1] CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1266.373323][ C1] Tainted: [L]=SOFTLOCKUP [ 1266.373330][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1266.373343][ C1] RIP: 0010:__remove_hrtimer+0x1c9/0x3e0 [ 1266.373376][ C1] Code: 3c 28 00 74 08 4c 89 e7 e8 84 23 83 00 4d 8b 24 24 4d 85 e4 74 24 e8 06 5a 13 00 49 83 c4 28 4c 89 e0 48 c1 e8 03 80 3c 28 00 <74> 08 4c 89 e7 e8 5d 23 83 00 49 8b 1c 24 eb 0f e8 e2 59 13 00 48 [ 1266.373393][ C1] RSP: 0018:ffffc90000a18d78 EFLAGS: 00000046 [ 1266.373410][ C1] RAX: 1ffff920009e2f89 RBX: 1ffff110170e5196 RCX: ffff88801e2a0000 [ 1266.373425][ C1] RDX: 8000000001000001 RSI: 0000000001000001 RDI: ffff8880b8728ca0 [ 1266.373439][ C1] RBP: dffffc0000000000 R08: ffff8880b8728c9f R09: 0000000000000000 [ 1266.373453][ C1] R10: ffff8880b8728c90 R11: ffffed10170e5194 R12: ffffc90004f17c48 [ 1266.373468][ C1] R13: 0000000000000000 R14: ffff8880b8728c78 R15: ffff8880b8728340 [ 1266.373483][ C1] FS: 0000000000000000(0000) GS:ffff888124dda000(0000) knlGS:0000000000000000 [ 1266.373499][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1266.373512][ C1] CR2: 00007fb6a6a27dac CR3: 0000000056690000 CR4: 00000000003526f0 [ 1266.373530][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1266.373542][ C1] DR3: 0000000000000001 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1266.373554][ C1] Call Trace: [ 1266.373562][ C1] [ 1266.373573][ C1] __hrtimer_run_queues+0x295/0xa10 [ 1266.373609][ C1] hrtimer_interrupt+0x4cd/0xaa0 [ 1266.373651][ C1] __sysvec_apic_timer_interrupt+0x102/0x430 [ 1266.373676][ C1] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 1266.373704][ C1] [ 1266.373710][ C1] [ 1266.373718][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1266.373739][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 1266.373786][ C1] Code: f7 e8 5d 25 bd f5 f7 c3 00 02 00 00 74 05 e8 50 62 e9 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 f4 3e ae f5 65 48 8b 05 9c c1 ad 07 48 85 c0 74 18 5b 41 5e c3 [ 1266.373802][ C1] RSP: 0018:ffffc90000157ca8 EFLAGS: 00000206 [ 1266.373818][ C1] RAX: 0000000000000002 RBX: 0000000000000206 RCX: 8000000000000001 [ 1266.373831][ C1] RDX: 0000000000000000 RSI: ffffffff8e474257 RDI: 0000000000000001 [ 1266.373844][ C1] RBP: ffffc90000157e18 R08: ffffffff907a137f R09: 1ffffffff20f426f [ 1266.373858][ C1] R10: dffffc0000000000 R11: fffffbfff20f4270 R12: 0000000000000002 [ 1266.373872][ C1] R13: ffff88801e2a0000 R14: ffffffff9ad31080 R15: dffffc0000000000 [ 1266.373897][ C1] nbcon_kthread_func+0x6c4/0x880 [ 1266.373921][ C1] ? nbcon_kthread_func+0x163/0x880 [ 1266.373939][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 1266.373962][ C1] ? __kthread_parkme+0x71/0x1f0 [ 1266.373990][ C1] ? __kthread_parkme+0x199/0x1f0 [ 1266.374019][ C1] kthread+0x38b/0x480 [ 1266.374036][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 1266.374055][ C1] ? __pfx_kthread+0x10/0x10 [ 1266.374073][ C1] ret_from_fork+0x514/0xb70 [ 1266.374092][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1266.374121][ C1] ? __switch_to+0xc89/0x1420 [ 1266.374148][ C1] ? __pfx_kthread+0x10/0x10 [ 1266.374166][ C1] ret_from_fork_asm+0x1a/0x30 [ 1266.374203][ C1] [ 1266.390268][T24343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1266.396268][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1267.654208][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1267.665167][ T31] Tainted: [L]=SOFTLOCKUP [ 1267.669507][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1267.679582][ T31] Call Trace: [ 1267.682879][ T31] [ 1267.685834][ T31] vpanic+0x56d/0xa60 [ 1267.689840][ T31] ? __pfx___schedule+0x10/0x10 [ 1267.694739][ T31] ? __pfx_vpanic+0x10/0x10 [ 1267.699285][ T31] panic+0xc5/0xd0 [ 1267.703033][ T31] ? __pfx_panic+0x10/0x10 [ 1267.707475][ T31] ? preempt_schedule_common+0x7f/0xd0 [ 1267.712955][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 1267.718340][ T31] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 1267.724515][ T31] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 1267.730705][ T31] watchdog+0x1030/0x1030 [ 1267.735065][ T31] ? watchdog+0x1c7/0x1030 [ 1267.739501][ T31] kthread+0x38b/0x480 [ 1267.743583][ T31] ? __pfx_watchdog+0x10/0x10 [ 1267.748280][ T31] ? __pfx_kthread+0x10/0x10 [ 1267.752895][ T31] ret_from_fork+0x514/0xb70 [ 1267.757515][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1267.762652][ T31] ? __switch_to+0xc89/0x1420 [ 1267.767359][ T31] ? __pfx_kthread+0x10/0x10 [ 1267.771963][ T31] ret_from_fork_asm+0x1a/0x30 [ 1267.776769][ T31] [ 1267.781074][ T31] Kernel Offset: disabled [ 1267.785412][ T31] Rebooting in 86400 seconds..