last executing test programs: 7m44.541947811s ago: executing program 3 (id=130): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'macsec0\x00', 0x0}) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) recvmmsg(r0, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x10022, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r4, 0x6, 0x22, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r4, &(0x7f0000000100)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r4, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9", 0x1}], 0x1, 0x0, 0x0, 0x91}}], 0x1, 0x20008000) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000500)=@o_path={&(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, r0}, 0x18) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000a80)={0x1ff, 0x200, 0x1, {0x6, @sliced={0x0, [0x9, 0x100, 0x4, 0x3, 0x6, 0x4, 0x1, 0x4, 0x4, 0x7, 0x200, 0x2, 0xad, 0x0, 0x6e, 0xfff7, 0x6, 0x2, 0x2, 0x0, 0x2, 0x1800, 0x5, 0x0, 0x8000, 0xa000, 0x401, 0x2480, 0x7, 0x101, 0x4, 0x1, 0x1, 0x0, 0x6, 0x1, 0x8, 0x0, 0x800, 0x5, 0x3, 0xffff, 0xfff, 0x3, 0x5c69, 0x2, 0xd17, 0x7], 0x9}}, 0x9}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="600000000206010800000000000000000000000014000780080011400000000005000006000000050005000a00000005000400000000000900020073797a300000000011000300686173683a69702c706f727400"/96], 0x60}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r6 = socket$inet6(0xa, 0x3, 0x8000000003c) r7 = openat$kvm(0xffffff9c, &(0x7f0000000080), 0x20000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r9, 0x4008ae90, &(0x7f0000000240)={0x666666666666763}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000240)) r10 = add_key$keyring(&(0x7f0000000080), &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r10, 0x0, 0x0) add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, r10) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000800)={&(0x7f00000005c0)={0x214, r11, 0x4, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x60, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NET={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7fffffffffffffff}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x42}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10001}]}, @TIPC_NLA_NET={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x10001}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffe}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}]}, @TIPC_NLA_MEDIA={0xfc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x120000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x84f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe0000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff1767}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}]}, @TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xffff9c82}]}]}]}, 0x214}, 0x1, 0x0, 0x0, 0x4841}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffffd}]}) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @mcast1, 0x9}, 0x1c) sendmsg(r6, &(0x7f00000000c0)={0x0, 0x9511, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000300)={0x2, &(0x7f00000001c0)=[{0xff80, 0xe, 0xd, 0x6}, {0x81a, 0xd2, 0x6, 0x8}]}) 7m44.019920783s ago: executing program 3 (id=132): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_mreq(r1, 0x29, 0x15, 0x0, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000007040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000007000)={0x20}, 0x0}) (async) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) (async, rerun: 32) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) (rerun: 32) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44801}, 0x840) (async, rerun: 32) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) (async, rerun: 32) syz_emit_ethernet(0x3a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000008004500002c0000000000119078000000000000000000"], 0x0) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r5, 0xc01064c7, &(0x7f0000000300)={0x8, 0x0, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xc}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0x2000000}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x5c}, 0x1, 0x0, 0x0, 0x200000a4}, 0x20008040) r6 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r6, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x3ed, 0x100, 0x70bd2d, 0x25dfdbfd, "d6637c980f70b9fbc7a245f76f40850198", [""]}, 0x24}, 0x1, 0x0, 0x0, 0x48000}, 0x80) 7m43.576136673s ago: executing program 3 (id=134): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f0000000100)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000040)={0x0, @bt={0x7a8000, 0x41, 0x1, 0x1, 0x101, 0x7fa, 0xff, 0x8, 0xfffff081, 0xc, 0x9, 0x3, 0xffffffff, 0x8000, 0x16, 0x30, {0x5c, 0x5}, 0x2, 0x8}}) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000001c0)={0x3, 0x400, 0x7, 0x3}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) r4 = socket$kcm(0x2, 0x200000000000001, 0x106) pselect6(0x40, &(0x7f0000000200)={0x6, 0x4, 0x7, 0x4, 0x1, 0x8000000000000000, 0x5, 0x8000000000000001}, &(0x7f0000000240)={0x4, 0x10000, 0x2, 0x4, 0x473, 0x7fffffff, 0x9, 0x7}, &(0x7f0000000280)={0x8, 0x40, 0x51ec1202, 0x51052559, 0x0, 0x6, 0xff, 0x1000}, &(0x7f00000002c0), &(0x7f0000000380)={&(0x7f0000000340)={[0xff]}, 0x8}) sendmsg$inet(r4, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x4001, @empty}, 0x10, 0x0}, 0x30006041) close(r4) 7m43.437585708s ago: executing program 3 (id=135): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004f40)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x94}}, 0x0) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, 0x0, 0x0) r5 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r5, &(0x7f00000031c0)={&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x0, 0x4}, 0x80, &(0x7f00000018c0)=[{&(0x7f0000000280)="9eb8a2c0e241fb04", 0x8}], 0x1, &(0x7f0000000580)=ANY=[@ANYBLOB="1800"], 0x18}, 0x8080) sendmsg$kcm(r5, &(0x7f0000000040)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x2, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='S\x00', 0x2}], 0x1, 0x0, 0x0, 0x900}, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f0000000180)={{&(0x7f0000012000/0x4000)=nil, 0x4000}}) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\x10rust\xe3c*sgrVen:Dd', 0xfffffffffffffffe) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="0fc7590e0f0726f36e660f38827e00660fc7330f38f6b90f0065650f06f4f3660f06b800088ed8"}], 0x1, 0x10, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x9a090b, 0x7fffffff, '\x00', @ptr=0x10000}}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="01"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24}, 0x94) socket(0x200000000000011, 0x2, 0xd) r7 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r7, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) syz_emit_ethernet(0x86, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0xfffc, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x2, "e5410e86db87a41f716be8e1fa0fe2fb143899778cc5c15c1337404bb397c0fc", "0c17d7b032591c2a7eb609eb8d2d9d15", {"28cbbe8b3bc8849d1e6124e7e5913283", "0080200000002000d300000000000400"}}}}}}}, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) execveat(0xffffffffffffff9c, &(0x7f00000001c0)='./file2\x00', 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x2000, 0x0) mknod$loop(&(0x7f0000000340)='./file0\x00', 0x208c, 0x1) 7m42.6269627s ago: executing program 3 (id=144): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_keypress_notify={{0x3c, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x4}}}, 0xa) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000140000feb7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007baa00fe00000000b5090800000000007baaf0ff00000000bf8700000000000036070000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004602010076000000bf98000000000000be080000000000008500000007000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0xb, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000000040)={{r2}, "ac16a5dde586dfc9f0c9f7794db56d9dc6ec8e0864585baf52fe1b65bcae92baf1a35b78b5755cc5ed0cec2ea08a0f487a8b3dc091f2b0f54079b513c0fb5f5544a6f93d9bbe1d123e6172e2eac19e2e7e3eff3028a6a8e10fd7bce9e1420bdeeebc6dd4f6ea05dce367f218799d87e3a0a4d424e33f29751785ae194924220f22679d902f64daf81de5566bbb05000b08d081c76a32f9e7f367c6f7513a1ad24a5ea32de7441945c01cd0a4dc3c2456e369864d610b8b2bbc73bc86bdf606c2a7478a177d819e326546f44bc5ca13e1e64cb012874fc9704b64e5c6cf490b3647d22d6259b04076dc78235408239d5f64a8740939e4696c6b60f9dbb046e164466c9882f5f638ee5be91f5343ea5220f4f41267ee52513f072751f1348c5c7585fbc5cfcda5487204731eefb14e0c317dbd30e107259ee1cc50168b846a9b8fc9b56b79e4501a2442920f74ca07f64765b006ddae010535673da463fc8b7710a4c9114b18abf71f900e4cd33ec7206adc2179f2309a11cc71d4573d0da743c87023253c8f9a365883e050c24d3c3c343d5c01e39caef24b1410b309f7debd375a490280b9eb4c84054fec8cf06cd4374496cb7c8125f046fffd6addf53c41720165283e34f5efa450f3dedb9c4989125254216fbbf6ac2cf61991f5ea1c9e2a710005b0560c2e1c9c11043229a4aa24d78cbde9d33329679b903fa4beb4766245d30d4ac7157cb130dd81927b4727f52088df23b092d28f6435980b5629b352d2653f62b35194adc67febacce39f9923e6acbdd6db9cc1b5e630a8f39c943e65c64d83805ae60185cea41ae25f0d8e5deaf01cc1885aeabd7b38ceed772fca35e0b8eeb648ecaf6ff5fb6f11969293dfc33d276a3745a4a1dab730881d081110d379a2e678d60fed85d03f7c81cf0be54aee4b62f3f9077d238f410bdad9180db379a9da2bac130ad87f39dca950c3b765a792a2662cd5c5bc139cecefb4ac2f4b26ac2668702d4adf115e37a7d20e116d5890b7e5e6a062aff0d28ffbe59ab7aefe451d396eeca124c844cfbeb28a7faf2c770e34ff421836208566c4376f5837ab9a52dec78e9846b351ce1e30a59cccc216e5652413825ed633e898209ce3caa9f5da54ec438d558815ed5690b999e8378c6b17cc2e011ac46bbf6da7041646bcd258ead30a89381b712b2d728a78fd06d121d6f1bcb7955c6f2f506541f527631f7c351740a94f606cfd82a93f09770727d3eb6cdd21d5051eb7e75dfaf38c2039f1bebe65fbd3b9a25578d02ffcf3e19a154066e2d4eefe9876264abb973c027c9064a64d209e1adbe17b4f4f731e215499ea7f0296e51ebef2941a6b10588a592d61e815d6aa7947795ef6627e36ea49b5d775373a9042f228bbe4590053b1219a5b4b6ede77ac15b643cf397087cd28100c5e203dbc5557c2bb82383f0fd73815b2fd4f97170eef9c2407bbb8b4ef63aca1e3377e7ee492b5823550bbff40b566346f7922c03c9008812945b225e1a5b54527bbb51674e6c7b74947c99a433cfd3df995ef116de6f5fa1ff47cd2254a158b715cb39d22676c628396e7b9c1b352899204ba8fbe8423a1cfb74a8329ae28a95e1d83f2d025df98c7c6556d6d225ced363945209fd1f2478071d1904a07059e80644c2c7cad4ee9a745f63a8761e50b41fca18909e0e773b498969758c404eb5f53b8596cf853114585303c0ce7ad7699eef8825430459537fa3e4d7fe480631689f08deb016481601745e7d9c0c28bd762bd1acfcf83f7b7c993ee9f24159352b8826db8a7f08f6bdcfcfa219743cc1f68f8ace63201137f499dd6a2899e4298c30baaa3ebdf50d036f6df5105dc1ccf2e169fdd2c3a879056ce049ff89b4cd4d21913a2cc8bee2bd0f4b07b0edf1421c8d07d6b44957a31b8f6f6114161fc7011cc1fa6c4ab3d59682c287c7828dd1a199376fef0759d182053b9d0a728869d245380c3a71c443ea381f488f3f304eceb730c18cd8c704251be9cf9d83a291b3754098c4f3fa95ba6c89e72a2e1e8a909ac679da7dac16420330d1bb948d6b7f9820de829315cc5a9c009b6c5091c3bf8a328c65a8afc405efc3753d0d30a53cbb40d910c17a3802b765e7771a34ed9025dba30307a44b16d1b2771ff11396eac41bbb335e5cea35ef5966b2f98cbd08356ad39aa233fdeeefb1e4ebb71c2cea64e075be8d61b8e8f92182fcfeb76586f6d84f22d3ac5b34e6dd12916dd515409be699205d81ee090aa8f262a53e6bba349b52959005b179c58b1d89b0b3d346f8525d53df017a260c8ce2e37045f3c1728db0f32f8a2e9121d1b8c292a0c1498988809b482aafdc42fa46f36db97ffcff49020cc283599f0d9739a3e391ac0a1f1e7f2e074d5b81bfbf1c9e71633bf0a58c1e082395fadc888ede8882e63356ca6cecf0a1a6e684be9f4b06e32daeb628940821bdaf114103ce9a7ef6e6739bffb834e95f342c2a5bc6969b0ce094398ec53ef9353a82561cbc0558d1023b3252eda678f1a218aa797929966fa632610355b9c9ab9aa6749f64e6a601ae81f88dcb3959ccb68b50f1af7f5fc320bb1c7389247a17e0e15bcdd120cb022f1f058fd488656aeaadd093647a1eb92b4b411148e3915fd8fd8848f49a34bcdb6af4e11025d29e87c3804868a492c572aa62d0c6b67d6517f5140376b57cc799d1237b1dcb6de93d8d9eff17e216845e92a3b3865a4443c12f1bbd8bf9d0a73b06a08d3975cacba44168ea1547279426ae3911f6d2c886ab68ebf021d432bd396558b29ff968bcf92b7c9e0f5660165487cd8d3a5cf3497229ebc05baabe8e4d00f3ef34ce7ae5009a49604b5edaae45b42accc1450db1635a47142a641a3d9d94097a268931f4caf4eedf03e634765b93d5f8ccc7232408e41cda4b34bd24da26cb82e1d84cdf78f442743ad13738c56e0c2b1a31e10891bb7b1467ec8c8f685c765d4d99e5f450e398c1b5483affefbf45e032d78f0ab5007e820b846b315016105ccd7c42ee4a0eede2aea794c079e3a05eb4abc7059c76b2322d545baff15d0e43468543df1d00ef358672b3342d20c8fbcb3f9f1a4471747b11a84feb999f2e894ca7b8c531cb3ac4b0ee9f0e13f63b3be0cf06d07d1e06f3089ef7db686da68c6e49b2ca00d17578d3044478b0fad7e5629328f3ea8b4c4e57d1e801d79d10550ed5a41ef94f6be6064e17770e49003df14191fd3fa0a8e09aee426b5a4fd3484bef4d5a0de5190730c9d67d798e3995982fadc6eea67c7dbd8c691aa9b25d42e4bc68c90a8da2bb265118ebd2904e5f8a0395fcf0b9f8110fb8c81dab606dc56003911635bc1742aa02f96d23a1eb3c9b46cf2076a60055c60d1a3c3a21123286abc932225f7af8aba1f31264b21966159727dc94bead51c955a9434272716c980d777e91ec6862b28c177c6a0ed09867c09d24c078cdc0555275e35432af9c8431a989c81504d9f630627b37dab1766cde0690c3ba132e5fe5aa7a7907d74b61b36d8e93fd666f979b636a85ca3d6d42ecaec9c014d5eb2d4fccde4ad476f5b1d07c6580898a64306d5547947a5197b05218654e150df7dfd7f6537daed73ab2bc0c363ea78bbd27c283691a9461ca1b1375f8c3f8d53bdc62860fe2d140d98e01eba7f26b458bd41ea2bea2773f979ed806dbf2f64dfe66e4e065ecc680832e05e896963a1a4370e9670dd1d62d2e0a6db5f5707dd041a7c44096022d1c12c5cd3b99146586033bfb8376cf101adefaa9d0d1163f39c52d69c6cd382f34fb3e6276a0d1d733e823008d6eb14f9d8b9e7a1608390d00cf4e3e1c80d9e16b1d324db5ed0859398209905165a39912e274143b5f8a47970f5d6262b29147367ef2aecc509fb19cc2d6f3a6235e19668cf628b80904453093c3f34b55c7940e84f286ccccc9af4a5c5ee183f9fe12d0413450eac1d7f5059c0d8059eee6c2049d3e68184a3088d9bde57fe60949b8eab809b98d8954459a945b1f9debd6c020d014cddd76ca3870a93f21db3709bab7a26cb7f5d6323fb99d5dbc1f7a5bb3cc4d6d42f6ff2b5edc534c7e5ceeaeec0471c4bf0227373e1bb432b355c25da51e781e57c8c2da8a84000a7d42ba243cc2b4417393294090e34490a5162d282d52fe9b6373da5eb9fb5f174554985e868fbffed45e6759c9e942a1eb1d39ce1f14fe8f2f904bc4504fabd247ac3f22c41d0664016d2b9408ae008f23cc8c87b5cc998d3d465ebf044043b15174c665abad4c151a8a610f4c0265177f36e996d085fe9a6ea64af66ca7e220db70b663972c75458fab8c449770a0aed4c5d82cadaf5472dedab3d6dccefbcc6ffb90c99739717c45f9db0443b738a290f95f1020044b6b77472087bbb53230bf8923b6142e63bcc3969d8b9f249ef90bff250b7fb06973e91c755fbda3ea0ab303b3f5ad4b7d9f85a744143855bc2a42d1da9d8526b72ed1f541cfc2fc4376b51c6f57bf6f3a8c93508bbab0c56163918c258c641551b62c1a8695861cb7633263b8a467c5f0d6a13f66d1abb76144f8ab405fdf0abdc4e76af5a1730c5a2c08f9ee0ffb4d1f6b452400c89592f77013deae6d3ed7e3d3a09a81901a0beafc139a9c9ca194c7425d0f5c9df9ca6dad771facf699a6ecae8cba5c3943342665a5ede838335c2378b077e057f73cf6213c5b4a97cfb55ec3fa7db3e67e197a30003a68713f8f2468ae3e65fa6eec2c5d2f228cd8ff152c204996988da1068d2c49b4587977adfb7323814b66b74f78267b1551b7c59921ea888f604dd5fc837f7d05fe38dbc1e5ba5eaaf46b6459b06a63a1e976f94a89e5b8d0d7cdedf63b3b114c1b93873d2f70bb5b4a876a57576214a1f330778f83076a091ac32b5904823fc895e043078208ab034dc54f23797482acbf6c71b53232cda06ac4aeff03dfa0e7592d6350cf7cc70fa133bc283e0d81cb56932e746b773407ff8a4d959d74b2cd03eb30f2185667cada12735f9c901240c2caeea02f2ab5386d169859e2b301107d338659a5c00df314252386d51182debc074d32ec5308fc3b30a7a30e3ece7c7d0fb5d51a5f302611bb957ea99efd8cc11e3ed81d62ae0dfd6a3bb29d7dd2f68737864c2a47ababa6e48f061d0c63324a28fe7547691a6e78b80e9a6f53973179e8e43adeb19515d3f7be76aa57455531ace82f34c4951181d03960262065f46b81af6bc6cfdf94d51b842699cb35705d3b97d2a8a7b7dbe2053c9d8717ec3858075edb4c479e0894bae8c952108264d31590ad7a6b2521620b69392d2c7736a26cb7ee55b8d911b5a2196b2a46b07a84df531a7fa07209de642fff9ff42af12215036800ffc7bfc2af4faff92f00d759680181a94571ed5f602e2bc2cef3cbe42a8fdf76d1691c0a19cdfa9dda5f42705d3d431d8c2a029487327db2de0a71edb8556c9d317708c5d0c39e13211d7de9bbe698a9bafab2b62cc77f7abc38992963b3051b7b710baaf634a85f159c7eed20de72fab60107e4e919b56cc3fa4b6a7e8422eef8e0fac66ff405bbabaee1c9489e42fed92e48fb521138a6aa91aec6703c0c98e202fa0cefbc65be5642f2cc6a96dc8b1065772176211153e2808de9d4e99346cc2803429a54b5c3022c3def1da17fc5d5d6fe556ab66b49cf15809dafd67567d816198cc76419a391ce61ad9cb741d40d88b1dea39955a73b93cc0d0b1d838a3afbbc9049bb8762b3961d219aa587706a09e283ed09543138f796b89d7083895448beb3af84a89f457bb23755dfc211"}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) read$FUSE(r6, &(0x7f0000001040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r5, &(0x7f0000003080)={0x18, 0xfffffffffffffff5, r7, {0x1}}, 0x18) write$P9_RGETLOCK(r6, &(0x7f0000000040)=ANY=[], 0xffffff6a) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r8, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000002, 0x206031, 0xffffffffffffffff, 0x18a41000) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r10 = accept4$alg(r9, 0x0, 0x0, 0x0) read$alg(r10, &(0x7f0000002300)=""/4128, 0x1020) sendmmsg$alg(r10, &(0x7f0000001080)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24018000}], 0x1, 0x404c0d1) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r5, r11, 0xfffffffffffffc01, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) r12 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000030c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0xff, 0x925, 0x8888, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x30, 0x3, "", [{{0x9, 0x4, 0x0, 0x81, 0x2, 0x3, 0x1, 0x2, 0x1, {0x9, 0x21, 0x708d, 0x7f, 0x1, {0x22, 0x97d}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x9, 0xb, 0x54}}, [{{0x9, 0x5, 0x2, 0x3, 0x10, 0x8, 0x2, 0x3}}]}}}]}}]}}, &(0x7f0000003240)={0xa, &(0x7f0000003100)={0xa, 0x6, 0x250, 0xff, 0xc1, 0xd0, 0xff, 0x9}, 0x92, &(0x7f0000003140)={0x5, 0xf, 0x92, 0x2, [@generic={0x8a, 0x10, 0xb, "4787e09e7cb79698142a659b41ab54d861baab5f9e6efce175b56dd0b0d4cb44ab59d05ac4b993ea15a3c51a15d98500c1f88cb0bc451dee00f73627fd27a2f8d53b6aa131c61b015c0221ae1493169e94711ff0cb19f26640ecabc184ae35ec044532c00d9291efe852bce966c6905f4d5b21478600e58562b4004f921073514d90d2d3a059ab"}, @ptm_cap={0x3}]}, 0x1, [{0x4, &(0x7f0000003200)=@lang_id={0x4, 0x3, 0x44e}}]}) syz_usb_control_io$hid(r12, &(0x7f0000003400)={0x24, &(0x7f0000003280)={0x40, 0x30, 0x6a, {0x6a, 0x9, "1bbd170b12b138ca3e9accbc617d8827f3f700d0f8a133248ba7a84f6eb5f534f4919c01efc85410085a2e3559c256a020c761d986d468847625a0058ade0217966e06e21b5e32b23cb2ab4188df224a31db869f4326e9f6244905fdd5b64ed841062e9ae88197dc"}}, &(0x7f0000003300)={0x0, 0x3, 0x4a, @string={0x4a, 0x3, "a9b99f4d00b8d82ea5d701799305cec9f64d7bed5b3496655b7f9647750107ccd12a00d3f3c6aa78b414ffa6d55e26c3b843fe6eea6419e298e16f0c343b8cba7a1f0143fde61aed"}}, &(0x7f0000003380)={0x0, 0x22, 0x11, {[@local=@item_4={0x3, 0x2, 0x9, "598d458e"}, @main=@item_012={0x1, 0x0, 0xe, "06"}, @local=@item_012={0x2, 0x2, 0x1, '\a '}, @local=@item_4={0x3, 0x2, 0x3, "b61c55a8"}, @local=@item_012={0x1, 0x2, 0x8, 'D'}]}}, &(0x7f00000033c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x8, 0x8, 0x1, {0x22, 0xaf3}}}}, &(0x7f0000003640)={0x2c, &(0x7f0000003440)={0x0, 0xd, 0x38, "f8493a455d35e6f0394a50bd9fd68ffddf4f24d788fc9397e5155c2ffefb54f38877497c95062d7644fbef29d74f7ab5622cbad8bf3301f4"}, &(0x7f0000003480)={0x0, 0xa, 0x1, 0x3}, &(0x7f00000034c0)={0x0, 0x8, 0x1}, &(0x7f0000003500)={0x20, 0x1, 0xbd, "9b38f992a0af725b006c62ebf6548023e18210c2ea095e69d17de4a08e725867f5912be7d90789283632c4dab59f701ed065065ad64c4a95b842236ced3bd58ce862f2ed9aaea11e06248691966689249c63d2839a4c86c4f1e9e987f2282005ece3fd650e646b558fb27a79b379bf1b3148803a08f1ddf994a0bc961959273465e3bd965b317e3ccf057f534ab839ec6638e66eb976ca9a8aa7ca9455b1c7c8b73123a4725973349cb05a383149fb06124552a6cbf816ce700d42b8a6"}, &(0x7f0000003600)={0x20, 0x3, 0x1, 0x7}}) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a300000000040000000160a01040000000000000000010000000900010073797a30000000000900020073797a300000000014000380080001400000000008000240000000002c000000030a01040000000000000000010000000900010073797a30000000000900030073797a300000000058000000060a01040000000000000000010000000900010073797a30000000000900020073797a30000000002c0004802800018011000100666c6f775f6f66666c6f6164000000001000028009000100"], 0x10c}}, 0x4004) 7m39.16992467s ago: executing program 3 (id=161): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000440)={0x7, @output={0x0, 0x0, {0x918, 0x7f}, 0x2, 0xffffffff}}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x158, 0x18c, 0x203, 0x158, 0x19030000, 0x248, 0x2e0, 0x2e0, 0x248, 0x2e0, 0x7fffffe, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0x0, 0x0, 0xff, 0xff], [0xffffff00, 0xff000000, 0xff000000, 0xff000000], 'bond_slave_1\x00', 'bond0\x00', {}, {}, 0x84, 0x7, 0x2, 0x55}, 0x300, 0x110, 0x158, 0x0, {0x1000000}, [@common=@unspec=@physdev={{0x68}, {'ip_vti0\x00', {}, 'veth0_macvtap\x00', {}, 0x1c, 0x11}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x5, 'syz0\x00', {0x8}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x5, 'syz0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x378) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x8801, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x800000000000000, 0x0, 0x0, 0x800, 0x0, 0x8}, 0x0, &(0x7f0000000080)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6a9, 0x3ac8}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) write$dsp(r2, &(0x7f0000002000)='`', 0x88020) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r5 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3, 0x0, 0x0, 0x2}, 0x30, 0x0) landlock_restrict_self(r5, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000140)='./file0\x00', 0x2000056f) inotify_add_watch(r6, &(0x7f00000001c0)='./file0\x00', 0x90000844) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = syz_io_uring_setup(0xd3a, &(0x7f0000000380)={0x0, 0x2, 0x3010, 0x3, 0x3}, &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000180)) ppoll(&(0x7f0000000240)=[{r8, 0x80}, {0xffffffffffffffff, 0x2442}, {0xffffffffffffffff, 0x400}, {0xffffffffffffffff, 0x4602}, {0xffffffffffffffff, 0x8}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x388}, {r8}, {0xffffffffffffffff, 0x20}], 0x2000000000000095, 0x0, 0x0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x1) sendmsg$NFT_BATCH(r7, 0x0, 0x0) 7m23.964030825s ago: executing program 32 (id=161): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000440)={0x7, @output={0x0, 0x0, {0x918, 0x7f}, 0x2, 0xffffffff}}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x158, 0x18c, 0x203, 0x158, 0x19030000, 0x248, 0x2e0, 0x2e0, 0x248, 0x2e0, 0x7fffffe, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0x0, 0x0, 0xff, 0xff], [0xffffff00, 0xff000000, 0xff000000, 0xff000000], 'bond_slave_1\x00', 'bond0\x00', {}, {}, 0x84, 0x7, 0x2, 0x55}, 0x300, 0x110, 0x158, 0x0, {0x1000000}, [@common=@unspec=@physdev={{0x68}, {'ip_vti0\x00', {}, 'veth0_macvtap\x00', {}, 0x1c, 0x11}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x5, 'syz0\x00', {0x8}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x5, 'syz0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x378) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x8801, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x800000000000000, 0x0, 0x0, 0x800, 0x0, 0x8}, 0x0, &(0x7f0000000080)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6a9, 0x3ac8}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) write$dsp(r2, &(0x7f0000002000)='`', 0x88020) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r5 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3, 0x0, 0x0, 0x2}, 0x30, 0x0) landlock_restrict_self(r5, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r6 = inotify_init() inotify_add_watch(r6, &(0x7f0000000140)='./file0\x00', 0x2000056f) inotify_add_watch(r6, &(0x7f00000001c0)='./file0\x00', 0x90000844) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = syz_io_uring_setup(0xd3a, &(0x7f0000000380)={0x0, 0x2, 0x3010, 0x3, 0x3}, &(0x7f0000000140), &(0x7f0000000040), &(0x7f0000000180)) ppoll(&(0x7f0000000240)=[{r8, 0x80}, {0xffffffffffffffff, 0x2442}, {0xffffffffffffffff, 0x400}, {0xffffffffffffffff, 0x4602}, {0xffffffffffffffff, 0x8}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x388}, {r8}, {0xffffffffffffffff, 0x20}], 0x2000000000000095, 0x0, 0x0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x1) sendmsg$NFT_BATCH(r7, 0x0, 0x0) 4m44.385100856s ago: executing program 0 (id=1027): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x5, 0x6576, 0x109}) socket$netlink(0x10, 0x3, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x406, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x43c, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0x5, 0x4, 0x46, 0xf1, 0xa, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0xb, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0xe], [0x2, 0xfffffdfe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x43, 0xc, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd1, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0xffffffff, 0x100, 0x2, 0x7, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x80, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0x8, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x4, 0xf, 0xe, 0x408, 0x274, 0x3, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x1]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) (async) socket$xdp(0x2c, 0x3, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0x80, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x3c, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x966}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_TUPLE={0x30, 0x2, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x7}}}}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x4}, 0x80) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) r9 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r9, 0xc008561c, &(0x7f0000000300)={0xf0f02b, 0x1}) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000380), r10) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)={0x54, r11, 0x111, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0xd5, 0xb, 0x9}, {0x6, 0x16, 0xfffa}, {0x5, 0x12, 0x1}}]}, 0x54}, 0x1, 0x0, 0x0, 0x804}, 0x20000) (async) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r5, 0x6628) mmap(&(0x7f00003e9000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x101000000) 4m44.124171911s ago: executing program 0 (id=1028): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x87, 0x7ffc0201}]}) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x2}, 0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r2 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f00000000c0), &(0x7f00000001c0)=0x30) dup2(r0, 0xffffffffffffffff) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES64=r1, @ANYRESHEX=r3], 0x48) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e22, 0xc2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7}]}, &(0x7f0000000440)=0x10) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xc) setsockopt$inet_sctp6_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000100)={r5, 0xc, 0xffffffff}, 0x10) inotify_add_watch(0xffffffffffffffff, 0x0, 0x8) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0) 4m43.916805061s ago: executing program 0 (id=1029): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000880), 0xfffffffffffffffc, 0x4880) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r0, 0xc0984124, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) socket$netlink(0x10, 0x3, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0x8841, 0x0) sendmsg$inet(r1, &(0x7f0000000840)={&(0x7f00000001c0)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000700)=[{&(0x7f00000002c0)="5dcb2b576c3495f5e3c2610909f05a5ce7f95cb1468eb201d9f8b31a26684d759aa2aaa837c818f009936305a093ba287067e01155be92f1d451be33b231dcbfd7619682b80de10f5a662f10e048d7393b596123d77d3803ee555c7e2ca6db15eda53ad495771dc12e50fc30b61e5ff26745436a9d7bd40c1ad62372f3f7fc8d0741a7ff5ab2951a8d9872d60dae8ba1653c196669", 0x95}, {&(0x7f0000000380)="ffe1968f3500554e7cc45d656b89b1ba110405c458239cfef1c04186c1909c69feb93071ceeb4072185b202c49a62d669e81df42545a2d7c237763fc3360f3ce0e8a561bc7a2badbd5f31d86f2757148acad5de398a51c26f179f96ed38af880145b927ea416c5c7824f639dd801f56f2f5688206250f93d3ca36e88324a5a811e65d3da71c7ca8660591fe567c179", 0x8f}, {&(0x7f0000000440)="b4365a4316a056d454a8014755af092a55efd9c5b17d313452f9d4fda22859678ef79a7f694c375956ec9ee1b28fa36b95a86ea909c76881b9710fb2026b8ae5462bacbed2774abcdf34e54def4958d4cbbeff45df8f226038cd87cf83079663cc19c7f867d99aad1a44bb385dcf137017039d05187044fefde9c823503b25", 0x7f}, {&(0x7f00000004c0)="6b07975d144a3a99cd985d3e87fd108c424c7346c44f5747cc983e3419f8693b49f87aa54f7b89cca135556678a23a965b2aee22f36ea3ec0d00367684c09a606564046002bfc32629d718269bd2ddb733bb915bf40f91d0f0111589250674fbb865ad3f1bc44157fcd6e7601c7dca40ca479eff7d4ebc8bd9260db35ad50540f7", 0x81}, {&(0x7f0000000580)="20b12551e503bf80c864cf9075644aedcc98063a0ca2a8a8f5c097e40e656905f770a717544342298b19eb00652b15c71862b0c22033d7965104749f98c805f0c1c5320000c2b3dc633dff6c93f9346c1af46417fdfe3ef8dcbcd96b52b96d4ff703728e8c1ac1575954967e4ba3b73e3b312fd3529d48b7364381f74b753f53caa522d46701263f90814c5d28461c84034f1fcf10eb5a8b8f832ec6aaa23fda8b08baf5c3a1a4590a3d6b5c33468581e7f77ae47f3750e2ffea784745e7cc545f0cd50d553b9035", 0xc8}, {&(0x7f0000000680)="cf61bab2802560252eafda91292aa09736dacfba831c359652608c7b1343557743e6f9d7c69b3bf08bfd293c86e2fbbf1f9bf8c4c276e04befebcdf41c3eb0f1cce2b287c0bc3e3817c7574c6b2d2548", 0x50}], 0x6, &(0x7f0000000780)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@ssrr={0x89, 0xb, 0xf1, [@local, @private=0xa010101]}]}}}, @ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_ttl={{0x14, 0x0, 0x2, 0x5}}], 0x98}, 0x4000800) r2 = socket(0x1e, 0x4, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) add_key(&(0x7f0000000000)='pkcs7_test\x00', 0x0, &(0x7f0000000100)="3081bb06092a864886f70d010702a081ad3081aa020101311b300a06082a811ccf55018311300d06096086480165030402010500300b06092a864886f70d010701317b303a0201013014300f310d300b0603550403130454657374020101300a06082a811ccf55018311300d06092a864886f70d0101010500040401020304303d0201013014300f310d300b0603550403130454657374020102300d06096086480165030402010500300d06092a864886f70d0101010500040401020304", 0xbe, 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = getpgid(0x0) syz_pidfd_open(r5, 0x0) fcntl$lock(r2, 0x25, &(0x7f0000000080)={0x2, 0x3, 0x9, 0x8000000000000001, r5}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x5c, r7, 0x917, 0x0, 0x1000000, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @remote}}, @L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback={0xfff5}}]}, 0x5c}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002211c0000001f000000060001000700000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x20000811}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) syz_open_dev$sndpcmc(&(0x7f0000000880), 0xfffffffffffffffc, 0x4880) (async) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r0, 0xc0984124, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socket$netlink(0x10, 0x3, 0x0) (async) openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0x8841, 0x0) (async) sendmsg$inet(r1, &(0x7f0000000840)={&(0x7f00000001c0)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000700)=[{&(0x7f00000002c0)="5dcb2b576c3495f5e3c2610909f05a5ce7f95cb1468eb201d9f8b31a26684d759aa2aaa837c818f009936305a093ba287067e01155be92f1d451be33b231dcbfd7619682b80de10f5a662f10e048d7393b596123d77d3803ee555c7e2ca6db15eda53ad495771dc12e50fc30b61e5ff26745436a9d7bd40c1ad62372f3f7fc8d0741a7ff5ab2951a8d9872d60dae8ba1653c196669", 0x95}, {&(0x7f0000000380)="ffe1968f3500554e7cc45d656b89b1ba110405c458239cfef1c04186c1909c69feb93071ceeb4072185b202c49a62d669e81df42545a2d7c237763fc3360f3ce0e8a561bc7a2badbd5f31d86f2757148acad5de398a51c26f179f96ed38af880145b927ea416c5c7824f639dd801f56f2f5688206250f93d3ca36e88324a5a811e65d3da71c7ca8660591fe567c179", 0x8f}, {&(0x7f0000000440)="b4365a4316a056d454a8014755af092a55efd9c5b17d313452f9d4fda22859678ef79a7f694c375956ec9ee1b28fa36b95a86ea909c76881b9710fb2026b8ae5462bacbed2774abcdf34e54def4958d4cbbeff45df8f226038cd87cf83079663cc19c7f867d99aad1a44bb385dcf137017039d05187044fefde9c823503b25", 0x7f}, {&(0x7f00000004c0)="6b07975d144a3a99cd985d3e87fd108c424c7346c44f5747cc983e3419f8693b49f87aa54f7b89cca135556678a23a965b2aee22f36ea3ec0d00367684c09a606564046002bfc32629d718269bd2ddb733bb915bf40f91d0f0111589250674fbb865ad3f1bc44157fcd6e7601c7dca40ca479eff7d4ebc8bd9260db35ad50540f7", 0x81}, {&(0x7f0000000580)="20b12551e503bf80c864cf9075644aedcc98063a0ca2a8a8f5c097e40e656905f770a717544342298b19eb00652b15c71862b0c22033d7965104749f98c805f0c1c5320000c2b3dc633dff6c93f9346c1af46417fdfe3ef8dcbcd96b52b96d4ff703728e8c1ac1575954967e4ba3b73e3b312fd3529d48b7364381f74b753f53caa522d46701263f90814c5d28461c84034f1fcf10eb5a8b8f832ec6aaa23fda8b08baf5c3a1a4590a3d6b5c33468581e7f77ae47f3750e2ffea784745e7cc545f0cd50d553b9035", 0xc8}, {&(0x7f0000000680)="cf61bab2802560252eafda91292aa09736dacfba831c359652608c7b1343557743e6f9d7c69b3bf08bfd293c86e2fbbf1f9bf8c4c276e04befebcdf41c3eb0f1cce2b287c0bc3e3817c7574c6b2d2548", 0x50}], 0x6, &(0x7f0000000780)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@ssrr={0x89, 0xb, 0xf1, [@local, @private=0xa010101]}]}}}, @ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_ttl={{0x14, 0x0, 0x2, 0x5}}], 0x98}, 0x4000800) (async) socket(0x1e, 0x4, 0x0) (async) epoll_create1(0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) (async) add_key(&(0x7f0000000000)='pkcs7_test\x00', 0x0, &(0x7f0000000100)="3081bb06092a864886f70d010702a081ad3081aa020101311b300a06082a811ccf55018311300d06096086480165030402010500300b06092a864886f70d010701317b303a0201013014300f310d300b0603550403130454657374020101300a06082a811ccf55018311300d06092a864886f70d0101010500040401020304303d0201013014300f310d300b0603550403130454657374020102300d06096086480165030402010500300d06092a864886f70d0101010500040401020304", 0xbe, 0xffffffffffffffff) (async) socket$nl_route(0x10, 0x3, 0x0) (async) getpgid(0x0) (async) syz_pidfd_open(r5, 0x0) (async) fcntl$lock(r2, 0x25, &(0x7f0000000080)={0x2, 0x3, 0x9, 0x8000000000000001, r5}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x5c, r7, 0x917, 0x0, 0x1000000, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @remote}}, @L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @loopback={0xfff5}}]}, 0x5c}}, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002211c0000001f000000060001000700000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x20000811}, 0x0) (async) 4m43.501248893s ago: executing program 0 (id=1033): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) read(0xffffffffffffffff, &(0x7f0000000140)=""/53, 0x35) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='loginuid\x00') r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000200)='./file0/file0\x00', 0x801) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000022c0)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000000100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000002240)={0x50, 0x0, r5, {0x7, 0x8, 0x11, 0x10043048, 0x10, 0x8, 0xaab, 0x6, 0xc00, 0x0, 0x20, 0x17989}}, 0x50) chown(&(0x7f0000002140)='./file1\x00', 0x0, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x1804420, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x10e) r7 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000a40)='./file0\x00', 0x2) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r7, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x1018}, './file0\x00'}) preadv(r2, &(0x7f0000000180)=[{&(0x7f0000000380)=""/44, 0x2c}], 0x1, 0x0, 0x0) writev(r2, &(0x7f00000003c0), 0x100000000000022d) 4m42.605273733s ago: executing program 0 (id=1041): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_clone(0x88206100, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) ptrace$ARCH_SET_CPUID(0x1e, r0, 0x0, 0x1012) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r1, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040), 0x183200, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000300c8"], 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x0) semctl$IPC_INFO(0x0, 0x1, 0x3, 0x0) r3 = socket(0x11, 0x3, 0x80300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) r5 = dup2(r3, r3) sendto$packet(r5, &(0x7f0000000080)="01154e0001001c1122d51d028cfb", 0xe, 0x404c094, &(0x7f0000000040)={0x11, 0x1c, r4, 0x0, 0x7, 0x0, @local}, 0x14) ioctl$FE_GET_PROPERTY(r5, 0x80106f53, &(0x7f0000000600)={0x38, &(0x7f0000000340)=[{0x13, '\x00', @data=0x6}, {0x43, '\x00', @data, 0x883d}, {0x42, '\x00', @st={0x4, [{0x3, @svalue=0xcec4}, {0x1, @svalue=0x3}, {0x2, @uvalue=0xc7d}, {0x2, @uvalue=0x1}]}, 0x9}, {0x33, '\x00', @data=0x5, 0x2}, {0xd, '\x00', @buffer={"127bd744ace478c8ac3156c6ea61b7de8461e6e091bedd4312883de7b6e77662", 0x20}, 0xc2b9}, {0x12, '\x00', @buffer={"f50c02d4ae7a5cd696d37c367f23a854df8befbb6e111847741836bc77654c64", 0x20}, 0x8}, {0x22, '\x00', @buffer={"c6f2be294b0b986a4e6fd584fc048e77da3e9d1ce6fc21bea44a12adc30a1523", 0x20}, 0x6}, {0x3b, '\x00', @data=0x3, 0xfff}, {0x3d, '\x00', @st={0x4, [{0x2, @svalue=0x5}, {0x2, @svalue=0x68b3363f}, {0x3, @uvalue=0x2}, {0x2, @uvalue=0x2}]}}]}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x840, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) unshare(0x22020600) socket$inet6(0xa, 0x2, 0x3a) r8 = eventfd(0x6) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000100)={r8, 0x4, 0x0, r6}) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000140)={r8, 0x5, 0x1}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="40000000420001000000000000000000030100000f0000001200010000112233445566778899aabb86dd00000400028010000380090011"], 0x40}}, 0x4000000) 4m42.432018935s ago: executing program 5 (id=1043): r0 = socket(0xa, 0x5, 0x0) listen(r0, 0x100) socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_connect$uac3(0x5, 0xb2, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000086307302040000102030109026e0003010ac007080b0002012430e50904000000010130000a2401060a0007000000090401000001023000090401010101"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000021c0)=[{{&(0x7f0000000240)=@file={0x1, './file1\x00'}, 0x6e, &(0x7f0000000700)=[{&(0x7f0000000780)="a3f56471f45ace7fef752f6ff96805bdc9277f1e6b1da822dd65084970cd4bfeda6ce5eb7f25e39c9aab227876b21f0411bca602fdd37025f6ad908c762774a790231416cb5f3e5b144359d8d8c38833b3ee496812ae1458f4a234d236284c3f547f0aa4e3c86b9a9e07d30aa18a0a6334bb08dcd524830949cc80e1fa1ea1d1793ab17636628e7030560948efe2f1a5f91e2d177f86651d147019d29a4c216d6d04d9a07181fba5fbe7db4da965b33ef72dde109c046c9f39eea26ec2f9fee8a2a961422ff844b628eb0e7befd179722f150fc7521ccdf53e4386a997ace4deb8599c459e3cb3a6ca60d70f66241a97c016ec2eb3bbed125b32cb78de4d5ab5be4ceb04253dcc86231aa95f94d6585197a213910cd1c26ef7000000000000", 0x11f}, {&(0x7f0000000500)="94c1e2595d5a4351827a8e184b22034f6ec07f544c37c8fd42d44b1f6cb6979cfc2f30469f5419f396cbd2a876eada60b1313d1c4e6d50acfcf77fd3ee2704f9c6d7f00ccdff228a81be08ef9737180fe1b8dda58e0204748585509510c7a6b48b4e176fefba6b2561cc201a56a6bc14a544c20580dd978d254e8453929b3fa85c5a59eaa6069cf27cf41acf9593f8ccd32d84c0cb87d29e0cc4810e1a04d9ab1f3ff167b701f01bd5fb14c286c51b86581ac4d1a83b89670dd1a83f8454af13cef6d20115dd43665020aad41cc952e1fbefffc7ac4eae2a9121bbe7fbf4e427b90cf3057a2e89b91b650d2cb2f9033cb2", 0xf1}, {&(0x7f0000000600)="8769e674549a3a", 0x7}, {&(0x7f0000000640)="3a7ef2d39631c62ead9bcef00588299cb929bb1c26cce472d2368d2f5e059dadfda47f14c03ffae52ff3a7f9dc0df29b73f17340e3779ef00cc7f07a9a527ec9254529d6412dcf18cd8f814bac0bd11b4c89069b741eded833ef05dd743aedfae3f8765d0d51054b9bc6ccc677f48a75389a0f5ace07e41f29", 0x79}, {&(0x7f0000000400)="63b405289869889624064c36b9d26e1d79775a1221c86687ec73be0b829c595fd03bbb9e5911e3ca3a4fe877ae3a5b753de22a99966e6012dfa2bc5ee1df19facfe19d3887957a11ebcffba618637ca2bd6372ea9f72574d5ba647c95292d0717b693799da67a4072cea355e455fb2f6e8c4015ebb399dbe77b673a470da437e5eb812eabd7a5845ac371a05df2429f69945a1f2f4cc5c6cc9bbc64b3b82d6a62a", 0xa1}], 0x5, &(0x7f00000008c0)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0x0, 0xee01}}}, @cred={{0x1c}}], 0x60, 0x4000000}}], 0x1, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0xfffffffffffffd9d, 0x80000001, 0xcb}, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_PROMISC(r3, 0x6b, 0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x14000, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x0) unshare(0x22020600) r5 = fsopen(&(0x7f0000000140)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x1) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x5800000d}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x387c02, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000940)={{0xa, 0x4e22, 0x9, @mcast1, 0x400}, {0xa, 0x4e21, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2}, 0x0, {[0x4, 0x81, 0x10001, 0x3ff, 0x80000000, 0x5, 0x935d, 0x4]}}, 0x5c) open(0x0, 0x60840, 0x0) fsopen(&(0x7f0000000000)='overlay\x00', 0x0) set_mempolicy(0x2, &(0x7f0000000080)=0x5, 0x1000000000007) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) io_setup(0x6, &(0x7f0000001380)) syz_open_procfs(0x0, &(0x7f0000000200)='fd/3\x00') 4m42.362562407s ago: executing program 0 (id=1045): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) unshare(0x22020600) r3 = io_uring_setup(0x1c6c, &(0x7f0000000040)={0x0, 0xaebb, 0xd000, 0x20000a, 0x20002f7}) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8088002, 0x2000007, 0x810, r3, 0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x400, 0x0) r4 = socket$pppoe(0x18, 0x1, 0x0) unshare(0x8000100) connect$pppoe(r4, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r4, 0x80047437, &(0x7f0000000040)) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r5, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r5, 0x4004743a, &(0x7f00000000c0)) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$TCXONC(r6, 0x540a, 0x2) ioctl$TIOCPKT(r6, 0x5420, &(0x7f0000000080)=0xd) r7 = syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0xfefffffe, 0x10, 0x3, 0x200003ca}, &(0x7f0000000580)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) io_uring_enter(r7, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) ioctl$TIOCSPTLCK(r6, 0x40045431, &(0x7f0000000000)) r11 = ioctl$TIOCGPTPEER(r6, 0x5441, 0x1) ioctl$TCXONC(r11, 0x540a, 0x2) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4c00000013000500010000000000000007000000", @ANYRES32=r2, @ANYBLOB="00000000000000002c001a000600000002000000200004801c000a800800010001000000090002"], 0x4c}}, 0x0) r12 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x12000, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r12, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'veth0_to_bond\x00', 0x2}, 0x18) 4m42.072946543s ago: executing program 33 (id=1045): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) unshare(0x22020600) r3 = io_uring_setup(0x1c6c, &(0x7f0000000040)={0x0, 0xaebb, 0xd000, 0x20000a, 0x20002f7}) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8088002, 0x2000007, 0x810, r3, 0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x400, 0x0) r4 = socket$pppoe(0x18, 0x1, 0x0) unshare(0x8000100) connect$pppoe(r4, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r4, 0x80047437, &(0x7f0000000040)) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r5, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r5, 0x4004743a, &(0x7f00000000c0)) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$TCXONC(r6, 0x540a, 0x2) ioctl$TIOCPKT(r6, 0x5420, &(0x7f0000000080)=0xd) r7 = syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0xfefffffe, 0x10, 0x3, 0x200003ca}, &(0x7f0000000580)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) io_uring_enter(r7, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) ioctl$TIOCSPTLCK(r6, 0x40045431, &(0x7f0000000000)) r11 = ioctl$TIOCGPTPEER(r6, 0x5441, 0x1) ioctl$TCXONC(r11, 0x540a, 0x2) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4c00000013000500010000000000000007000000", @ANYRES32=r2, @ANYBLOB="00000000000000002c001a000600000002000000200004801c000a800800010001000000090002"], 0x4c}}, 0x0) r12 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x12000, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r12, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'veth0_to_bond\x00', 0x2}, 0x18) 4m39.091746878s ago: executing program 5 (id=1061): r0 = socket$packet(0x11, 0x2, 0x300) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) getsockopt$packet_int(r0, 0x107, 0xb, 0x0, &(0x7f0000001540)) 4m38.72601443s ago: executing program 5 (id=1062): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) r1 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r1, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x10000, 0x0, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_disconnect(r2) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) 4m35.510498065s ago: executing program 5 (id=1069): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x8, 0x8}, 0x50) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x80000001}}, './file0\x00'}) read$FUSE(0xffffffffffffffff, &(0x7f0000000a40)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_WRITE(r1, &(0x7f0000002a80)={0x18, 0xffffffffffffffda, r2, {0x2}}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x59}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4m35.186774716s ago: executing program 5 (id=1072): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x9}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)={0x4c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x6, 0x0, 0x2}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_FAMILY={0x5}]}, 0x4c}}, 0x4000000) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x7000002, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x109) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0xfff) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000400), 0x35) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0xa000000, 0x800000, 0x9, 0x4c032, 0xffffffffffffffff, 0x0) syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') read$FUSE(r5, &(0x7f00000046c0)={0x2020}, 0x2071) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fremovexattr(r2, &(0x7f0000000100)=@random={'security.', ')\x00'}) creat(&(0x7f00000005c0)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) 4m34.116484638s ago: executing program 5 (id=1076): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) syz_usb_connect$printer(0x6, 0x2d, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, 0x0, 0x0) timer_create(0x1, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r6 = socket$nl_route(0x10, 0x3, 0x0) getpid() fstat(r6, 0x0) getgroups(0x1, &(0x7f00000005c0)=[0xee01]) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ffd, 0x0, 0x0, 0x0, 0x9}, [@btf_id={0x18, 0x9, 0x3, 0x0, 0x3}, @call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0xfffffffffffffdda) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r7, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 4m18.882446047s ago: executing program 34 (id=1076): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) syz_usb_connect$printer(0x6, 0x2d, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, 0x0, 0x0) timer_create(0x1, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r6 = socket$nl_route(0x10, 0x3, 0x0) getpid() fstat(r6, 0x0) getgroups(0x1, &(0x7f00000005c0)=[0xee01]) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ffd, 0x0, 0x0, 0x0, 0x9}, [@btf_id={0x18, 0x9, 0x3, 0x0, 0x3}, @call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0xfffffffffffffdda) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r7, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 3m1.250305469s ago: executing program 1 (id=1525): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) write$dsp(r0, &(0x7f00000000c0)="4612f9121c0e0ecb8fe35cb99c78d758f01405f9ea3e355591ab3a240ef910ef43077b618ce4a46eda00e67f31ad2c7e112a37be943970e850139959a9865a472119bb287a6fe9973f24fc1392a762e752317062cb21b45a92", 0x59) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000040)=0x10004) ioctl$SNDCTL_DSP_GETIPTR(r0, 0x800c5011, &(0x7f0000000080)) mmap(&(0x7f00003cf000/0x4000)=nil, 0x4000, 0x3000002, 0x12, r0, 0x5dba6000) (fail_nth: 9) 3m0.946359596s ago: executing program 1 (id=1527): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = dup3(r0, r0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x4, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f0000000540)={0x4, 0x0, 0x1, {0x2, @pix={0x7fff, 0xb, 0x384c4150, 0x2, 0x7, 0x9, 0xa, 0x5, 0x1, 0x2, 0x1, 0x5}}, 0x7}) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000000100)=0x90c3ff, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000000)=0x4533, 0x4) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{&(0x7f0000000080)={0xa, 0x0, 0x2, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) recvfrom(r3, 0x0, 0x0, 0x12000, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="df00cf00000000af6c419f18110000", @ANYRES8=r3, @ANYBLOB="0000000000000000b702000000000000850000008600000018190000", @ANYRES32=r1, @ANYBLOB="00000000000000001800000000000000000000003d07000085100000fcffffff85100000fbffffff850000005b00000018000000070000000000000005000000"], &(0x7f0000000400)='syzkaller\x00', 0xe, 0x0, 0x0, 0x40f00, 0x71, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000480)={0x2, 0x9, 0x2, 0x7}, 0x10, 0x0, 0x0, 0x3, 0x0, &(0x7f00000004c0)=[{0x1, 0x5, 0x2, 0xb}, {0x8, 0x4, 0x4, 0x3}, {0x4, 0x3, 0x2, 0xa}], 0x10, 0x400}, 0x94) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4c, 0x0, &(0x7f00000008c0)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000800)={@flat=@weak_binder={0x77622a85, 0x3, 0x3}, @fd={0x66642a85, 0x0, r2}, @flat=@weak_binder={0x77622a85, 0x1, 0x2}}, &(0x7f0000000880)={0x0, 0x18, 0x30}}, 0x2040}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000007c0)={0x4c, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2fc0}], 0x0, 0x0, 0x0}) r4 = open(&(0x7f0000000380)='./file1\x00', 0x1c1142, 0x80) ftruncate(r4, 0x136) sendfile(r4, r4, 0x0, 0x1000000201005) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1b, 0x4, 0x9, 0x1ff, 0x80081, r1, 0x200, '\x00', 0x0, r4, 0x2, 0x3, 0x2}, 0x50) syz_open_dev$ublk_chdev(&(0x7f0000000000), 0x0, 0x101200) r5 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x202) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r5, 0x5385, &(0x7f0000000000)={0x8d, ""/141}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) rt_sigprocmask(0x0, &(0x7f0000001480)={[0xffffffffffffffff]}, 0x0, 0x8) r6 = getpgrp(0x0) r7 = gettid() rt_tgsigqueueinfo(r6, r7, 0x1f, &(0x7f00000003c0)={0x26, 0x1, 0x10004}) rt_tgsigqueueinfo(r6, r7, 0x36, &(0x7f0000000180)={0xa, 0x8, 0x29b}) syz_open_dev$dri(&(0x7f0000000080), 0x7, 0x95432a676774dd1e) ppoll(0x0, 0x0, &(0x7f0000002d00), &(0x7f0000002d40)={[0x100000000]}, 0x8) 3m0.322636757s ago: executing program 1 (id=1529): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000140)=0x4, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x8040480) sendmsg$nl_route(r1, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x1000000}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000)=0xc, 0x4) 3m0.130111853s ago: executing program 1 (id=1533): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r1 = syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0x2d85, 0x40000, 0x0, 0x800000c3}, &(0x7f0000000580)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000f40)=0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x8a, &(0x7f0000000300)={@random="195df410dc24", @random="000600", @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "aac4e0", 0x54, 0x2c, 0x0, @dev, @local, {[@routing={0x2b}, @routing={0x4, 0x0, 0x2, 0x6}], {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0xff}}}}}}}}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r6) sendmsg$TIPC_NL_NET_SET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x30}}, 0x0) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f0000000940)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000900)={&(0x7f0000000980)={0x32c, r7, 0x804, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb0a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffab6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}]}, @TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x62}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_NODE={0x20, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xeceb}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}]}, @TIPC_NLA_SOCK={0xb8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x401}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7ff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x81}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xf}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffff7}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER={0x124, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x10}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @rand_addr=0x64010101}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x100, @mcast1, 0x6}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x7, @dev={0xfe, 0x80, '\x00', 0x21}, 0x1}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xffff0000, @mcast2, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'rose0\x00'}}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x874}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5764}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7a}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xea}]}]}, 0x32c}, 0x1, 0x0, 0x0, 0x10}, 0x4004880) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TLS_TX(r9, 0x11a, 0x1, &(0x7f0000000400)=@gcm_128={{0x303}, "77bc11a48a36d6d0", "f13137c50b1bb9cf9d3231f01e212120", "3cd1daf4", "099fbba4896f8d32"}, 0x28) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r5, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000824bd7001ffdbdf370000000000000000", @ANYRES32=r8, @ANYBLOB="0c0058004c000000000000000c00580040000000000000000c0058001f000000000000000c00580005000000000000000c00580049000000000000000c0058003a00000000000000"], 0x64}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x11, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f00000002c0)=0x0) timer_create(0x0, &(0x7f0000000380)={0x0, 0x3c, 0x1, @tid=r10}, &(0x7f00000003c0)) socket$tipc(0x1e, 0x2, 0x0) (async) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) (async) syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0x2d85, 0x40000, 0x0, 0x800000c3}, &(0x7f0000000580), &(0x7f0000000540), &(0x7f0000000f40)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_emit_ethernet(0x8a, &(0x7f0000000300)={@random="195df410dc24", @random="000600", @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "aac4e0", 0x54, 0x2c, 0x0, @dev, @local, {[@routing={0x2b}, @routing={0x4, 0x0, 0x2, 0x6}], {{}, {}, {}, {}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0xff}}}}}}}}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r6) (async) sendmsg$TIPC_NL_NET_SET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x30}}, 0x0) (async) sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f0000000940)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000900)={&(0x7f0000000980)={0x32c, r7, 0x804, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb0a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffab6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}]}, @TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x62}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_NODE={0x20, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xeceb}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}]}, @TIPC_NLA_SOCK={0xb8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}]}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x401}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7ff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x81}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xf}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffff7}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER={0x124, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x10}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @rand_addr=0x64010101}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x100, @mcast1, 0x6}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x7, @dev={0xfe, 0x80, '\x00', 0x21}, 0x1}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xffff0000, @mcast2, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'rose0\x00'}}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x874}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5764}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7a}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xea}]}]}, 0x32c}, 0x1, 0x0, 0x0, 0x10}, 0x4004880) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) setsockopt$inet6_tcp_TLS_TX(r9, 0x11a, 0x1, &(0x7f0000000400)=@gcm_128={{0x303}, "77bc11a48a36d6d0", "f13137c50b1bb9cf9d3231f01e212120", "3cd1daf4", "099fbba4896f8d32"}, 0x28) (async) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r5, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000824bd7001ffdbdf370000000000000000", @ANYRES32=r8, @ANYBLOB="0c0058004c000000000000000c00580040000000000000000c0058001f000000000000000c00580005000000000000000c00580049000000000000000c0058003a00000000000000"], 0x64}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) (async) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x11, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1}) (async) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) (async) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) (async) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) (async) ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f00000002c0)) (async) timer_create(0x0, &(0x7f0000000380)={0x0, 0x3c, 0x1, @tid=r10}, &(0x7f00000003c0)) (async) 2m59.477272066s ago: executing program 1 (id=1537): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x9}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)={0x4c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x6, 0x0, 0x2}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_FAMILY={0x5}]}, 0x4c}}, 0x4000000) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x7000002, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x109) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0xfff) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000400), 0x35) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0xa000000, 0x800000, 0x9, 0x4c032, 0xffffffffffffffff, 0x0) syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fremovexattr(r2, &(0x7f0000000100)=@random={'security.', ')\x00'}) 2m58.467644777s ago: executing program 1 (id=1541): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001200010a009d7e000000000080"], 0x26}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000440)={0x2, 0x0, [{0x1, 0x0, 0x6, 0x0, 0x0, 0x20}, {0x4a2a745b9e1d3bbd, 0x0, 0x2, 0x31237648, 0x0, 0x9}]}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) (async, rerun: 32) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) (async, rerun: 32) accept4$alg(r4, 0x0, 0x0, 0x0) fadvise64(r4, 0x5, 0x5, 0x0) (async) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000440)={0x2, 0x0, [{0x1, 0x20000000, 0x0, 0x0, 0x6, 0x20, 0x7}, {0xa, 0x0, 0x0, 0x31237646, 0x0, 0x9, 0x1}]}) (async, rerun: 64) recvfrom(r0, 0x0, 0x0, 0x12060, 0x0, 0x0) (rerun: 64) 2m43.371911037s ago: executing program 35 (id=1541): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001200010a009d7e000000000080"], 0x26}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000440)={0x2, 0x0, [{0x1, 0x0, 0x6, 0x0, 0x0, 0x20}, {0x4a2a745b9e1d3bbd, 0x0, 0x2, 0x31237648, 0x0, 0x9}]}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) (async, rerun: 32) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) (async, rerun: 32) accept4$alg(r4, 0x0, 0x0, 0x0) fadvise64(r4, 0x5, 0x5, 0x0) (async) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000440)={0x2, 0x0, [{0x1, 0x20000000, 0x0, 0x0, 0x6, 0x20, 0x7}, {0xa, 0x0, 0x0, 0x31237646, 0x0, 0x9, 0x1}]}) (async, rerun: 64) recvfrom(r0, 0x0, 0x0, 0x12060, 0x0, 0x0) (rerun: 64) 5.442683419s ago: executing program 8 (id=2410): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001500010000000000000000000b000000080002000a", @ANYRESOCT], 0x1c}, 0x1, 0x0, 0x0, 0x20004040}, 0x20000080) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) write(r1, &(0x7f0000000000)='file read @tc/passwd 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}) io_uring_enter(r6, 0x1, 0x1, 0x1, 0x0, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x1e1201, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) r13 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r13, 0xc0205647, &(0x7f0000000100)={0xf030000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f910, 0x8000, '\x00', @ptr=0x4000000020001100}}) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {0x0, 0x8001}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000600)=@newtclass={0x24, 0x28, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {0x1, 0x8001}, {0x0, 0x8001}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000009c0)=@newtfilter={0x3c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {}, {0x0, 0x8001}, {0x3, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x10, 0x5}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x0) memfd_secret(0x0) 5.330603613s ago: executing program 7 (id=2411): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), 0xffffffffffffffff) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) (async) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000000c0)) (async) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) r3 = dup2(r2, r2) (async) r4 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x1, 0x40055}, &(0x7f00000000c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) io_uring_enter(r4, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) (async) read$FUSE(r3, &(0x7f0000000440)={0x2020, 0x0, 0x0, 0x0}, 0x2020) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x1) sendmsg$nl_netfilter(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000028c0)={&(0x7f0000002480)={0x404, 0x9, 0x8, 0x801, 0x70bd25, 0x25dfdbfb, {0xa, 0x0, 0x7}, [@nested={0x269, 0x26, 0x0, 0x1, [@generic="a6dac75e13bf1895b2b12eef604dafd67d4a92e4fdfc51ee764c173233e94769c5cb247739feb9e02cf9cefc91a32b2e78bdea12b9f1ea8129d8c90b573e97932f92671c836a0eedc5eda1dbdfb0747027a3382ffef0c3beaa37241fbecbdc83996b97eebe098007fff8e9542990feec3861cc99f3bed287f1881e4078acee19eff020f55669b38f45a64212653de3d49a5a7f27d8ae3f2a1ad5d29bc06db995a7307aaa4690b20fb9ea1785", @typed={0x8, 0x14e, 0x0, 0x0, @str='/]!\x00'}, @generic="45fb69e6cc8f2d23f89cc6a057fca33d0f06986842fa610c48f80a468e2a81dadabfef9d740d8bc7422470b36f9ca463a2db9fc199f778b960ddf6b61545aa9e4444905410943c713db27d43f9aebb3a3ba4271c56c1f87dd5a978bdb21ef73430b3f56586f0209bc442eea9a4ee3ccfd525024a0d5dd7d9625bbca120f19a2d85c7e8212b7781afc3aa853ca35777b1c3ed72ea81da6f3d76cd2d25970ce531ad5fa9f58f1eea6bf1b0c44227cbc69100ce0cfcb5f89a7c46efa2f08ca3a3dad26467d75b5c6a9f3f9f8657b4dbb7099faa475a0e82af2c7fdea9629377d794", @typed={0xc, 0xae, 0x0, 0x0, @u64=0x403}, @nested={0x4, 0xae}, @generic="58df215747f0afd9dd2fac68cfd30fff3ae7886bf2e6072aa2cae381376781d3bada6a", @nested={0x4, 0x130}, @typed={0x8, 0x119, 0x0, 0x0, @uid=r8}, @generic="e08956c1c8397fc3e8098b312fca8de0261908df54305684ec22d5dfa34523fbad17610b939fcbe0d9eda547db5ad89f4d588e40b5367f30cc91e50f44ab4f399cb9bd233f2427898b0899fbbbec2a63f1dcd33830b1ed8708b22a22e8fb5b7ec491dcded688af371627fe40e0abf28bcfcb9ea0e126123a31025ce17724ccb39c70bf15f2f09a31a6bc0ac1c3c97cf74085"]}, @generic="b70da752563581cb1ccde7c6ba1d376e04d6bfaafd70267295113431e643a197a615a1ecca1ca68a55dab8de1271ce11783d47188c6d7452abe2394ce20f81e3ea19bfb669cce5b953d228ef8c4f829a517b0677c6fa9e8395b3280e8e96701c046ff2529840e142a52f57483810f74937396c5f99184aadfbc656e5efec321b8a886188d46dd994788e5b024161794f8e33b000607d1fe2eb4b8c6f975be1f0508d5d42ec3ffdb33f0ef185b86f965d2682a62bb9e2ef94caf1ca525fb161da06cf0147b7f627cf8a0e339530ae8696", @nested={0xb3, 0x156, 0x0, 0x1, [@generic="f226c0cbed7db081188d19d9fc77ba896ef6d3224d7ca5aa949bbe9b3796a2b444b7e25f6139758c6a6a2a06017ac069a5fddda5b43888e3e175125c05b0260fe73347fd8b708e71f57e92c7", @generic="89913a97a2448fa5ee0bf12d351449b1b16e97cff123d0960c1f9a05f0bbfc0f8f608c4dad368dfdc493e14eafc28c8fbc6a9cf2f86e9e3fa65b8f379b7f77c470edca326887079a777b81d852af2859683e3ae7124a8e45811a800bc690cd78572402"]}]}, 0x404}, 0x1, 0x0, 0x0, 0x10}, 0x24040002) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f00000007c0)=ANY=[@ANYBLOB='\"\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fddbdf2501000000180001801400020065727370616e30000000000000000000100002800c000180080001000c900548"], 0x3c}, 0x1, 0x0, 0x0, 0x44004}, 0x40) 4.512429954s ago: executing program 6 (id=2416): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) (async) close(r2) r3 = accept4(r0, 0x0, &(0x7f00000001c0), 0x800) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001600)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180)="0a646f829dbc88e728e3d40e1b36c0", 0xf, r3}, 0x68) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001600)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180)="0a646f829dbc88e728e3d40e1b36c0", 0xf, r3}, 0x68) sendmsg$nl_crypto(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000015c0)={&(0x7f00000014c0)=@get={0xe0, 0x13, 0x20, 0x70bd2d, 0x25dfdbfb, {{'drbg_nopr_ctr_aes128\x00'}, '\x00', '\x00', 0x6400, 0x2400}}, 0xe0}, 0x1, 0x0, 0x0, 0x20040400}, 0x40080) (async) sendmsg$nl_crypto(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000015c0)={&(0x7f00000014c0)=@get={0xe0, 0x13, 0x20, 0x70bd2d, 0x25dfdbfb, {{'drbg_nopr_ctr_aes128\x00'}, '\x00', '\x00', 0x6400, 0x2400}}, 0xe0}, 0x1, 0x0, 0x0, 0x20040400}, 0x40080) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)='=@', 0x2}], 0x1, 0x0) (async) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)='=@', 0x2}], 0x1, 0x0) preadv2(r4, &(0x7f0000001780)=[{&(0x7f0000001680)=""/112, 0x70}, {&(0x7f0000001700)=""/110, 0x6e}], 0x2, 0xa8f, 0x3, 0xa) recvmmsg(r4, &(0x7f0000001440)=[{{&(0x7f0000000280)=@un=@abs, 0x0, &(0x7f0000001400)=[{&(0x7f0000001480)=""/1}, {&(0x7f0000000300)=""/102}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/111}]}}], 0x700, 0x40002002, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xffc1) setsockopt$sock_int(r4, 0x1, 0xa, &(0x7f0000000100)=0x7, 0x4) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 4.38891323s ago: executing program 6 (id=2417): syz_open_dev$video(&(0x7f0000000080), 0x4, 0x64100) (async) syz_open_dev$video(&(0x7f0000000080), 0x4, 0x64100) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x30c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x9, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x1, 0x40, {0x9, 0x21, 0xc1, 0xfe, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x39, 0xc8, 0x4}}}}}]}}]}}, 0x0) (async) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x30c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x9, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x1, 0x40, {0x9, 0x21, 0xc1, 0xfe, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x39, 0xc8, 0x4}}}}}]}}]}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) r0 = gettid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x6, 0x2, 0x0, 0x7ffffffb}]}) rt_sigqueueinfo(r0, 0x21, &(0x7f0000000040)={0x0, 0x0, 0xfffffffb}) (async) rt_sigqueueinfo(r0, 0x21, &(0x7f0000000040)={0x0, 0x0, 0xfffffffb}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_clone3(&(0x7f0000002100)={0x1000000, 0x0, 0x0, 0x0, {0x1d}, 0x0, 0x0, 0x0, &(0x7f00000020c0)=[0x0], 0x1}, 0x58) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x13, r1, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x13, r1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) (async) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000000)={0x600, 0x100000}) syz_open_dev$vbi(0x0, 0x0, 0x2) r3 = socket(0x400000000010, 0x3, 0x0) socket(0x10, 0x803, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x129c81, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000000)=0x8) write$binfmt_aout(r5, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r5, 0x40045431, &(0x7f00000000c0)={0x0, 0x5, 0x400007f, 0xfffffffc, 0x5, "42341f9b1000007e4f00"}) splice(r5, 0x0, r4, 0x0, 0x7ffff000, 0x0) (async) splice(r5, 0x0, r4, 0x0, 0x7ffff000, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x403, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x4, 0x0, 0x0, 0x8002}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_PACKETS_PER_SLAVE={0x8, 0x14, 0xffffffff}, @IFLA_BOND_MODE={0x5, 0x1, 0x2}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24040090}, 0x4000844) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00'}) 4.338080491s ago: executing program 7 (id=2418): bpf$MAP_CREATE(0x0, 0x0, 0x8a) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r0 = syz_usb_connect$lan78xx(0x0, 0x0, 0x0, 0x0) io_pgetevents(0x0, 0x1, 0x1, &(0x7f0000000100)=[{}], 0x0, 0x0) io_submit(0x0, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5}]) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000180)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f00000001c0)={r1}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x8) fallocate(r2, 0x0, 0x1000000, 0x3) r3 = socket(0xa, 0x5, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000040)=0x8, 0x4) sendmsg$inet_sctp(r3, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e26, 0x200000ff, @loopback, 0x5}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000100)="a6", 0x1}], 0x1, &(0x7f0000000080)=[@dstaddrv6={0x20, 0x84, 0x8, @ipv4={'\x00', '\xff\xff', @local}}], 0x20, 0x4855}, 0x24000052) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x5c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x9}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x40}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x6}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x5c}}, 0x4000) ioctl$F2FS_IOC_COMPRESS_FILE(r2, 0xf518, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x200000c, 0x13, r2, 0x2000) r5 = openat$cgroup_ro(r2, &(0x7f0000000140)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) r6 = fanotify_init(0x200, 0x0) fanotify_mark(r6, 0x101, 0x1, r5, 0x0) io_uring_setup(0xf71, 0x0) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r7, 0xaf01, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$VHOST_SET_VRING_ERR(r7, 0x4008af22, &(0x7f00000002c0)={0x1}) sendmsg$NL80211_CMD_NOTIFY_RADAR(r2, 0x0, 0x1) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, 0x0, 0x4000100) close(0xffffffffffffffff) syz_usb_ep_write(r0, 0x1, 0x2f, &(0x7f0000000040)="a9eb9f56d1c79e2d80e74e208f329c705ad2460b0590f2932d30a2bdad0bb9371ac31b49ce92c7c8d2717b7beea1ae") 4.08462849s ago: executing program 8 (id=2419): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x45e, 0xf9, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x8, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x81, 0x10, 0x1, {0x22, 0x23}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x8, 0xc1}}}}}]}}]}}, 0x0) r1 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e20, 0xffffffff, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x1c) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e5b, 0x80000000, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x5}, 0x1c) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0105500, &(0x7f0000000140)={0x80, 0x6, 0x301, 0x3, 0x0, 0x951, 0x0}) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) syz_usb_connect$midi(0x0, 0x86, &(0x7f0000000680)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x41e, 0x3048, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x74, 0x1, 0x1, 0x10, 0x60, 0xfb, "", {{{0x9, 0x4, 0x0, 0x0, 0x3, 0x1, 0x3, 0x0, 0x51, [@midi_in_jack={0x6, 0x24, 0x2, 0x1, 0x6, 0x2}, @midi_in_jack={0x6, 0x24, 0x2, 0x1, 0x29, 0x11}, @midi_out_jack={0xf, 0x24, 0x3, 0x2, 0xf, 0x4, [{0x6, 0x6}, {0x0, 0x5}, {0x5d, 0xc0}, {0x2}], 0x1}, @midi_out_jack={0xb, 0x24, 0x3, 0x1, 0x5, 0x2, [{0xc, 0x2}, {0xd, 0x7}], 0x4}], [{{0x9, 0x5, 0x5, 0x0, 0x8, 0x5, 0x3, 0x8, {0x10, 0x25, 0x1, 0xc, "be43c91834d5bae5dd217894"}}}, {{0x9, 0x5, 0xc, 0x0, 0x40, 0x1, 0x5, 0x3, {0x9, 0x25, 0x1, 0x5, "1ff74c9350"}}}, {{0x9, 0x5, 0xe, 0x0, 0x200, 0x7, 0x5, 0x7f, {0x8, 0x25, 0x1, 0x4, "5402a6a0"}}}]}}}}}]}}, &(0x7f0000000900)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x110, 0x9, 0x7, 0x4, 0x8, 0x7}, 0x5f, &(0x7f0000000780)={0x5, 0xf, 0x5f, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x26d8e035e62d0390, 0x4, 0xf1, 0x4}, @ptm_cap={0x3}, @ss_cap={0x0, 0x10, 0x3, 0x2, 0x8, 0x3, 0x7, 0x2}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "11c5fa6c9125e4f6688d16914f934129"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x2, 0x2, 0x8, 0x5}, @ssp_cap={0x24, 0x10, 0xa, 0x7, 0x6, 0x6, 0xf, 0x1ff, [0x3f00, 0xf0, 0xffc000, 0xff000f, 0xff003f, 0x30]}]}, 0x3, [{0x38, &(0x7f0000000800)=@string={0x38, 0x3, "626be8aa2f6ab3b94c79a96f1af95f7ef8784cf6ff73e47b0eadd9c7aed8a3620124816155854e4912bedd20d7fb6cf71ec8b35f3ee0"}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x455}}, {0x59, &(0x7f0000000940)=@string={0x59, 0x3, "adbd6abddd0dd94bc176a11515e210de167db0a32f8818dc42bbdcdb7b6717657c1f9571f9b7ab3497f024ace26632dbfd229cdadc09d3af87e88c05f0e17b581772ec4faaecdb8aca99f0e82f99f5eec59a21bb1416852cf61a8358854cc577859179b78e197ed04cc0789d89e092c868ea56e17a72f65ed8de590d4d4806502a18686d432dcc44a615f1b5edcd7a4d"}}]}) syz_usb_control_io$hid(r0, 0x0, 0x0) r3 = syz_usb_connect(0x5, 0x4a, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109023800010000000009043200019740a400052406000105240000000d240f0109000000020009004e06241a00b51409058203ff"], 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xc, &(0x7f0000000200)={[{0x5, 0x4e00, "90aab6a3e3"}]}) syz_open_dev$ttys(0xc, 0x2, 0x1) syz_usb_connect$uac3(0x0, 0x130, &(0x7f0000000100)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x17cc, 0x1915, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x11e, 0x3, 0x1, 0x0, 0xe0, 0xe, {0x8, 0xb, 0x1, 0x2, 0x1, 0x0, 0x30, 0x9}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x9, 0x3d, 0x2}, [@power_domain={0xc, 0x24, 0x10, 0x3, 0xe33, 0x100, 0x4, "993bd5"}, @input_terminal={0x14, 0x24, 0x2, 0x4, 0x100, 0x5, 0x25, 0x40, 0x3, 0x3, 0x2, 0x1}, @output_terminal={0x13, 0x24, 0x3, 0x6, 0x300, 0x3, 0x1, 0x5, 0x8001, 0x0, 0x4, 0xff}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xfff3, 0x80, 0x1, 0x3}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0xff80, 0x5e, 0x8, "83e853cc097eae27fd"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xdf, 0x40, 0x9, 0x81}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0xe, 0x6, 0xd1, "1f68"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x2, 0x3, 0x2, 0x6e}]}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x7f, 0xf3, 0xa, {0xa, 0x25, 0x25, 0x4, 0x3, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x9, 0x2, 0x26, 0x7}, @as_header={0x17, 0x24, 0x1, 0x3, 0x40, 0xfffd, 0x1002, 0x85, 0x81, 0x3, 0x6}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xfffa, 0xfff8, 0x8, 0x1}, @as_header={0x17, 0x24, 0x1, 0x7, 0x0, 0x3, 0x5, 0xfd, 0x5, 0x78f5, 0xf0}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0xfe, 0x2, 0x1, {0xa, 0x25, 0x25, 0xad7, 0xf, 0x80}}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x200, 0x0, 0xf7, 0x0, 0x40, 0x5}, 0x11c, &(0x7f0000000280)={0x5, 0xf, 0x11c, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0x3, 0x1, 0x7}, @ptm_cap={0x3}, @generic={0xfa, 0x10, 0x3, "2b5528337b607d1ec009f53eca4bda8781ea232851c9bf7892cc6f645b457fa458262923db5b706bf7506747054d23aa2e1aa46bb367ba1ad6d5a4ef6bcb81ffea6e56b82bea320365a9b4c2a2ca7788d0258ae66756e67e607faf3f9a7192b10d3073b6800a779dbacdd01022e3e47a8973b954d7e1107c7373dafa021db3cfbbf7e22a1b8586163601aa9580ded83c3e925f2891b26e4a3fa7d4bda1666e0e57f9fe1ed22ed1f4cdcfb0ce136cf85c0b3c926292915f8e07b691cb85b8951fcc5e9af18ddfd91a138940f6e6b82b4bdeb9633da8ad5b316ca3075c938507c0c5664fdc4dd83581eac23658ed73687471d4b1599e7da7"}, @ptm_cap={0x3}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x4, 0x8, 0xfe00}]}, 0x4, [{0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x4c0a}}, {0xc2, &(0x7f0000000400)=@string={0xc2, 0x3, "64e8e1a6c9bfdbcb41769b8493a6b3b750c4360ad088f059027081fab983bbfd1051d05a9b4685dd9558c9d2c514119055d53bdf97ced99c3d1281b33e0ef7665e5734d2fc65b37ee83d7238c59b141e490bc562365fed98042abd31b89cc0574fb25a2c59d9d534cea5c0953ffba119f7892c404dbcc175d81861c04ac3668d0e442f51de46a477f98a56d15f0ea3a3bf168f30d69e425db1fc1701c13df432df0345a7501ce6b5015ff60649b038f11848f24600a8da60c8db9122718e9a4b"}}, {0xb1, &(0x7f0000000500)=@string={0xb1, 0x3, "7607c42c0cb9c30999401701b534aa4cae1778d8db5349ecfbf58a96256297cb62cf65b5df9e566bd1691ba14c8ac5f663ab096cd5989ca0b2d630cdde7dcf3af1c4d6172f9cf72070d8be72f531de7ceba66df848cd615d51df5e91f7f633603dd165a2831b0d5af0db7cb13ca7f88e16a703fb5562be108f5feb17d6bf5e08e9989814d0dff1189a54760bb67e5ef5d8c124eae08dda7fcae838c9772569cee9c7a7b2db006121246742573a21b1"}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x6bec32078684e048}}]}) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB=' \"('], 0x0, 0x0, 0x0, 0x0}, 0x0) 3.476525431s ago: executing program 2 (id=2421): r0 = memfd_create(&(0x7f0000003a40)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9a5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\\\xb0:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85l\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7y`~7\x16\x02\x00(v\xe6`\"6\xfcgC\xb5\xf0\x13.zj\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hR\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1exQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+\xa0\x1c\x14\x01\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1.E\b1\xcb\xa2\xbe}\xb2\xe4y\xbb\xe6\x1f\x10\x95y\x8e\xa6\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x82\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17d\xe3dSr\x13\xab\xdal\xdd\x18\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00x0}, 0xfffffffffffffc22) r3 = syz_open_procfs(r2, &(0x7f0000000040)='sessionid\x00') (async) r4 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r4, &(0x7f0000000000), 0x10) (async) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x800) ioctl$DRM_IOCTL_GEM_CLOSE(r5, 0x40086409, &(0x7f0000000180)) (async) syz_emit_ethernet(0x3e, &(0x7f0000000240)={@local, @link_local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0x8, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, {[@dstopts={0x32}]}}}}}, 0x0) (async, rerun: 32) r6 = socket$inet(0x2, 0x1, 0x0) (rerun: 32) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x130, 0x1c8, 0x260, 0x2f8, 0x98, 0x130, 0x1c8, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) r7 = socket$nl_route(0x10, 0x3, 0x0) (async) r8 = getpgrp(0x0) r9 = syz_pidfd_open(r8, 0x0) flistxattr(r9, 0x0, 0x28) (async) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0x10, 0x1, 'BATMAN_V'}]}}}]}, 0xfd12}}, 0x0) (async) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x730, 0x270, 0x190, 0x0, 0x190, 0x0, 0x660, 0x660, 0x660, 0x660, 0x660, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {}, 0x21}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}, @common=@inet=@dccp={{0x30}, {[0x4e24, 0x4e24], [0x4e23, 0x4e24], 0x20, 0x0, 0x4, 0x7}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@loopback, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @mcast2, @mcast2, @private0, @empty, @loopback, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x790) ioctl$USBDEVFS_FREE_STREAMS(r3, 0x8008551d, &(0x7f0000000200)={0x43ec}) (async) fcntl$getownex(r7, 0x10, &(0x7f0000000fc0)={0x0, 0x0}) syz_open_procfs(r11, &(0x7f0000001000)='pagemap\x00') (async) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000180)=[{{0x1, 0x0, 0x1}, {0x3, 0x1}}, {{0x4, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}}], 0x10) (async) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f00000006c0)={@dev, 0x0}, &(0x7f0000000700)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000f80)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)=@deltclass={0x38, 0x29, 0xa00, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r12, {0xa, 0xb}, {0x9, 0xc}, {0x2, 0x7}}, [@tclass_kind_options=@c_cake={0x9}, @TCA_RATE={0x6, 0x5, {0x1, 0x5}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x50) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, 0x0, 0x0) (async) syz_usb_connect$cdc_ecm(0x2, 0x5c, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000090000202505a1a440000000010109024a000101000000090400401702020000052406000005240000000d240f010000000006000000200624070407000905810340000000000905820210000000000905030240"], 0x0) (async, rerun: 32) renameat2(r3, &(0x7f00000000c0)='./cgroup\x00', r3, &(0x7f0000000080)='./cgroup/../file0\x00', 0x2) (async, rerun: 32) socket$can_j1939(0x1d, 0x2, 0x7) 3.337695171s ago: executing program 8 (id=2423): syz_open_dev$sndmidi(&(0x7f0000000000), 0x2, 0xa0000) r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x8d00, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000d88000/0x1000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00008f7000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1191, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xcb}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) sched_setattr(0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0) io_uring_setup(0x8, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e15"]) 3.156105637s ago: executing program 7 (id=2424): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b405000000fdff0071102300000000001ca00000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r2, &(0x7f00000002c0)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x11, 0x4, 0x800, 0xca6}, @mpls={[], @ipv6=@generic={0x1, 0x6, "11b712", 0x173, 0x11, 0xff, @local, @mcast2, {[@srh={0x1, 0x4, 0x4, 0x2, 0x7, 0x20, 0x2, [@loopback, @remote]}, @fragment={0x5c, 0x0, 0x3d, 0x1, 0x0, 0x8, 0x65}, @routing={0x0, 0x12, 0x1, 0x2b, 0x0, [@empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @local, @mcast1, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}]}, @routing={0x21, 0x14, 0x0, 0xe, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @local, @local, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x35}}, @local]}], "edac99"}}}}, 0x1a9) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(r5, &(0x7f0000000280)='memory.numa_stat\x00', 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000009c0)=ANY=[@ANYBLOB="300000003f0007012bbd700000000000017c0088dd76e2800c00018048010600800a00"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc020) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x1, 0x4, 0x5, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r7, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r8 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x34424752, 0x0, 0x0, 0x0, 0x0, 0x2, 0x779acd4f0ad4811f, 0x0, 0x2, 0x2}}) 2.903828369s ago: executing program 7 (id=2425): openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) write$dsp(r0, &(0x7f00000000c0)="4612f9121c0e", 0x6) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000040)=0x10004) ioctl$SNDCTL_DSP_GETIPTR(r0, 0x800c5011, &(0x7f0000000080)) 2.776740972s ago: executing program 2 (id=2426): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000007c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000780)={&(0x7f0000000c80)=ANY=[@ANYBLOB="0c020000", @ANYRES16=r1, @ANYBLOB="00002dbd7000fedbdf252e000000080003008a2f467a5252c696290f28cb7a3f77fb532f4292f3df6aca4cc43ba4dc6f3ff07b1ddd6885a7c5a0dd98a0561927f9a77dcd5eb567240e90e4f3af85b02907dd6f21a1e1e643814c817d90205b0aaa1e3d4b869b7ee61b1e636b2178e636978f69f401c6759dae23e83ebef29f6ecc22fb01debedb01f21a406d38ec56713c280e843b4d7696791c39902655b599f4a70a089bd5d7803a3e53ee577ab6548849300e8dd558cf323ac1c2cc2ca54ee5692bfab8e5fbd3e8de50cd3711e6a832cad24f9b4462dd1ef5067f6d3cb84d84732ac8f02c810ab534913ad3fd99911bf1400a0c5b369130", @ANYRES32=r2, @ANYBLOB="0a00c80008021100000000000a00060050505050505000001000e3800c00000006000300020400001100f900456f99021366e7704782ff81f90000005900fc006b14b547e2557677372b4f8f809871c7bfa3c9cbf89d292903dfec93e4d07066cead9c59c3b138ff87510921344799a3939e7e381684dd26cf6d802a67432ad5dc0c7a3bad427f45ea470d157d05490b052596908b0000000a00f9003200c6c0358300000301fc00c83580fe537977264e47c1570ada3a279f19ac9f9ab112ebd8db15209fb22e6f56f8dcfb378009083b2c92ea4822aff430bf280ad340aa4d73058452b487f4ba5aa3b45054680eeec14bdf03e30e9495894c9f07387b10b8166f681ff89ea8e3f62780c23c3257cc34f4484e022f6c0fa3dce369ad9a038bd3d824a1b8e5457c664ff19d84a6b919e5563d879398ded03a81efb1f3778792b140513eecfcf2772a3c96e29973d568c29e415997bfdcc5810c142168a298bf4e1d0838d149c7760a83cbb5c70b84ce98ccb477e44d87886955fb302d1420d4d7d68258eccca001477f2514fadc515018f00a00fac5f1e335abccde25b25d95c65a5c1870caa3001400fa00d370a551fdb6051c88c2df046ca111350a00f90071be9abe798e00000600fb00060000001400e3801000000004000100060003000b0200000a0006005050505050500000"], 0x20c}, 0x1, 0x0, 0x0, 0x10}, 0x41) socket$rds(0x15, 0x5, 0x0) syz_ublk_setup_io_uring(0x2261, &(0x7f0000000300)={0x0, 0xd58c, 0x80, 0x2, 0x30b}, 0x0, 0x0, 0x0) eventfd(0xe467) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r3, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r3, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1}) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0x3b5, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x400, 0x5, 0x255}, &(0x7f0000000a00)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x40000, 0x3, 0xff, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0xb2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x20000000, 0xe4, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x200, 0x1, 0x80000250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x20084884) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 2.755728038s ago: executing program 7 (id=2427): syz_usb_connect(0x3, 0x3f, &(0x7f0000000740)={{0x12, 0x1, 0x310, 0x78, 0xe8, 0x72, 0x20, 0x1f71, 0x3306, 0x2ac0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x1, 0x80, 0x5, "", [{{0x9, 0x4, 0xdf, 0x0, 0x0, 0x46, 0x35, 0x34, 0xf}}, {{0x9, 0x4, 0x19, 0x6, 0x1, 0xfb, 0xdc, 0x42, 0x0, [], [{{0x9, 0x5, 0x80, 0x10, 0x200, 0x6, 0x6, 0x4, [@generic={0x9, 0x4, "df9b52d017dc73"}]}}]}}]}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) syz_open_dev$sg(0x0, 0x8, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000300)={0x0, 0x0}) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) unshare(0x60000600) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004107f540f30c7593de1a000000010902"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x4008880}, 0x0) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_io_uring_setup(0x9b2, &(0x7f00000006c0)={0x0, 0x4e36, 0x8000, 0x1, 0x2fe}, &(0x7f0000000280), 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f0000f98000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000721000/0x4000)=nil) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r1, &(0x7f00000001c0), 0x0, 0x7, 0x10000) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x9, 0xfc, 0x3, 0xa9c}]}, 0x10) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f00005fe000/0x1000)=nil, 0x1000, &(0x7f0000000640)='\"P\x00\xc7\xc8\xea\xf0Q^\xc3*\xc4k0\xf0:I\x18W\x83]k\x06-\xda\xcb<=K\x89o\xc7\x05\xc5PP;\xc6\x96\n\x00\x00\x00\x00\x00\x00\x88B\xb9\b1\x85H\xc3N?\xb2\xde\x14.\xfeI\x81\x11\xb3/W\xc9d\x9c\xe2r\xa9\x820\xe4\x7f\xa3\x15\xa1\av\x88d\xa9:d\xfac\x1b\x00\x00\x00') munmap(&(0x7f0000a88000/0x1000)=nil, 0x1000) munmap(&(0x7f0000694000/0x3000)=nil, 0x3000) mremap(&(0x7f00007b2000/0x4000)=nil, 0x4000, 0x3000, 0x3, &(0x7f0000968000/0x3000)=nil) mremap(&(0x7f00003fd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000769000/0x1000)=nil) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x31, 0x0, &(0x7f0000006680)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="0000b1b0366aa318f9d3ffffffdbdf2500000400d43b0647690ea5a0edec9ec54831be80f5f80fccd7def5cde1bc1e23c75b202b7e4b6dfbea10b09f448a3c6190431fa3f98e2f196bbaf89b34d2f5ebfeeb4777e949821b456b1d1f0c69736e9a8a630fd733cefacbcf895717a6949a1ea3aebc9ab7cea5374285c797dc636794da0609bb9dd69ee81579dc2e2d3489d0a9189b4f4ec6ab2e21a0f1b3f56a34dc66624c1fe4b42c9a32139a4b3135464962e1b9db4eef34bac625300b2e32a5015f113b78b97d639b2839f413c57607415d12ab2258ddd89c5d42c49718c71d9942b6b48910e6910fe1475047aaf3b851a75cbba188a5fea04abbd12d7bbed80f317efa1a839a89fa1fb3f0d44f1abcba55127b82bf79c84b43c0bd54c2e946a59d146ea997fb7c4431e66c17423ebbe9db8d5bdee4cb8657723ee8", @ANYRES32=0x0], 0x30}, 0x1, 0x0, 0x0, 0x20a7d52d1a3e1087}, 0x30000010) r3 = socket$inet(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r3, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) 2.693123611s ago: executing program 8 (id=2428): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000003c0), 0x4000, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000400)={&(0x7f00000001c0)="bdf240cbfb215625bc485188fc3a54c914fadaf27e23beb89ca62aeebcd252922d75fe28acbf7773ae18aa52abb33b1d2bff6f095fff03ffd6fce494699d523b16a6853533d4466fd6d3d9c99d2f5b98187fd1fb064d36cbed88b6719dbc449a223432d6f7ff010d75ba4524331888c21c70a778358d4b9b38603e43908fe01ff188bd4a91d5ba97d91e53128b44690bca9c9455e64e1c4f6904b4e2f90c1ad4c6ec3c225a125e04af5a76613684", &(0x7f00000002c0)=""/85, &(0x7f0000000340)="b2f65416da255910788c", &(0x7f0000000380)="dbd08c387d5d891c098ab6a6103301c7262160612e04b0f99ca3fcffed9caa0c9f57a4e07280f36d4dc818fbd972fa9a406bbd9d79d270e3423fd9de261f", 0x7, r1}, 0x38) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000100)={{0x100, 0x3, 0x0, 0x1}, 'syz1\x00', 0x27}) ioctl$UI_DEV_CREATE(r4, 0x5501) write$input_event(r4, &(0x7f0000000340)={{0x0, 0xea60}, 0x16, 0x5, 0x84000003}, 0x6) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="540000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="15020000fe0f00001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB="080004"], 0x54}, 0x1, 0xba01, 0x0, 0x4004}, 0x4000000) 2.384999274s ago: executing program 8 (id=2429): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) sendmsg$NFT_MSG_GETSET(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000006c0)={0x14, 0xa, 0xa, 0x3, 0x0, 0x0, {0x5, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x40c0040}, 0x408c4) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d8ca8d40d10521200029001000010902120001050000000904"], 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0xff, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x0, 0x0, 0x3ff}}}}}}}, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "0007f8f9951e76c13f64323723e7eecdf40c363423eb3d259266f79c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000040000c279f03558083906666827d61dcc3a633bffff250b5a293e3877adc1660edbc9a0307a0a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103c7114ab40a68e528329d97afc3612e325c1eb4a3ab2e156aaf44480000000000000000000000000000000000aed500", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec118b233cce7e4a1e49738d9679d33610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6762c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8542e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8508002e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928ff0100000000000095adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b6ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c303cf786093a21477431fea0458023953700"}) syz_emit_ethernet(0x56, &(0x7f0000000380)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x20, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x7, 0x2}]}}}}}}}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000010c0)={0x28, 0x7, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x7ba506dd}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x20000040) recvmsg(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000c080)=[{&(0x7f0000002180)=""/4089, 0xff9}, {&(0x7f00000003c0)=""/63, 0x3f}, {0x0}], 0x3}, 0x40000020) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000001200)={0x9, 0x9808, 0x9, 0x7, 0x5}) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f00000011c0)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001180)={&(0x7f0000001100)={0x4c, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xc}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xc4}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x80) sendmsg$NL80211_CMD_JOIN_MESH(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x30, r6, 0x5, 0x0, 0x21dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x14, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_ROOTMODE={0x5, 0xe, 0x1}, @NL80211_MESHCONF_HWMP_RANN_INTERVAL={0x6, 0x10, 0x5}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004044}, 0x0) r8 = syz_open_dev$ttys(0xc, 0x2, 0x0) r9 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x80042, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000001280), r0) close_range(r8, 0xffffffffffffffff, 0x0) r10 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r10, &(0x7f0000002040)=[{{&(0x7f0000000280)={0xa, 0x4e22, 0xe, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x2}, 0x1c, 0x0, 0x0, &(0x7f0000000680)=[@rthdr={{0x18, 0x29, 0x39, {0x99, 0x0, 0x1, 0x2}}}], 0x18}}], 0x1, 0x40000000) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x1010, r9, 0xf78bd000) socket$nl_netfilter(0x10, 0x3, 0xc) 2.371417595s ago: executing program 4 (id=2430): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002a40)='comm\x00') read$FUSE(r0, &(0x7f00000009c0)={0x2020}, 0x2020) pread64(r0, &(0x7f0000000940)=""/126, 0x7e, 0xe) read$usbmon(r0, &(0x7f00000000c0)=""/170, 0xaa) socketpair(0x18, 0x80000, 0x0, &(0x7f0000000a40)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, 0x0, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f00003fd000/0xc00000)=nil, 0xc00000, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x100, 0x800, 0x6, 0x2, 0x9}, &(0x7f0000000040)=0x14) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000180)={r4, @in6={{0xa, 0x4e23, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, 0xf26}}, 0x1ff, 0xbb}, &(0x7f0000000240)=0x90) semop(0x0, &(0x7f0000000080)=[{0x1, 0x8001}, {0x1, 0x5b7a, 0x800}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000001d040000000000007f000000000000005504000017ffff162500000017ffff17ce040000000000007b0a00fe000000002d04000000000000d6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236ed200073826593c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f6260a483632a2ab447f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d172ab29967e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f522df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb520400000000000000c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399fa5ee0b41e14a6fe6894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014fa841061e63d40f4e536314beda5738fee012365f963b2a85e7d8075c333475b9f0284405e30700000041285fbe0bdd37220e31d4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe8c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68ad9fa2b2528798df1c36fc438d9c98f168490b41e158bb2e2d8ed19d44b9cce67c79f9f7bfae7ebe09e441745c592ce69c522b5136be09ed1b97ea3d5b317508df23e92c56fc2eb74d27d3861d91745b8fb9f6cc20e9f8b174000c62c4a2b212332a073fc5d0be7347e41454cb27e081c43e92ae7f9f046600db85d945a4666b588629ce0809d5c8506308688db21ec04d365497bf902126ca2ec1589f1423ae3a655121"], &(0x7f00000001c0)='GPL\x00'}, 0x48) semop(0x0, &(0x7f0000000d00), 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffff7f}]}) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r5, 0x9) r6 = socket$vsock_stream(0x28, 0x1, 0x0) syz_emit_vhci(0x0, 0x57) syz_emit_vhci(&(0x7f0000002a00)=ANY=[@ANYBLOB="02ff2012000e00050019020a8005060000000000000000"], 0x17) connect$vsock_stream(r6, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) socket$vsock_stream(0x28, 0x1, 0x0) 1.991819472s ago: executing program 2 (id=2431): r0 = getpgrp(0xffffffffffffffff) sched_getattr(r0, &(0x7f0000000000)={0x38}, 0x38, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r2, 0xc038586a, &(0x7f0000000180)={r1, &(0x7f0000000080)='\x00', 0x40001, &(0x7f00000000c0)={@_ha_fsid={[0xfffffff2, 0xa]}, {0x8, 0xb, 0x7df, 0x5}}, 0x6, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x9}) (async) ioctl$XFS_IOC_FD_TO_HANDLE(r2, 0xc038586a, &(0x7f0000000180)={r1, &(0x7f0000000080)='\x00', 0x40001, &(0x7f00000000c0)={@_ha_fsid={[0xfffffff2, 0xa]}, {0x8, 0xb, 0x7df, 0x5}}, 0x6, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x9}) ioctl$XFS_IOC_GETBMAPX(r3, 0xc0205838, &(0x7f00000001c0)={0x9, 0xfd, 0xf0, 0x6, 0x1ea2, 0x10, 0xa}) (async) ioctl$XFS_IOC_GETBMAPX(r3, 0xc0205838, &(0x7f00000001c0)={0x9, 0xfd, 0xf0, 0x6, 0x1ea2, 0x10, 0xa}) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e23, 0x1, @remote, 0x9}, 0x1c) r4 = gettid() sched_setattr(r4, &(0x7f0000000240)={0x38, 0x3, 0x4, 0x2, 0xc, 0x2, 0x5, 0xe, 0x5}, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r2) r5 = epoll_create1(0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000280)={0x0, 0xb, "71a8eb7af72c70197e3dd0"}, &(0x7f00000002c0)=0x13) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000300)={r6, @in6={{0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}}}, &(0x7f00000003c0)=0x84) setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000400)={r7, 0x3, 0x37, "6bc2b130712823432dae3c5cf4e31fd317974f3111a8b1fb92911ae6b4b4caa3dd9ac369f9691e5e09688ffcc2bc57d1baf3b246c6312f"}, 0x3f) map_shadow_stack(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) (async) map_shadow_stack(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) close_range(r3, r5, 0x2) ioctl$UBLK_U_CMD_START_DEV(r3, 0xc0207506, &(0x7f0000000440)={0x0, 0xffff, 0x0, 0x0, r0}) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000004c0)=r8) (async) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000004c0)=r8) syz_genetlink_get_family_id$gtp(&(0x7f0000000500), r1) syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r3) (async) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r3) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x2c, r9, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40001) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x2c, r9, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40001) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r5, 0x4058587a, &(0x7f0000000840)={{r1, &(0x7f0000000680)='+\',[\x00', 0x200802, &(0x7f00000006c0)={@align=0x8, {0xcc9, 0x2, 0x80000001, 0x10}}, 0x7f6, &(0x7f0000000700), &(0x7f0000000740)=0xb7c8}, {[0x7, 0x5, 0x5, 0x1ff]}, 0x8, 0xb4, &(0x7f0000000780)=""/180}) ioctl$UBLK_U_CMD_GET_PARAMS(r10, 0x80207509, &(0x7f0000000940)={0x0, 0xffff, 0x70, &(0x7f00000008c0)={0x70}}) syz_open_procfs$namespace(r4, &(0x7f00000009c0)='ns/ipc\x00') ioctl$DVB_DEMUX_DMX_QUERYBUF(r1, 0xc0186f3d, &(0x7f0000000a00)={0x1, 0x2, 0xe9, 0x1, 0x18, 0x3}) (async) ioctl$DVB_DEMUX_DMX_QUERYBUF(r1, 0xc0186f3d, &(0x7f0000000a00)={0x1, 0x2, 0xe9, 0x1, 0x18, 0x3}) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r2, 0x8008f511, &(0x7f0000000a40)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r1) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r1) syz_io_uring_setup(0x3b00, &(0x7f0000000ac0)={0x0, 0x9db8, 0x800, 0x1, 0x1d1, 0x0, r3}, &(0x7f0000000b40), &(0x7f0000000b80), &(0x7f0000000bc0)) (async) syz_io_uring_setup(0x3b00, &(0x7f0000000ac0)={0x0, 0x9db8, 0x800, 0x1, 0x1d1, 0x0, r3}, &(0x7f0000000b40)=0x0, &(0x7f0000000b80), &(0x7f0000000bc0)) r12 = mmap$IORING_OFF_SQ_RING(0x0, 0x2, 0x2000000, 0x40011, r1, 0x0) syz_io_uring_submit(r11, r12, 0x0, &(0x7f0000002080)=@IORING_OP_LINKAT={0x27, 0x4, 0x0, r3, &(0x7f0000001fc0)='./file0\x00', &(0x7f0000002000)='./file0\x00', 0xffffffffffffffff, 0x400}) 1.801263617s ago: executing program 2 (id=2432): r0 = syz_usb_connect(0x0, 0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040b90661400001010203010902320002010080320904000000ff0000000904010000ff00000009040101"], 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@setlink={0x44, 0x13, 0x331, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x34702, 0x42402}, [@IFLA_IFNAME={0x14, 0x3, 'dummy0\x00'}, @IFLA_AF_SPEC={0x10, 0x1a, 0x0, 0x1, [@AF_INET6={0xc, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xab}]}]}]}, 0x44}}, 0x2004c850) syz_usb_control_io(r0, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x2, {0x2, 0x3}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r2, 0x110, 0x5, &(0x7f0000000080)=[0x2, 0x3], 0x2) socket$inet(0x2, 0x3, 0x101) stat(&(0x7f0000001100)='./file0\x00', &(0x7f0000001140)) syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f8100000000000000000006241a0000000905810300000000000904010000020d00000904010102020d000009058202000000000009050302"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010c001ddf8208c007121522300000000109021b0001000000010904010001faf48d00090582"], 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) pwritev(r3, &(0x7f00000004c0)=[{&(0x7f0000000580)="a60c8d78476cfa35145c738d975cfbbdff0d7448bd778c1079aae0fdfdc999d8c7734eda6205ae55605ae54764f4e9f08e5efbb0235c6ca527a9b3f0c9f110d03c9db49626da37dfb05effeb8feaafb51976488a6ea8e6bd166bc18fd71143e5adfa3aeb4edc163f9e5cdde9d356e515deda9546471553a6af9f1179a1f52ac1edec79ada0ea2baee6647743a633258c6260cde3ff0ace95fac1e66c4876f344535a989b2b975bddcca981bda2923ef76e0dc7df169313c9f534fda1782377230f30ec6423", 0xc5}, {&(0x7f0000000000)="a1af9d8be409210da0c54a619f6c403cf824aaa2fb0dc6a1f65aedf9895758841d0f1414b0f13044296640f2b9f08e37d196a791d6a6615526b947e20b727fb758c7117b14e94f4f7ae0d7089e326536757e9807fa7cc4fcbed9a7f29deb03f91567a491fc5c60ed6397a97401c09aef3d1c01bc50dd5a90754dd07259b7eb95fb54b22295c761d4ea776f85d5b09c8ce5b51f9e5ff654191919ca3c71fab4756d3b73293c36cea7528d199f4a6620821d6a2868", 0xb4}, {&(0x7f0000000200)="120d84c785304d6d5bb41e4941d68a6ff447960e77a3f8a9166822f0a7d9f77744abe34d1eda002cd79aea727f88460403b72f9f6fb8ae2cb2e3b5790a83746e355f70a62671165cdaf94d8be696991d444a8016e6a02eae69ea606ecad5522e9d7d2cfe29089fb25d6927ef17bc1ee78a397aab0b577ad9eb231c84151521a2afd7937af7d43792a32dab1784d236e8451824e74686c2b76b", 0x99}, {&(0x7f00000002c0)="d27f90bde6846e618ea78459a27071ea5ad8639c491ae9a2fd0856b3254bc4534a1ec2e25bff96b7a51b563af2db5accfe51e8fb4d6383b19b21bcb88928f8a93ad11c4f482027415eae3d35c35abe8325cd9b60704d29c99cc694dfd3208af91a712306f4e4f0f90bf721429fbe", 0x6e}, {&(0x7f0000000340)="5971a9c07889f28fc0", 0x9}, {&(0x7f0000000680)="32e5d4311f0d11ec2df7a13c9b9f3b92d4a126f4a1ef9aa09aaf0e30c30f22a20d6a271e00909ec7e40b57403ab147821321dd945703add3340e000000000000b632a5241b1d0afb91bd7b14cfeff2e4", 0x50}, {&(0x7f0000000400)="9f2b6759e39c1793adfd2dbdacc68f9f64f1d33838827ecbaa14dcb79e9d7d1567a54dd4c589da7476581b0feb5aed1b4127c894d6656bfbbb011dc5e91428be7392c8bf7919153e088b71a2bc354bd3b59a519acb1c8cd852bb38a5992c5987a1ea0d9200cd55dab6ee7fb6976b23412bd4acd55a872db299f92f3328b7354d25b682e2c4ba3b4c193da8024039922447211acf429c", 0x96}], 0x7, 0x200, 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r3, 0x0) futex_waitv(&(0x7f0000001b00)=[{0x3, &(0x7f00000000c0)=0x200000006, 0x6}], 0x1, 0x0, 0x0, 0x1) syz_open_dev$char_usb(0xc, 0xb4, 0xffffffffffffffff) r4 = fsopen(&(0x7f00000000c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x4) fchdir(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x14b302, 0x8c) pwritev2(r6, &(0x7f0000000100)=[{&(0x7f0000000080)="7f", 0x1}], 0x1, 0x8800000, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) r7 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000800)={'#! ', './file1', [{0x20, '#! '}, {0x20, '\x00'}, {}, {0x20, '\x04\x00\x00\x00\b\x00\xc0q\x04\xb8Z*\x9bR\x00y^\xa9\x99\xda\xa6\xa4bg\x9e57\x9aY\xb1%c\xbbe\xb7\x88\xdea\xb9\x89\xd9\xc1\xad\x1b\xb9\xbeS\xc7\xbd\xdf\x04\x1eX%(\f\xdd\xa62\x10I\xac\rt\xcb\xd0\x94\xee*,\xa7\xf5\xb8\xd1V\xed\x82\x8d.\xcc\x92\x9fT\x1f{\x7fgP*lcA\xcc\xb9\x0f\xf4\xd9\x87\x8f\fF(O\xf5\x9a\x90\xfa8M\t\x00\x00\x00\x00\x067\xab\xb4@HN \x88\xd1\xbc\xf76\x13\x9f\xaa>\xa9\xad\xa8\xe4,\\\xe2\xaa\x03\x0f\xa1\xf9}k\x8b\xb7\t\xad9o0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f00000001c0)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000580)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x2, 0xc3a, 0x0, 0x0, 0x1000, 0xffffffff, r6, 0x0, 0x8}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) socket(0x10, 0x803, 0x0) r11 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r14, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001082abd6200000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000800040044"], 0x30}}, 0x0) r15 = syz_open_dev$dri(&(0x7f0000000080), 0xfffffffffffffffb, 0x101040) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r15, 0xc01064d0, &(0x7f0000000140)={0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd25, 0x0, {0x60, 0x0, 0x0, r13, {0x0, 0x2}, {0x0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xfff, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x55}, 0x4000) syz_ublk_setup_queues(r10, r8, &(0x7f0000000500)={0x0, 0x1fffd, 0x0, 0x3}, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x2, 0x3, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf7ff, 0x8, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x10, 0x4002, 0xe3, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29a7, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x20, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x800000, 0x0, {}, 0x1f, r7, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) r16 = io_uring_setup(0xbbc, &(0x7f00000000c0)={0x0, 0xdf62, 0x2, 0x2, 0x210}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000b86f28350900000000000109022400010000704009040010fe0300000009210100fc0122280009058a032000098102"], 0x0) io_uring_enter(r16, 0x100000, 0x2, 0xf, &(0x7f0000000000), 0x18) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x30}) statx(r1, 0x0, 0x1000, 0xc91802293bb1c2d9, 0x0) 1.384899267s ago: executing program 4 (id=2434): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) landlock_create_ruleset(&(0x7f0000000140)={0x19160, 0xa, 0x1, 0x4181, 0x8, 0xbd7acb5dd9a550b8}, 0x30, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000180)={@local, 0x2}) r3 = socket$pppoe(0x18, 0x1, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000240)=0x0) recvfrom(r3, &(0x7f00000001c0)=""/5, 0x5, 0x1, &(0x7f0000000280)=@nfc={0x27, r4, 0x1, 0x4}, 0x80) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000010ff11a068331ce2884ce2f5a9f6b3f2beb3b79152e756bb7fef8dc57dcdb3c9d85f887cf7aae394b1725873249498a295de1c290f0891660db2920ac422d0079574f5d0a346223a8d1db616791c8b99b0cd0a994c0bbe544245c85b7ef8557f78a46ebcac7072669a5f361cf5cc9baa3983688cf9a408a964db7e37f2299727e7f2fc49ebd854df3b7f5740babd66e0039bb718c212da17048ab12f764d9d7b7a2d584241558bedfc0020e19c76e8177a4a7e3a9285b8b598951e8238f2c0094247603a015804a87576d93d3d0b8070fca1fca8", @ANYRES16=r1, @ANYBLOB="010000000005e4ffffff0600000008000300", @ANYRES32=r2, @ANYBLOB="140004006e696376663000000000000000000000080005000e"], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2400c890) 1.244633314s ago: executing program 4 (id=2435): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b405000000fdff0071102300000000001ca00000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r2, &(0x7f00000002c0)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x11, 0x4, 0x800, 0xca6}, @mpls={[], @ipv6=@generic={0x1, 0x6, "11b712", 0x173, 0x11, 0xff, @local, @mcast2, {[@srh={0x1, 0x4, 0x4, 0x2, 0x7, 0x20, 0x2, [@loopback, @remote]}, @fragment={0x5c, 0x0, 0x3d, 0x1, 0x0, 0x8, 0x65}, @routing={0x0, 0x12, 0x1, 0x2b, 0x0, [@empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private2, @local, @mcast1, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}]}, @routing={0x21, 0x14, 0x0, 0xe, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @local, @local, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x35}}, @local]}], "edac99"}}}}, 0x1a9) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(r5, &(0x7f0000000280)='memory.numa_stat\x00', 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000009c0)=ANY=[@ANYBLOB="300000003f0007012bbd700000000000017c0088dd76e2800c00018048010600800a00"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc020) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x1, 0x4, 0x5, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r7, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r8 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x34424752, 0x0, 0x0, 0x0, 0x0, 0x2, 0x779acd4f0ad4811f, 0x0, 0x2, 0x2}}) 1.244239841s ago: executing program 6 (id=2436): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f000004c000/0x1000)=nil, 0x1000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x2, r1, 0x0, &(0x7f00002dd000/0x3000)=nil, 0x3000, 0x1000000d}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r2, 0x0, 0x10001, 0x0, 0xfffffffd, 0x7eac0, 0x3d3b4e}) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0xc1105511, &(0x7f0000000040)={0xa, 0x2}) r4 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) syz_emit_ethernet(0xe, &(0x7f00000001c0)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}, @void, {@generic={0x8864}}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x40, @rand_addr=' \x01\x00', @mcast2, {[], {{0x4e22, 0x4e22, 0x1000, 0x41424344, 0x0, 0x0, 0x6, 0x1, 0x3, 0x0, 0x0, {[@sack_perm={0x4, 0x2}]}}}}}}}}, 0x0) 1.184471035s ago: executing program 2 (id=2437): openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) write$dsp(r0, &(0x7f00000000c0)="4612f9121c0e", 0x6) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000040)=0x10004) ioctl$SNDCTL_DSP_GETIPTR(r0, 0x800c5011, &(0x7f0000000080)) 1.165143319s ago: executing program 7 (id=2438): syz_open_dev$sndmidi(&(0x7f0000000000), 0x2, 0xa0000) r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x8d00, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000d88000/0x1000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00008f7000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1191, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xcb}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) sched_setattr(0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0) io_uring_setup(0x8, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e15"]) 996.664865ms ago: executing program 6 (id=2439): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x26) ioctl$KVM_MEMORY_ENCRYPT_REG_REGION(r1, 0x8010aebb, &(0x7f0000000040)={0x3000, 0xc000}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x7, 0x2, 0x3, 0x100}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x7, 0x6, 0x9, 0x0, r2, 0x100}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r3, 0xd}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r4}, &(0x7f0000000880), &(0x7f00000008c0)=r2}, 0x20) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}, @in={0x2, 0x4e21, @loopback}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x85, &(0x7f0000000000)={r8, @in={{0x2, 0x4e23, @empty}}, 0x27c0}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x85, &(0x7f00000001c0)={r8, @in6={{0xa, 0x4e20, 0x3, @empty, 0xddb3}}}, 0x90) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002abd70000000007b280000000c00018008000100", @ANYRES32=r6], 0x20}}, 0x4044884) 863.65081ms ago: executing program 2 (id=2440): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40440, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = getpgrp(0xffffffffffffffff) sched_setattr(r3, &(0x7f0000000040)={0x38, 0x0, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r4, 0x28, 0x2, &(0x7f00000000c0)=0x33, 0x8) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000002140)=ANY=[]) syz_fuse_handle_req(r5, 0x0, 0x0, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) listen(r4, 0x3) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r7 = accept4(r4, 0x0, 0x0, 0x0) sendto(r7, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvfrom(r6, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) syz_usb_connect(0x0, 0x3f, 0x0, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0x1, 0x0, 0x7, 0x8, 0xe, 0xffffffff, 0x7}]}) r9 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x3a2, 0x0) ioctl$SG_BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) preadv(r9, &(0x7f0000000580)=[{&(0x7f0000000000)=""/42, 0x2a}], 0x14, 0x7, 0x800) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff2000}]}) close_range(r10, 0xffffffffffffffff, 0x0) 831.964547ms ago: executing program 6 (id=2441): ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000100)={"b46474f815e8d5535f0887c44335cc824dc6121bc72a77f532ff5dad4d643a9cab29d2310e04be14eb26c0af4985fe45e3b3b0680b3ec92725d74b9716e0f7c3119a2c9a0ae65ff4772e2e12733cb013c4308fe40863480747c0a7ddb9361b1578015ca1bb2c1677ebae096f08345476f567443842946ed946434c75916d1db83fe305920de65bfaf9bd940672216846cb16b8ae67cd3affc61375381f91b3b9f1cc5e38cafe5239aee71dcd481fbe1ecd2547ffbaad4469a74697c28fb9beefa6a5d736712a55eb9110c2cf7964062ba8cbc1c038e84f0f5db7fc7053118bf5221e3efa6fc3edb5d0ca3cde7054dd0751a332520aa8478b1775d552c5cc24d3c2df9eb333e5ca3aa06c1c2cf8526714f5caff2f55b41976fc20b64f1fc61d5b44f50953582a1825d32130a31abfeafd1987317879e29ac51b93c9659e023fff3ddb5e39dd19cc3ef1d883c78b9e073d08a9197fb3717df238b9831831214b186693be9dd2568bb77272e80df5dfed03e8c467627bedfbd93359a9f79a3aa37e873dc1357b37b43d813ea85267b0dc8b1c4cc5328833beb2679b7fb762555bbea2da936b36f8f1673fd5f606b2b6eb23b72bf947206e8dbfeb40ca6f265a3485c8446e0f0da652860b88328073d2282c14b48a7774e62754a968b60e92205e8fafcdd70a55c3c4d1a4821ff44e6e3681f15ae091260010000000000000e30ebbf9d24287bb8a5d73c608d47d287f9e716cf02b4796a83fb0c05e45b89de9ef8bce834e6d7a0be6e30d2c66cb6e640cb01898454ad361bc0701d8fe56113335ae6adec59300db04691cc4a689034272a8e086a32ce7061b4f79fa8afbb48a6ce4b62bdc44af013d78980457e1fa61eb9204818606f4c3b03c0f33cd2a841ac9bc2b73151a96e31ab99e6ec969b5f2c3edd5f9abc69845e487af992758ba445368da93dae1d44360d52a534a88276b8aaf349841d8a4788c60408618437c442308dbf70efeda2e54e9b9e4fe5f76997c9dcb945a26bd75748c85d19ca8b99264dce50580e8d4dbda401dad7df31e9a7a6a3a83bfbdfb5394abd581ac0824fbcd75d2f5205c0b7c9188e6f26bfd97734d9a20433f6cdba9d14a5f32a4d97a57f4603b21146fd1aebf082e863d463c224ad623c17d8043d3bf083f0322408dd6ead6915ac6a4222ab51480eb6e11a8913348219515170d9df90d72d7363bbda3e327d19f98c0a856f98076380e788e602e8a2ae0a1930786874dc21a2e99abda15f35457cf1dcb440c4b41350d0eda352aad7f57a0adc8a6914da06460635ed21c4c11cd1a8ec778fd87105119cc7e2f828b23f94b16619a5520731c2c40ab8583c9f2e73233d74b84f4877ce6b35bb1180300"}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000500)=[@code={0x1, 0x68, {"3ef30fc735fc9a00003e0f01c8c4417df1a9b398000066b8240066baa10066b8000066ef460f79f2c4e1717db49c26000000b9800000c00f3235000400000f307b9666baa00066b8000066ef66bad1040f01c2260f78da"}}], 0x68}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, &(0x7f0000000000)={0x6, 0xc}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x88002, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, r5, 0x1, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) sendmsg$TIPC_NL_KEY_SET(r3, 0x0, 0x4000004) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000600), r3) sendmsg$TIPC_NL_KEY_SET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x54, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) dup(r2) 533.788394ms ago: executing program 4 (id=2442): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r0 = syz_open_dev$ublk_bdev(&(0x7f0000000040), 0x0, 0x2a6302) pwrite64$ublk_bdev(r0, &(0x7f0000000040), 0x0, 0x5) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) (async) socket(0x3, 0x5, 0x8c) 317.37568ms ago: executing program 6 (id=2443): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106161154d00008000000109022400010000000009040000010300000009210000000122f80409058103"], 0x0) (async) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x0, 0x98b3}, {0x6, 0x8, 0xfd, 0x7}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000380)={@multicast, @local, @void, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x2, 0x38, 0x24, 0x68, 0x0, 0xa, 0x21, 0x0, @multicast2, @local}, {{0x4e22, 0x4e23, 0x4, 0x1, 0x4, 0x0, 0x0, 0x1, 0x6, "8dc878", 0x9, "0ed80d"}}}}}}, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) (async) syz_usb_connect$cdc_ecm(0x5, 0x64, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x52, 0x1, 0x1, 0x6, 0x0, 0x3, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x2, 0x6, 0x0, 0x9, {{0x6, 0x24, 0x6, 0x0, 0x0, 'r'}, {0x5, 0x24, 0x0, 0x7fff}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x100, 0x4897, 0x4}, [@mbim_extended={0x8, 0x24, 0x1c, 0x4, 0x8, 0x3}, @call_mgmt={0x5, 0x24, 0x1, 0x0, 0xd}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xd9, 0x1, 0xc}}], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x6, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0xad, 0x6, 0xb3}}}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x200, 0x4, 0x0, 0xa0, 0xff, 0x2}, 0x3a, &(0x7f0000000140)={0x5, 0xf, 0x3a, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xb, 0x9, 0x6c, 0xb7}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "fc864b28e70b3d4a06513839d81ffd05"}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0xfe, 0x0, 0x2}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x5, 0x3, 0x5, 0x4}]}, 0x6, [{0xa4, &(0x7f0000000180)=@string={0xa4, 0x3, "86875bc79a250e0a4c17bfe13a8aeff228e6104550c59a7a7de9626c714f0052f1ab7261ca675628f53be9c3510e4afc2d9b35d2c69d3e8fdf5ebc86f8b44f60da3617683cc7293a15d36a9962d9298d88df582047cdf524d924c975d622e795950b099eb71c45576b1532bf94f9ccc6de6113b8a29c15abc6270ca9932b138e9b46e5640b8d52244886fa6de520704f7de7ada27fdae177f8452061dfa2eade1f23"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1436}}, {0x17, &(0x7f00000002c0)=@string={0x17, 0x3, "a8dfe2848dc80e2fa527f6e8afb65788ddf3e796cd"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x2009}}, {0xce, &(0x7f0000000480)=@string={0xce, 0x3, "20d76bdc726d249d0f18b84441aabf18d4da344d0b94f791275923fa7dbe3f7914d3fbc1d23aaf00f91700c748f9d05224fd2e23bfefe2fbc39949bb26f7178dd242ad7d33401784ef6370f7ab0f1e5c1443476d550379fbacdaa46e48afa1c1ce1fd5ed8be3948c3886fbb8d14d40bfdb4255c99467e5d55afa139fb026d9acc20648ea7371e07daf7fabd6eef1cb4d747e321c5fc393ae782e34184c46cf77728bf666ab8eb197eacdb695f503322e761eb202a1043813fcbc450832b2086e9d72addce81662778dd0fa22"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0xf8ff}}]}) 316.890018ms ago: executing program 4 (id=2444): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x1) connect$vsock_stream(r1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000001c0)={@loopback={0x0, 0x3fc}, 0x1c, r2}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) pipe(&(0x7f0000000040)={0xffffffffffffffff}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101901, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x971}) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f00000005c0)={0x1, 0x0, [{0x1ff, 0x2, 0x0, 0x0, @msi={0xcf, 0x40, 0xfffffffd, 0x20001}}]}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000000)={0x0, 0x9a, "02e957677b80148e7ea1b91d94b5ce4e7267dfe1e68dbe84d96ccb9dad72a882623705485e3867bba2a59f089c7148c66fe1784d8d333015ec45085cc735e81f1b64e8d07ab8573132b9e6a177ab89f7778405b3004e4404057f203d633fa462c8c5f6a759cace23b11695a214433b3a7088606c462b637489b2067ee998aa1970c9477bad1f569bc50d6262c19dcbbbfbb73192e04051eaf3b9"}, &(0x7f00000000c0)=0xa2) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0xc0000, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000280)={0x48}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r6}) 0s ago: executing program 4 (id=2445): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, 0x0, 0x777) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="2c0000001800dd8d00000000fedbdf25021010000000360b00000020080006"], 0x2c}, 0x1, 0x0, 0x0, 0x400a044}, 0x20004090) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) r4 = dup(0xffffffffffffffff) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'syztnl1\x00', 0x0, 0x29, 0x80, 0x8, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast1, 0x1, 0x1, 0x1b3, 0x5}}) sendmsg$nl_netfilter(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d0005800900010070707470"], 0xbc}}, 0x0) unshare(0x8040480) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000400000008000000141000000a6e31cfb590211dc2e70ac6ed47b0088fd4aff1e08fd599af93163a8a803bdce65b0eda4916af3c1715ffce4502417c4ec0eb04630d97914c9b1c5458a0b4039f74c724a70ba25d244c40d7094e4a1209a41f1e3f4cc77e67236c530c8829694d940a62eb1cf63e411433554a0f25cc0254986f5c2d5f695d76bd28eb21ff9d1e5eb725e6f00f4f94ca", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x4, 0x4, 0x7, 0x0, r6, 0x0, '\x00', 0x0, r4}, 0x50) sendmsg$nl_route(r1, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1e, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) listns(&(0x7f0000000040)={0x20, 0x0, 0x946, 0x40000000}, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r7, &(0x7f0000000200)={0x0, 0x18, &(0x7f00000001c0)={&(0x7f0000000040)={0x14, 0x17, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x840}, 0x40010) sendmmsg$inet6(r0, &(0x7f0000001140)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x8020) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="b70001"], 0xa) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r8, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x68, r9, 0x100, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x3, @media='eth\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000080) timerfd_create(0x7, 0x0) kernel console output (not intermixed with test programs): 988563][T14038] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 489.002695][ T31] audit: type=1800 audit(1790929776.707:2922): pid=14038 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1963" name="SYSV00000000" dev="tmpfs" ino=14 res=0 errno=0 [ 489.291767][T14058] netlink: 60 bytes leftover after parsing attributes in process `syz.8.1968'. [ 489.314175][T14058] netlink: 60 bytes leftover after parsing attributes in process `syz.8.1968'. [ 489.451770][T14062] GUP no longer grows the stack in syz.8.1971 (14062): 200000005000-200000008000 (200000004000) [ 489.451798][T14062] CPU: 1 UID: 0 PID: 14062 Comm: syz.8.1971 Tainted: G L syzkaller #0 PREEMPT(full) [ 489.451813][T14062] Tainted: [L]=SOFTLOCKUP [ 489.451826][T14062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 489.451834][T14062] Call Trace: [ 489.451839][T14062] [ 489.451844][T14062] dump_stack_lvl+0xe8/0x150 [ 489.451866][T14062] __get_user_pages+0x23b6/0x2750 [ 489.451884][T14062] ? lock_acquire+0x115/0x350 [ 489.451905][T14062] ? __gup_longterm_locked+0xc3b/0x15c0 [ 489.451922][T14062] ? kernel_text_address+0xa5/0xe0 [ 489.451962][T14062] __gup_longterm_locked+0xd52/0x15c0 [ 489.451980][T14062] ? lock_acquire+0x115/0x350 [ 489.451993][T14062] ? gup_fast_fallback+0x20d/0x20e0 [ 489.452014][T14062] gup_fast_fallback+0x1d92/0x20e0 [ 489.452029][T14062] ? hrtimer_start_range_ns_common+0x7d1/0xb60 [ 489.452055][T14062] ? kasan_save_track+0x3e/0x80 [ 489.452071][T14062] ? __kmalloc_cache_noprof+0x321/0x600 [ 489.452084][T14062] ? __se_sys_futex+0x3a8/0x450 [ 489.452100][T14062] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.452120][T14062] ? __pfx_gup_fast_fallback+0x10/0x10 [ 489.452137][T14062] ? is_valid_gup_args+0x11f/0x200 [ 489.452153][T14062] ? get_user_pages_fast+0x4d/0xb0 [ 489.452170][T14062] get_futex_key+0x90f/0x1580 [ 489.452186][T14062] ? rcu_is_watching+0x16/0xb0 [ 489.452202][T14062] ? __pfx_get_futex_key+0x10/0x10 [ 489.452215][T14062] ? __kmalloc_cache_noprof+0x321/0x600 [ 489.452227][T14062] ? __kmalloc_cache_noprof+0x14d/0x600 [ 489.452238][T14062] ? futex_lock_pi+0x998/0xab0 [ 489.452253][T14062] ? futex_lock_pi+0x998/0xab0 [ 489.452272][T14062] futex_lock_pi+0x25d/0xab0 [ 489.452288][T14062] ? futex_unqueue+0x211/0x240 [ 489.452305][T14062] ? __futex_wait+0x358/0x400 [ 489.452327][T14062] ? __pfx_futex_lock_pi+0x10/0x10 [ 489.452381][T14062] ? __pfx_futex_wake_mark+0x10/0x10 [ 489.452409][T14062] ? __pfx_userfaultfd_unmap_complete+0x10/0x10 [ 489.452425][T14062] ? mas_walk+0x37e/0x490 [ 489.452506][T14062] do_futex+0x330/0x4e0 [ 489.452524][T14062] ? __pfx_do_futex+0x10/0x10 [ 489.452540][T14062] ? __vm_munmap+0x2fe/0x3e0 [ 489.452557][T14062] __se_sys_futex+0x3a8/0x450 [ 489.452576][T14062] ? __pfx___se_sys_futex+0x10/0x10 [ 489.452591][T14062] ? rcu_is_watching+0x16/0xb0 [ 489.452608][T14062] ? __x64_sys_futex+0x21/0xf0 [ 489.452625][T14062] do_syscall_64+0x166/0x520 [ 489.452640][T14062] ? trace_irq_disable+0x3b/0x140 [ 489.452652][T14062] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.452663][T14062] ? clear_bhb_loop+0x70/0xc0 [ 489.452677][T14062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.452688][T14062] RIP: 0033:0x7efc3b59e159 [ 489.452700][T14062] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.452711][T14062] RSP: 002b:00007efc3c45d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 489.452725][T14062] RAX: ffffffffffffffda RBX: 00007efc3b825fa0 RCX: 00007efc3b59e159 [ 489.452733][T14062] RDX: 0000000010000001 RSI: 000000000000000d RDI: 0000200000004000 [ 489.452741][T14062] RBP: 00007efc3b63506b R08: 0000000000000000 R09: 0000000000000002 [ 489.452748][T14062] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 489.452755][T14062] R13: 00007efc3b826038 R14: 00007efc3b825fa0 R15: 00007efc3b94fa48 [ 489.452775][T14062] [ 489.699914][ T989] usb 9-1: new full-speed USB device number 27 using dummy_hcd [ 489.851217][ T989] usb 9-1: not running at top speed; connect to a high speed hub [ 489.851253][ T989] usb 9-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 489.852261][ T989] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 489.852284][ T989] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 489.852331][ T989] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.926124][ T989] uvcvideo 9-1:1.0: Found UVC 1.00 device (046d:0825) [ 489.939084][T14068] loop5: detected capacity change from 0 to 7 [ 489.951619][T14068] Dev loop5: unable to read RDB block 7 [ 489.951667][T14068] loop5: AHDI p2 p4 [ 489.951681][T14068] loop5: partition table partially beyond EOD, truncated [ 489.951877][T14068] loop5: p4 start 3288604672 is beyond EOD, truncated [ 489.980469][ T30] usb 8-1: new high-speed USB device number 73 using dummy_hcd [ 490.112870][ T989] uvcvideo 9-1:1.0: Failed to query (GET_INFO) UVC control 1 on unit 1: 0 (exp. 1). [ 490.131207][ T30] usb 8-1: Using ep0 maxpacket: 8 [ 490.132166][ T30] usb 8-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 490.138543][ T30] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.138559][ T30] usb 8-1: Product: syz [ 490.138567][ T30] usb 8-1: Manufacturer: syz [ 490.138575][ T30] usb 8-1: SerialNumber: syz [ 490.146207][ T30] usb 8-1: config 0 descriptor?? [ 490.164236][ T30] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 490.496422][T14062] nvme nvme0: rdma_resolve_addr failed (-19). [ 490.612818][T14079] netlink: 68 bytes leftover after parsing attributes in process `syz.7.1972'. [ 490.747183][T14090] ucma_write: process 1425 (syz.4.1977) changed security contexts after opening file descriptor, this is not allowed. [ 490.843367][T14092] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1978'. [ 490.934474][T14092] sg_write: data in/out 406492/50 bytes for SCSI command 0x0-- guessing data in; [ 490.934474][T14092] program syz.2.1978 not setting count and/or reply_len properly [ 490.936922][T14092] fuse: Unknown parameter 'rootmode0000000000000004d' [ 491.038120][T14099] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1980'. [ 491.038136][T14099] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1980'. [ 491.102105][ T30] gspca_sonixj: reg_w1 err -110 [ 491.102187][ T30] sonixj 8-1:0.0: probe with driver sonixj failed with error -110 [ 491.249239][ T30] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 491.279258][T14106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.279694][T14106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.421658][ T30] usb 5-1: Using ep0 maxpacket: 16 [ 491.422487][ T30] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 491.423908][ T30] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 491.424737][ T30] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 491.424762][ T30] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 491.424791][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.428175][ T30] usb 5-1: config 0 descriptor?? [ 491.917185][ T30] hid_parser_main: 66 callbacks suppressed [ 491.917210][ T30] microsoft 0003:045E:07DA.0022: unknown main item tag 0x0 [ 491.934163][ T30] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.0022/input/input48 [ 492.015575][ T30] microsoft 0003:045E:07DA.0022: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 492.220123][ T30] usb 5-1: USB disconnect, device number 2 [ 492.638901][ T30] usb 8-1: USB disconnect, device number 73 [ 492.838528][ T31] audit: type=1326 audit(1790929780.537:2923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc3b59e159 code=0x7ffc0000 [ 492.839342][ T31] audit: type=1326 audit(1790929780.547:2924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc3b59e159 code=0x7ffc0000 [ 492.879200][ T31] audit: type=1326 audit(1790929780.577:2925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7efc3b59e159 code=0x7ffc0000 [ 492.879252][ T31] audit: type=1326 audit(1790929780.577:2926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc3b59e159 code=0x7ffc0000 [ 492.881622][ T31] audit: type=1326 audit(1790929780.577:2927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc3b59e159 code=0x7ffc0000 [ 492.885695][ T31] audit: type=1326 audit(1790929780.577:2928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7efc3b59ddeb code=0x7ffc0000 [ 492.885763][ T31] audit: type=1326 audit(1790929780.577:2929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc3b59e159 code=0x7ffc0000 [ 492.885800][ T31] audit: type=1326 audit(1790929780.577:2930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc3b59e159 code=0x7ffc0000 [ 492.890005][ T31] audit: type=1326 audit(1790929780.577:2931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7efc3b59ddeb code=0x7ffc0000 [ 492.890068][ T31] audit: type=1326 audit(1790929780.577:2932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14128 comm="syz.8.1989" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc3b59e159 code=0x7ffc0000 [ 493.161216][ T30] usb 8-1: new high-speed USB device number 74 using dummy_hcd [ 493.167311][T14135] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.185460][T14135] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.214254][T14129] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1989'. [ 493.310071][ T30] usb 8-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 493.316726][ T30] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 493.316746][ T30] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 493.317967][ T30] usb 8-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 493.317981][ T30] usb 8-1: Manufacturer: syz [ 493.356865][ T30] usb 8-1: config 0 descriptor?? [ 493.379882][ T5725] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 493.529276][ T5725] usb 5-1: Using ep0 maxpacket: 8 [ 493.530149][ T5725] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 493.531845][ T5725] usb 5-1: config 0 has an invalid descriptor of length 64, skipping remainder of the config [ 493.531895][ T5725] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 493.531945][ T5725] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.535703][ T5725] usb 5-1: config 0 descriptor?? [ 493.548503][ T5725] usb 5-1: probing VID:PID(0424:012C) [ 493.562955][ T5725] usb 5-1: vub300 testing BULK IN EndPoint(0) 81 [ 493.563011][ T5725] usb 5-1: Could not find two sets of bulk-in/out endpoint pairs [ 493.584331][ T5725] vub300 5-1:0.0: probe with driver vub300 failed with error -22 [ 493.635863][T14140] program syz.6.1991 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 493.740323][ T1191] usb 5-1: USB disconnect, device number 3 [ 494.325370][T14156] bond1: entered promiscuous mode [ 494.325800][T14156] 8021q: adding VLAN 0 to HW filter on device bond1 [ 494.350132][T14156] fuse: fd is not a fuse device [ 494.394947][T14168] fuse: Bad value for 'fd' [ 494.561446][ T8067] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 494.710406][ T8067] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 494.715405][ T8067] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.715431][ T8067] usb 5-1: Product: syz [ 494.715447][ T8067] usb 5-1: Manufacturer: syz [ 494.715462][ T8067] usb 5-1: SerialNumber: syz [ 494.797209][ T1191] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 495.008394][T14165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.008792][T14165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.105245][T14175] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.119711][ T989] uvcvideo 9-1:1.0: Failed to query (GET_INFO) UVC control 3 on unit 1: -110 (exp. 1). [ 495.122263][T14175] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.122618][ T989] uvcvideo 9-1:1.0: Failed to query (GET_INFO) UVC error code control 4 on unit 1: -32 (exp. 1). [ 495.122692][ T989] uvcvideo 9-1:1.0: No streaming interface found for terminal 32770. [ 495.144600][T10868] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.144613][T10868] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 495.205800][T14175] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.206198][T14175] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.806015][ T8067] usb 5-1: USB disconnect, device number 4 [ 495.825715][ T30] usbhid 8-1:0.0: can't add hid device: -71 [ 495.825866][ T30] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 495.844007][ T1191] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 495.844114][ T1191] ath9k_htc: Failed to initialize the device [ 495.845257][T14186] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.845659][T14186] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.887479][ T30] usb 8-1: USB disconnect, device number 74 [ 495.897397][ T8067] usb 5-1: ath9k_htc: USB layer deinitialized [ 496.950380][T14221] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2010'. [ 497.030484][T14221] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2010'. [ 498.394331][T14249] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.394765][T14249] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.839249][ T5725] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 498.878724][T14261] fuse: Bad value for 'fd' [ 498.879021][T14261] fuse: Bad value for 'fd' [ 498.882677][T14261] fuse: Bad value for 'fd' [ 498.884704][T14261] fuse: Bad value for 'fd' [ 498.884985][T14261] fuse: Bad value for 'fd' [ 498.885234][T14261] fuse: Bad value for 'fd' [ 498.885483][T14261] fuse: Bad value for 'fd' [ 498.885728][T14261] fuse: Bad value for 'fd' [ 498.885984][T14261] fuse: Bad value for 'fd' [ 498.886232][T14261] fuse: Bad value for 'fd' [ 498.892375][T14261] fuse: Bad value for 'fd' [ 498.892640][T14261] fuse: Bad value for 'fd' [ 498.892892][T14261] fuse: Bad value for 'fd' [ 498.894918][T14261] fuse: Bad value for 'fd' [ 498.895217][T14261] fuse: Bad value for 'fd' [ 498.897907][T14261] fuse: Bad value for 'fd' [ 498.898181][T14261] fuse: Bad value for 'fd' [ 498.898428][T14261] fuse: Bad value for 'fd' [ 498.898677][T14261] fuse: Bad value for 'fd' [ 498.898934][T14261] fuse: Bad value for 'fd' [ 498.926655][T14261] fuse: Bad value for 'fd' [ 498.926951][T14261] fuse: Bad value for 'fd' [ 498.927206][T14261] fuse: Bad value for 'fd' [ 498.927466][T14261] fuse: Bad value for 'fd' [ 498.927715][T14261] fuse: Bad value for 'fd' [ 498.927964][T14261] fuse: Bad value for 'fd' [ 498.945777][T14261] fuse: Bad value for 'fd' [ 498.946069][T14261] fuse: Bad value for 'fd' [ 498.946359][T14261] fuse: Bad value for 'fd' [ 498.946604][T14261] fuse: Bad value for 'fd' [ 498.946860][T14261] fuse: Bad value for 'fd' [ 498.947113][T14261] fuse: Bad value for 'fd' [ 498.953746][T14261] fuse: Bad value for 'fd' [ 498.954021][T14261] fuse: Bad value for 'fd' [ 498.954276][T14261] fuse: Bad value for 'fd' [ 498.954527][T14261] fuse: Bad value for 'fd' [ 498.954786][T14261] fuse: Bad value for 'fd' [ 498.963294][T14261] fuse: Bad value for 'fd' [ 498.963612][T14261] fuse: Bad value for 'fd' [ 498.963868][T14261] fuse: Bad value for 'fd' [ 498.964132][T14261] fuse: Bad value for 'fd' [ 498.964384][T14261] fuse: Bad value for 'fd' [ 498.964640][T14261] fuse: Bad value for 'fd' [ 498.973026][T14261] fuse: Bad value for 'fd' [ 498.973332][T14261] fuse: Bad value for 'fd' [ 498.973585][T14261] fuse: Bad value for 'fd' [ 498.973832][T14261] fuse: Bad value for 'fd' [ 498.974085][T14261] fuse: Bad value for 'fd' [ 498.974353][T14261] fuse: Bad value for 'fd' [ 498.981897][T14261] fuse: Bad value for 'fd' [ 498.982199][T14261] fuse: Bad value for 'fd' [ 498.982448][T14261] fuse: Bad value for 'fd' [ 498.982696][T14261] fuse: Bad value for 'fd' [ 498.982949][T14261] fuse: Bad value for 'fd' [ 498.983220][T14261] fuse: Bad value for 'fd' [ 498.989401][T14261] fuse: Bad value for 'fd' [ 498.989701][T14261] fuse: Bad value for 'fd' [ 498.989958][T14261] fuse: Bad value for 'fd' [ 498.990216][T14261] fuse: Bad value for 'fd' [ 498.990477][T14261] fuse: Bad value for 'fd' [ 498.990731][T14261] fuse: Bad value for 'fd' [ 498.992111][ T5725] usb 5-1: Using ep0 maxpacket: 16 [ 499.000717][ T5725] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 499.031239][ T5725] usb 5-1: config index 0 descriptor too short (expected 51443, got 18) [ 499.067594][T14261] fuse: Bad value for 'fd' [ 499.067861][T14261] fuse: Bad value for 'fd' [ 499.068117][T14261] fuse: Bad value for 'fd' [ 499.068370][T14261] fuse: Bad value for 'fd' [ 499.080816][ T5725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.080841][ T5725] usb 5-1: Product: syz [ 499.080855][ T5725] usb 5-1: Manufacturer: syz [ 499.080870][ T5725] usb 5-1: SerialNumber: syz [ 499.149489][ T5725] r8152-cfgselector 5-1: Unknown version 0x0000 [ 499.149514][ T5725] r8152-cfgselector 5-1: config 0 descriptor?? [ 499.575756][T14270] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.576601][T14270] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.585874][T14270] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.586267][T14270] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.592312][T14270] loop4: detected capacity change from 0 to 2640 [ 499.611717][T14270] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 499.611756][T14270] Buffer I/O error on dev loop4, logical block 1, lost async page write [ 499.611780][T14270] Buffer I/O error on dev loop4, logical block 2, lost async page write [ 499.611803][T14270] Buffer I/O error on dev loop4, logical block 3, lost async page write [ 499.611824][T14270] Buffer I/O error on dev loop4, logical block 4, lost async page write [ 499.611846][T14270] Buffer I/O error on dev loop4, logical block 5, lost async page write [ 499.611867][T14270] Buffer I/O error on dev loop4, logical block 6, lost async page write [ 499.611889][T14270] Buffer I/O error on dev loop4, logical block 7, lost async page write [ 499.611911][T14270] Buffer I/O error on dev loop4, logical block 8, lost async page write [ 499.611932][T14270] Buffer I/O error on dev loop4, logical block 9, lost async page write [ 500.815787][T14293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.818020][T14293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.844150][T14293] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2030'. [ 500.905277][T14293] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 500.923787][T14293] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 501.016772][T14297] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2032'. [ 501.034596][T14297] fuse: Unknown parameter '' [ 501.038639][T14297] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 501.114733][ T31] kauditd_printk_skb: 57 callbacks suppressed [ 501.114921][ T31] audit: type=1326 audit(1790929788.817:2990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.116906][ T31] audit: type=1326 audit(1790929788.817:2991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.174410][ T31] audit: type=1326 audit(1790929788.877:2992): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.174445][ T31] audit: type=1326 audit(1790929788.877:2993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.201097][T14301] input: syz1 as /devices/virtual/input/input49 [ 501.207018][ T31] audit: type=1326 audit(1790929788.907:2994): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=276 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.207068][ T31] audit: type=1326 audit(1790929788.907:2995): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.207106][ T31] audit: type=1326 audit(1790929788.907:2996): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.208070][ T31] audit: type=1326 audit(1790929788.907:2997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.208114][ T31] audit: type=1326 audit(1790929788.907:2998): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.208151][ T31] audit: type=1326 audit(1790929788.907:2999): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14296 comm="syz.6.2032" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f434a19e159 code=0x7ffc0000 [ 501.378977][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.379074][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.731386][ T8067] r8152-cfgselector 5-1: USB disconnect, device number 5 [ 501.801776][T14306] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2034'. [ 501.981464][T14307] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2034'. [ 502.116573][T14313] fuse: fd is not a fuse device [ 502.200937][ T8067] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 502.351193][ T8067] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 502.353940][ T8067] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 502.353972][ T8067] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 502.353998][ T8067] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 502.354022][ T8067] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 502.354064][ T8067] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.417006][ T8067] usb 5-1: config 0 descriptor?? [ 502.639709][T14315] xt_LOG: level 64 >= 8 [ 502.931981][ T8067] plantronics 0003:047F:FFFF.0023: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 502.996695][T14321] libceph: resolve '1270.1' (ret=-3): failed [ 503.510694][ T8067] usb 8-1: new high-speed USB device number 75 using dummy_hcd [ 503.660389][ T8067] usb 8-1: Using ep0 maxpacket: 16 [ 503.667673][ T8067] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 503.678701][ T8067] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 503.678719][ T8067] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 503.678731][ T8067] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 503.678755][ T8067] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.726417][ T30] usb 5-1: USB disconnect, device number 6 [ 503.739028][ T8067] usb 8-1: config 0 descriptor?? [ 504.028573][T14340] program syz.7.2043 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 504.074858][T14338] netlink: 212 bytes leftover after parsing attributes in process `syz.7.2043'. [ 504.421732][T14349] kvm: emulating exchange as write [ 504.534704][T14349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.535141][T14349] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.537415][ T8067] usbhid 8-1:0.0: can't add hid device: -71 [ 504.537489][ T8067] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 504.574268][ T8067] usb 8-1: USB disconnect, device number 75 [ 504.670667][T14358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.670921][T14358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.959388][ T30] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 505.090046][ T30] usb 5-1: device descriptor read/64, error -71 [ 505.245870][T14367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.247141][T14367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.332627][ T30] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 505.425019][T14372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.425446][T14372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.459829][ T30] usb 5-1: device descriptor read/64, error -71 [ 505.479193][ T8067] usb 8-1: new high-speed USB device number 76 using dummy_hcd [ 505.601879][ T30] usb usb5-port1: attempt power cycle [ 505.649570][ T8067] usb 8-1: Using ep0 maxpacket: 32 [ 505.653022][ T8067] usb 8-1: New USB device found, idVendor=056a, idProduct=06c5, bcdDevice= 0.00 [ 505.654969][ T8067] usb 8-1: too many endpoints for config 0 interface 0 altsetting 252: 223, using maximum allowed: 30 [ 505.655008][ T8067] usb 8-1: config 0 interface 0 altsetting 252 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 505.655033][ T8067] usb 8-1: config 0 interface 0 altsetting 252 has 1 endpoint descriptor, different from the interface descriptor's value: 223 [ 505.655125][ T8067] usb 8-1: config 0 interface 0 has no altsetting 0 [ 505.655159][ T8067] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 505.727537][ T8067] usb 8-1: config 0 descriptor?? [ 505.969224][ T30] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 505.990829][ T30] usb 5-1: device descriptor read/8, error -71 [ 505.991514][T14378] ip_tables: iptables: counters copy to user failed while replacing table [ 506.052762][T14383] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.053175][T14383] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.207919][ T8067] wacom 0003:056A:06C5.0024: ignoring exceeding usage max [ 506.216508][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216530][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216546][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216562][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216577][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216592][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216607][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216622][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216638][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.216653][ T8067] wacom 0003:056A:06C5.0024: unknown main item tag 0x0 [ 506.229390][ T30] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 506.259273][ T30] usb 5-1: device descriptor read/8, error -71 [ 506.302641][ T8067] wacom 0003:056A:06C5.0024: Unknown device_type for 'HID 056a:06c5'. Ignoring. [ 506.369510][ T30] usb usb5-port1: unable to enumerate USB device [ 506.846541][T14389] openvswitch: netlink: VXLAN extension message has 2 unknown bytes. [ 506.847576][T14389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.848050][T14389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.908780][ T30] usb 8-1: USB disconnect, device number 76 [ 507.532247][T14400] sctp: [Deprecated]: syz.4.2061 (pid 14400) Use of int in max_burst socket option. [ 507.532247][T14400] Use struct sctp_assoc_value instead [ 507.549241][ T1191] usb 8-1: new high-speed USB device number 77 using dummy_hcd [ 507.699916][ T1191] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 507.703662][ T1191] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 507.703694][ T1191] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 507.703706][ T1191] usb 8-1: config 0 interface 0 has no altsetting 0 [ 507.706866][ T1191] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 507.706886][ T1191] usb 8-1: Product: syz [ 507.706895][ T1191] usb 8-1: Manufacturer: syz [ 507.706903][ T1191] usb 8-1: SerialNumber: syz [ 507.718775][ T1191] usb 8-1: config 0 descriptor?? [ 507.746118][ T1191] hub 8-1:0.0: bad descriptor, ignoring hub [ 507.746144][ T1191] hub 8-1:0.0: probe with driver hub failed with error -5 [ 507.808513][ T1191] usb 8-1: selecting invalid altsetting 0 [ 507.869793][ T8067] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 508.020580][ T8067] usb 5-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 508.021654][ T8067] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 508.028003][ T8067] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.028018][ T8067] usb 5-1: Product: syz [ 508.028026][ T8067] usb 5-1: Manufacturer: syz [ 508.028034][ T8067] usb 5-1: SerialNumber: syz [ 508.078580][ T8067] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 508.393755][T14410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.395833][T14410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.439653][T14395] usb 8-1: reset high-speed USB device number 77 using dummy_hcd [ 508.446825][T14410] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2063'. [ 508.631926][T14395] usb 8-1: device firmware changed [ 508.635797][ T30] usb 8-1: USB disconnect, device number 77 [ 508.713200][T14414] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2065'. [ 508.821167][ T30] usb 8-1: new high-speed USB device number 78 using dummy_hcd [ 508.839426][T14417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.839813][T14417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.872552][T14404] tipc: Enabled bearer , priority 10 [ 508.929730][T14425] netlink: 72 bytes leftover after parsing attributes in process `syz.6.2067'. [ 508.931206][T14425] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2067'. [ 508.973093][ T30] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 508.974271][ T30] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 508.974319][ T30] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 508.974343][ T30] usb 8-1: config 0 interface 0 has no altsetting 0 [ 508.977613][ T30] usb 8-1: string descriptor 0 read error: -22 [ 508.977745][ T30] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 509.034257][ T30] usb 8-1: config 0 descriptor?? [ 509.037281][ T30] hub 8-1:0.0: bad descriptor, ignoring hub [ 509.037310][ T30] hub 8-1:0.0: probe with driver hub failed with error -5 [ 509.075139][ T30] usb 8-1: selecting invalid altsetting 0 [ 509.146131][ T8067] gspca_mr97310a: reg read [21] error -71 [ 509.146245][ T8067] mr97310a 5-1:1.0: probe with driver mr97310a failed with error -71 [ 509.192770][ T8067] usb 5-1: USB disconnect, device number 11 [ 509.359565][ T1191] usb 8-1: USB disconnect, device number 78 [ 509.536698][T14439] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2071'. [ 509.825148][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 509.833681][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 509.834058][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 509.834347][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 509.834642][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 509.834929][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 509.868542][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 509.870220][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 509.870334][T14459] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.877591][T14459] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.878012][T14455] ip_tables: iptables: counters copy to user failed while replacing table [ 510.279296][ T8067] usb 8-1: new high-speed USB device number 79 using dummy_hcd [ 510.435273][ T8067] usb 8-1: Using ep0 maxpacket: 32 [ 510.437223][ T8067] usb 8-1: New USB device found, idVendor=0582, idProduct=000c, bcdDevice= 0.40 [ 510.455043][ T8067] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 247, changing to 7 [ 510.469464][ T30] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 510.472490][ T8067] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.472516][ T8067] usb 8-1: Product: 娷쓹倳ꖨ䳲ቪ灋睒謔됈稹ﰟѬ뾴铚쌔캒녲鰷찉缢姫ꑉ栤㜗ϙ倷ߦҎ煎퐢뷤戠Ꞽᘑ㏵娸荰遅痾杛擅盡従ꌉ纶⋲劣Ѣ㆑腃㉶㛳쑠鿁⁤裷␟솯ħ녧溴቟錹헟〹⯦ⱗ塄씌猌纖챯젳㽊ໄᢺ칡踠팛ங琵듹ᤍજヺ緄䩆Ʌ鉆쭣䇕瘏錷氙襷麭瑱攲㼡㥊癹᷄ᕉ䙪괎ჼ峿 [ 510.472551][ T8067] usb 8-1: Manufacturer: 倊 [ 510.472566][ T8067] usb 8-1: SerialNumber: 㡤 [ 510.647473][ T30] usb 5-1: New USB device found, idVendor=6547, idProduct=0232, bcdDevice= 0.00 [ 510.653083][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.653108][ T30] usb 5-1: Product: syz [ 510.653124][ T30] usb 5-1: Manufacturer: syz [ 510.653138][ T30] usb 5-1: SerialNumber: syz [ 510.671458][ T30] ark3116 5-1:1.0: ark3116 converter detected [ 510.699285][ T8067] usb 8-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 510.699704][ T8067] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 510.700163][ T8067] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 510.703840][ T8067] usb 8-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 510.704206][ T8067] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 510.704633][ T8067] snd-usb-audio 8-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 510.708240][ T8067] usb 8-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 510.708617][ T8067] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 510.830696][ T8067] snd-usb-audio 8-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 510.834662][ T8067] usb 8-1: USB disconnect, device number 79 [ 510.881638][ T5617] udevd[5617]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 510.953871][T14496] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.954330][T14496] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.991041][T14496] syzkaller0: entered promiscuous mode [ 510.991081][T14496] syzkaller0: entered allmulticast mode [ 511.382639][T14500] bridge_slave_0: left allmulticast mode [ 511.382662][T14500] bridge_slave_0: left promiscuous mode [ 511.382918][T14500] bridge0: port 1(bridge_slave_0) entered disabled state [ 511.386119][T14500] bridge_slave_1: left allmulticast mode [ 511.386301][T14500] bridge0: port 2(bridge_slave_1) entered disabled state [ 511.393090][T14502] fuse: Bad value for 'fd' [ 511.426864][T14500] bond0: (slave bond_slave_0): Releasing backup interface [ 511.428844][T14500] bond0: (slave bond_slave_1): Releasing backup interface [ 511.447276][T14500] team0: Port device team_slave_0 removed [ 511.447800][T14500] team_slave_1: left promiscuous mode [ 511.461293][T14500] team0: Port device team_slave_1 removed [ 511.461716][T14500] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 511.462823][T14500] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 511.694482][ T30] ark3116 ttyUSB0: using RS232 mode [ 511.714372][ T30] usb 5-1: ark3116 converter now attached to ttyUSB0 [ 511.731844][ T31] kauditd_printk_skb: 8300 callbacks suppressed [ 511.731862][ T31] audit: type=1326 audit(1790929799.437:11300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.731902][ T31] audit: type=1326 audit(1790929799.437:11301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.734299][ T31] audit: type=1326 audit(1790929799.437:11302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.734354][ T31] audit: type=1326 audit(1790929799.437:11303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.734393][ T31] audit: type=1326 audit(1790929799.437:11304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.741937][ T31] audit: type=1326 audit(1790929799.447:11305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.741982][ T31] audit: type=1326 audit(1790929799.447:11306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.742020][ T31] audit: type=1326 audit(1790929799.447:11307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.745608][ T31] audit: type=1326 audit(1790929799.447:11308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 511.745652][ T31] audit: type=1326 audit(1790929799.447:11309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14513 comm="syz.7.2089" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 512.037708][T14523] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.038241][T14523] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.110648][T12100] Bluetooth: hci5: unexpected event 0x01 length: 4 > 1 [ 512.170452][T14530] netdevsim netdevsim7: Direct firmware load for .. @ failed with error -2 [ 512.170483][T14530] netdevsim netdevsim7: Falling back to sysfs fallback for: .. @ [ 513.154156][ T8063] usb 5-1: USB disconnect, device number 12 [ 513.193088][ T8063] ark3116 ttyUSB0: ark3116 converter now disconnected from ttyUSB0 [ 513.195167][ T8063] ark3116 5-1:1.0: device disconnected [ 513.530362][T14555] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2100'. [ 513.688722][T14561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.692468][T14561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.337594][T14571] bridge_slave_0: left allmulticast mode [ 514.337612][T14571] bridge_slave_0: left promiscuous mode [ 514.337739][T14571] bridge0: port 1(bridge_slave_0) entered disabled state [ 514.353550][ T8067] usb 8-1: new high-speed USB device number 80 using dummy_hcd [ 514.373909][T14571] bridge_slave_1: left allmulticast mode [ 514.373924][T14571] bridge_slave_1: left promiscuous mode [ 514.374150][T14571] bridge0: port 2(bridge_slave_1) entered disabled state [ 514.396474][T14571] bond0: (slave bond_slave_0): Releasing backup interface [ 514.398648][T14571] bond0: (slave bond_slave_1): Releasing backup interface [ 514.417595][T14571] team0: Port device team_slave_1 removed [ 514.418092][T14571] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 514.418874][T14571] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 514.439247][ T8063] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 514.448759][T14571] net_ratelimit: 58 callbacks suppressed [ 514.448771][T14571] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 514.519195][ T8067] usb 8-1: Using ep0 maxpacket: 8 [ 514.519786][ T8067] usb 8-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 514.523803][ T8067] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.523828][ T8067] usb 8-1: Product: syz [ 514.523844][ T8067] usb 8-1: Manufacturer: syz [ 514.523859][ T8067] usb 8-1: SerialNumber: syz [ 514.526718][ T8067] usb 8-1: config 0 descriptor?? [ 514.562190][T14576] netlink: 52 bytes leftover after parsing attributes in process `syz.8.2109'. [ 514.586683][ T8067] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 514.600011][ T8063] usb 5-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 514.600914][ T8063] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 514.600952][ T8063] usb 5-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 514.602783][ T8063] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.602797][ T8063] usb 5-1: Product: syz [ 514.602805][ T8063] usb 5-1: Manufacturer: syz [ 514.602814][ T8063] usb 5-1: SerialNumber: syz [ 514.617501][ T8063] usb-storage 5-1:1.0: USB Mass Storage device detected [ 514.675183][ T8063] usb-storage 5-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 514.678404][ T8063] scsi host1: usb-storage 5-1:1.0 [ 514.815994][T14569] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.816347][T14569] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.834439][ T8063] usb 5-1: USB disconnect, device number 13 [ 515.226681][T14587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.227037][T14587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.257346][T14587] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2111'. [ 515.271266][T14588] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.273568][T14588] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.742741][T14598] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2113'. [ 515.743501][T14597] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2113'. [ 515.748094][T14597] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.779782][T14597] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.785506][T14597] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.788161][T14597] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.805170][T14597] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.805591][T14597] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.808653][T14598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.809079][T14598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.240177][ T1191] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 516.352901][ T8067] gspca_sonixj: reg_r err -32 [ 516.353090][ T8067] sonixj 8-1:0.0: probe with driver sonixj failed with error -32 [ 516.389392][ T1191] usb 5-1: Using ep0 maxpacket: 16 [ 516.391688][ T1191] usb 5-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 516.393668][ T1191] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 516.393701][ T1191] usb 5-1: config 0 interface 0 has no altsetting 0 [ 516.398717][ T1191] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.398751][ T1191] usb 5-1: Product: syz [ 516.398766][ T1191] usb 5-1: Manufacturer: syz [ 516.398781][ T1191] usb 5-1: SerialNumber: syz [ 516.459329][ T1191] usb 5-1: config 0 descriptor?? [ 516.578574][T14611] binder: 14606:14611 ioctl c0d05640 2000000006c0 returned -22 [ 516.618525][T14611] netlink: 'syz.8.2117': attribute type 21 has an invalid length. [ 516.703701][ T1191] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input55 [ 516.737778][T14615] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 516.817657][T14618] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2120'. [ 517.001623][T14623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.001964][T14623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.017750][ T1191] rc_core: IR keymap rc-imon-pad not found [ 517.017789][ T1191] Registered IR keymap rc-empty [ 517.017866][ T1191] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 517.017885][ T1191] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 517.118404][ T1191] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 517.130485][ T1191] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input56 [ 517.155439][ T1191] imon 5-1:0.0: iMON device (15c2:0041, intf0) on usb<5:14> initialized [ 517.309556][T14628] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2123'. [ 517.375291][T14630] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2124'. [ 517.425580][T14628] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 517.682006][T14635] IPVS: set_ctl: invalid protocol: 7 172.20.20.19:21 [ 517.683321][ T153] IPVS: starting estimator thread 0... [ 517.683898][T14635] IPVS: sh: TCP 127.0.0.1:21 - no destination available [ 517.769214][T14642] IPVS: using max 38 ests per chain, 91200 per kthread [ 517.823480][ T5725] usb 8-1: USB disconnect, device number 80 [ 518.266136][T14656] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2130'. [ 518.299260][T13135] usb 8-1: new high-speed USB device number 81 using dummy_hcd [ 518.408255][T14659] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2131'. [ 518.459253][T13135] usb 8-1: Using ep0 maxpacket: 16 [ 518.459911][T13135] usb 8-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 518.492046][T13135] usb 8-1: config index 0 descriptor too short (expected 51443, got 18) [ 518.505969][T14662] IPVS: set_ctl: invalid protocol: 16 100.1.1.0:20002 [ 518.518137][ T5630] Bluetooth: hci0: unexpected event for opcode 0x2019 [ 518.528155][T13135] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.528181][T13135] usb 8-1: Product: syz [ 518.528222][T13135] usb 8-1: Manufacturer: syz [ 518.528238][T13135] usb 8-1: SerialNumber: syz [ 518.564639][T13135] r8152-cfgselector 8-1: Unknown version 0x0000 [ 518.564665][T13135] r8152-cfgselector 8-1: config 0 descriptor?? [ 518.635737][T14673] af_packet: tpacket_rcv: packet too big, clamped from 4096 to 3952. macoff=96 [ 519.068905][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 519.069450][ T8063] usb 5-1: USB disconnect, device number 14 [ 519.866808][T14690] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.880104][T14690] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.210200][ T1191] r8152-cfgselector 8-1: USB disconnect, device number 81 [ 520.284297][T14700] netdevsim netdevsim2: Direct firmware load for .. @ failed with error -2 [ 520.284330][T14700] netdevsim netdevsim2: Falling back to sysfs fallback for: .. @ [ 520.373222][ T31] kauditd_printk_skb: 81 callbacks suppressed [ 520.373241][ T31] audit: type=1326 audit(1790929808.077:11391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.373516][ T31] audit: type=1326 audit(1790929808.077:11392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.410596][ T31] audit: type=1326 audit(1790929808.087:11393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.410648][ T31] audit: type=1326 audit(1790929808.087:11394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.410698][ T31] audit: type=1326 audit(1790929808.087:11395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.410737][ T31] audit: type=1326 audit(1790929808.107:11396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.410776][ T31] audit: type=1326 audit(1790929808.107:11397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.410823][ T31] audit: type=1326 audit(1790929808.107:11398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.410862][ T31] audit: type=1326 audit(1790929808.107:11399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fec0435e98e code=0x7ffc0000 [ 520.410911][ T31] audit: type=1326 audit(1790929808.107:11400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14703 comm="syz.7.2141" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 520.644901][T14706] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2143'. [ 520.745702][T14708] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.746206][T14708] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.771463][T14708] xt_hashlimit: size too large, truncated to 1048576 [ 520.804612][T14711] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 520.840214][T14714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.855850][T14714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.263106][T14729] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 521.264548][T14729] netlink: 'syz.7.2149': attribute type 1 has an invalid length. [ 521.298105][T14729] 8021q: adding VLAN 0 to HW filter on device bond2 [ 521.308752][T14729] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2149'. [ 521.320110][T14732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.322851][T14732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.496517][T14734] nvme nvme0: failed to connect socket: -111 [ 521.651072][T13135] usb 8-1: new full-speed USB device number 82 using dummy_hcd [ 521.713330][T14742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.713706][T14742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.716780][T14742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.754382][T14742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.755044][T14742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.758692][T14742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.794627][T14742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.794922][T14742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.795824][T14742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.798328][T14742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.811666][T14742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.818270][T14742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.825689][T13135] usb 8-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 521.827080][T13135] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 521.827102][T13135] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 521.828078][T13135] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=249 [ 521.828101][T13135] usb 8-1: SerialNumber: syz [ 521.860631][T13135] usb 8-1: config 0 descriptor?? [ 521.875703][T13135] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 521.875808][T13135] dvb-usb: bulk message failed: -22 (3/0) [ 521.938864][T13135] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 521.946191][T13135] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 521.946254][T13135] usb 8-1: media controller created [ 521.949301][T13135] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 521.960077][T13135] dvb-usb: bulk message failed: -22 (6/0) [ 521.960154][T13135] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 521.987629][T13135] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.7/usb8/8-1/input/input57 [ 522.003812][T13135] dvb-usb: schedule remote query interval to 150 msecs. [ 522.003827][T13135] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 522.159685][T13135] dvb-usb: bulk message failed: -22 (1/0) [ 522.159715][T13135] dvb-usb: error while querying for an remote control event. [ 522.319426][T13135] dvb-usb: bulk message failed: -22 (1/0) [ 522.319458][T13135] dvb-usb: error while querying for an remote control event. [ 522.457438][T14748] input: syz1 as /devices/virtual/input/input58 [ 522.479601][ T8067] dvb-usb: bulk message failed: -22 (1/0) [ 522.479632][ T8067] dvb-usb: error while querying for an remote control event. [ 522.561540][T12100] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 522.561602][T12100] Bluetooth: hci0: Injecting HCI hardware error event [ 522.562937][T12100] Bluetooth: hci0: hardware error 0x00 [ 522.639411][ T8067] dvb-usb: bulk message failed: -22 (1/0) [ 522.639445][ T8067] dvb-usb: error while querying for an remote control event. [ 522.709328][T13135] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 522.799283][ T8067] dvb-usb: bulk message failed: -22 (1/0) [ 522.799310][ T8067] dvb-usb: error while querying for an remote control event. [ 522.870947][T13135] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 522.874264][T13135] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.874288][T13135] usb 5-1: Product: syz [ 522.874303][T13135] usb 5-1: Manufacturer: syz [ 522.874318][T13135] usb 5-1: SerialNumber: syz [ 522.876182][T13135] usb 5-1: config 0 descriptor?? [ 522.959557][ T8067] dvb-usb: bulk message failed: -22 (1/0) [ 522.959603][ T8067] dvb-usb: error while querying for an remote control event. [ 523.068713][T14750] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.080713][T13135] usb 5-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 523.082593][T14750] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 523.120761][ T1191] dvb-usb: bulk message failed: -22 (1/0) [ 523.120781][ T1191] dvb-usb: error while querying for an remote control event. [ 523.255166][T14757] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2154'. [ 523.279651][ T1191] dvb-usb: bulk message failed: -22 (1/0) [ 523.279681][ T1191] dvb-usb: error while querying for an remote control event. [ 523.453168][ T1191] dvb-usb: bulk message failed: -22 (1/0) [ 523.453193][ T1191] dvb-usb: error while querying for an remote control event. [ 523.490130][T13135] usb write operation failed. (-71) [ 523.512370][T13135] usb 5-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 523.512740][T13135] usb write operation failed. (-71) [ 523.520843][T13135] usb 5-1: USB disconnect, device number 15 [ 523.609198][ T1191] dvb-usb: bulk message failed: -22 (1/0) [ 523.609231][ T1191] dvb-usb: error while querying for an remote control event. [ 523.622960][T14763] netlink: 256 bytes leftover after parsing attributes in process `syz.8.2156'. [ 523.623172][T14763] unsupported nlmsg_type 40 [ 523.681756][T14766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.682289][T14766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 523.685895][T14766] loop2: detected capacity change from 0 to 7 [ 523.686718][T14766] Dev loop2: unable to read RDB block 7 [ 523.686756][T14766] loop2: unable to read partition table [ 523.686974][T14766] loop2: partition table beyond EOD, truncated [ 523.687000][T14766] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 523.770008][T13135] dvb-usb: bulk message failed: -22 (1/0) [ 523.770040][T13135] dvb-usb: error while querying for an remote control event. [ 523.929712][T13135] dvb-usb: bulk message failed: -22 (1/0) [ 523.932389][T13135] dvb-usb: error while querying for an remote control event. [ 524.090402][ T1191] dvb-usb: bulk message failed: -22 (1/0) [ 524.090435][ T1191] dvb-usb: error while querying for an remote control event. [ 524.176605][T14773] IPVS: set_ctl: invalid protocol: 120 172.20.20.27:20002 [ 524.249265][ T1191] dvb-usb: bulk message failed: -22 (1/0) [ 524.249297][ T1191] dvb-usb: error while querying for an remote control event. [ 524.251545][T14777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.253113][T14777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.314977][ T5725] usb 8-1: USB disconnect, device number 82 [ 524.388937][T14781] tipc: Enabled bearer , priority 0 [ 524.406435][ T5725] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 524.644094][T12100] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 524.690675][T14775] tipc: Disabling bearer [ 524.759212][ T5725] usb 8-1: new high-speed USB device number 83 using dummy_hcd [ 524.910067][ T5725] usb 8-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 524.911854][ T5725] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 524.919004][ T5725] usb 8-1: config 0 descriptor?? [ 524.948968][ T5725] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 525.167717][T14791] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 525.558265][T14795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 525.569622][T14795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.572398][T14784] loop4: detected capacity change from 0 to 2640 [ 525.662276][T14784] buffer_io_error: 320 callbacks suppressed [ 525.663563][T14784] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 525.663745][T14784] Buffer I/O error on dev loop4, logical block 1, lost async page write [ 525.663909][T14784] Buffer I/O error on dev loop4, logical block 2, lost async page write [ 525.664026][T14784] Buffer I/O error on dev loop4, logical block 3, lost async page write [ 525.664158][T14784] Buffer I/O error on dev loop4, logical block 4, lost async page write [ 525.664271][T14784] Buffer I/O error on dev loop4, logical block 5, lost async page write [ 525.664293][T14784] Buffer I/O error on dev loop4, logical block 6, lost async page write [ 525.664307][T14784] Buffer I/O error on dev loop4, logical block 7, lost async page write [ 525.664320][T14784] Buffer I/O error on dev loop4, logical block 8, lost async page write [ 525.664332][T14784] Buffer I/O error on dev loop4, logical block 9, lost async page write [ 525.773320][ T5725] usb 8-1: USB disconnect, device number 83 [ 526.426911][T14819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.427173][T14819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.462375][T14803] program syz.2.2169 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 526.589459][ T5725] usb 8-1: new high-speed USB device number 84 using dummy_hcd [ 526.658966][T14822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.661242][T14822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.749203][ T5725] usb 8-1: Using ep0 maxpacket: 8 [ 526.873829][T14824] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2175'. [ 526.902122][ T5725] usb 8-1: unable to get BOS descriptor or descriptor too short [ 526.902172][ T5725] usb 8-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 526.902998][ T5725] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 526.903034][ T5725] usb 8-1: can't read configurations, error -71 [ 526.948497][T14828] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2175'. [ 526.954241][T14828] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2175'. [ 526.966713][T14828] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 527.188132][T14834] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2177'. [ 527.317790][T14838] netlink: 'syz.6.2179': attribute type 1 has an invalid length. [ 527.383509][T14842] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(3) [ 527.383534][T14842] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 527.389852][T14842] vhci_hcd vhci_hcd.0: Device attached [ 527.423987][T14843] vhci_hcd: connection closed [ 527.424653][ T13] vhci_hcd vhci_hcd.8: stop threads [ 527.424679][ T13] vhci_hcd vhci_hcd.8: release socket [ 527.424710][ T13] vhci_hcd vhci_hcd.8: disconnect device [ 527.465518][T14838] bond1: entered promiscuous mode [ 527.465924][T14838] 8021q: adding VLAN 0 to HW filter on device bond1 [ 527.512943][T14848] bond1: (slave bridge1): making interface the new active one [ 527.512968][T14848] bridge1: entered promiscuous mode [ 527.514114][T14848] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 527.959216][ T5725] usb 8-1: new high-speed USB device number 86 using dummy_hcd [ 528.109541][ T5725] usb 8-1: Using ep0 maxpacket: 8 [ 528.116021][ T5725] usb 8-1: unable to get BOS descriptor or descriptor too short [ 528.116083][ T5725] usb 8-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 528.117071][ T5725] usb 8-1: config 4 interface 0 has no altsetting 0 [ 528.123764][ T5725] usb 8-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 528.123789][ T5725] usb 8-1: Manufacturer: syz [ 528.123804][ T5725] usb 8-1: SerialNumber: syz [ 528.209528][ T1191] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 528.326128][T14885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.326655][T14885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.360122][ T1191] usb 5-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 528.363447][ T1191] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 528.363472][ T1191] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 528.363494][ T1191] usb 5-1: config 0 has no interface number 0 [ 528.408123][ T1191] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.408144][ T1191] usb 5-1: Product: syz [ 528.408158][ T1191] usb 5-1: Manufacturer: syz [ 528.408172][ T1191] usb 5-1: SerialNumber: syz [ 528.432680][ T1191] usb 5-1: config 0 descriptor?? [ 528.524807][ T5725] usb 8-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 528.572703][ T5725] usb 8-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 528.573112][ T5725] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 528.573148][ T5725] usb 8-1: media controller created [ 528.627468][ T5725] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 528.857738][ T5725] zl10353_read_register: readreg error (reg=127, ret==0) [ 528.922419][T14885] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 528.970698][ T31] kauditd_printk_skb: 126 callbacks suppressed [ 528.970713][ T31] audit: type=1800 audit(1790929816.627:11527): pid=14885 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2193" name="SYSV00000000" dev="tmpfs" ino=15 res=0 errno=0 [ 529.055378][ T5725] usb 8-1: USB disconnect, device number 86 [ 529.427795][T14892] fuse: Bad value for 'user_id' [ 529.427808][T14892] fuse: Bad value for 'user_id' [ 529.478986][T14892] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 529.488598][T14892] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 529.531615][ T8067] usb 8-1: new full-speed USB device number 87 using dummy_hcd [ 529.699715][ T8067] usb 8-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 529.702555][ T8067] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 529.702607][ T8067] usb 8-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 529.704550][ T8067] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.704564][ T8067] usb 8-1: Product: syz [ 529.704572][ T8067] usb 8-1: Manufacturer: syz [ 529.704580][ T8067] usb 8-1: SerialNumber: syz [ 530.239959][T14905] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2198'. [ 530.366730][T14912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.367266][T14912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.492794][T14914] veth1_to_bond: entered allmulticast mode [ 530.497136][T14914] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2201'. [ 530.498622][T14914] veth1_to_bond (unregistering): left allmulticast mode [ 530.538932][ C0] usb 8-1: received EP1 urb->status = -71 [ 530.924835][ T1191] usb-storage 5-1:0.1: USB Mass Storage device detected [ 530.944620][ T1191] usb-storage 5-1:0.1: Quirks match for vid 1908 pid 1315: 20000 [ 530.996750][ T1191] usb 5-1: USB disconnect, device number 16 [ 531.364583][ T8067] usb 8-1: unable to init card! (ret=-19) [ 531.367803][ T8067] usb 8-1: USB disconnect, device number 87 [ 531.572440][T14941] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2209'. [ 531.681191][ T8067] usb 8-1: new high-speed USB device number 88 using dummy_hcd [ 531.840497][ T8067] usb 8-1: Using ep0 maxpacket: 8 [ 531.842480][ T8067] usb 8-1: New USB device found, idVendor=057e, idProduct=2017, bcdDevice= 0.40 [ 531.843671][ T8067] usb 8-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 531.843701][ T8067] usb 8-1: config 1 interface 0 has no altsetting 0 [ 531.938571][T14947] 8021q: adding VLAN 0 to HW filter on device team0 [ 531.958118][T14947] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 532.047209][T14947] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 532.047237][T14947] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 532.125250][T14947] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 532.167711][T14947] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 532.177349][T14947] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 532.187603][T14947] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 532.198385][T14947] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 532.206583][T14947] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 532.381245][T14947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.381760][T14947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.442799][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.442855][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.442890][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.533402][T13405] bond0: (slave netdevsim1): link status definitely down, disabling slave [ 532.536357][T13405] bond0: now running without any active interface! [ 532.548118][ T153] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.681102][T14959] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2214'. [ 533.070297][ T5725] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 533.223554][ T5725] usb 5-1: Using ep0 maxpacket: 16 [ 533.225425][ T5725] usb 5-1: New USB device found, idVendor=0b05, idProduct=18c6, bcdDevice= 0.00 [ 533.228174][ T5725] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 533.228205][ T5725] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 533.228233][ T5725] usb 5-1: config 0 interface 0 has no altsetting 0 [ 533.228266][ T5725] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.239320][ T5725] usb 5-1: config 0 descriptor?? [ 533.682320][T14961] vlan2: entered promiscuous mode [ 533.682345][T14961] bond0: entered promiscuous mode [ 533.722915][T14972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 533.725504][T14972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.773608][ T5725] usbhid 5-1:0.0: can't add hid device: -71 [ 533.773716][ T5725] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 533.787712][ T5725] usb 5-1: USB disconnect, device number 17 [ 534.212412][ T8067] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.231486][ T8067] usb 8-1: can't set config #1, error -71 [ 534.237031][ T8067] usb 8-1: USB disconnect, device number 88 [ 534.272357][ T5617] udevd[5617]: setting mode of /dev/bus/usb/008/088 to 020664 failed: No such file or directory [ 534.272471][ T5617] udevd[5617]: setting owner of /dev/bus/usb/008/088 to uid=0, gid=0 failed: No such file or directory [ 534.705653][T14989] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2220'. [ 534.815309][T14991] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.815924][T14991] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.819355][ T8067] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 534.991119][ T8067] usb 5-1: New USB device found, idVendor=1199, idProduct=0fff, bcdDevice= 0.00 [ 534.992481][ T8067] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 534.992509][ T8067] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 534.992554][ T8067] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 535.044237][ T8067] usb-storage 5-1:1.0: USB Mass Storage device detected [ 535.204222][T14995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.204696][T14995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.208173][T14995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.210370][T14995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.444186][ T8067] usb-storage 5-1:1.0: probe with driver usb-storage failed with error -5 [ 535.451890][ T8067] usb 5-1: USB disconnect, device number 18 [ 536.127769][T15012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 536.128057][T15012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.262454][ T8067] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 536.420987][ T8067] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 536.422596][ T8067] usb 5-1: config 0 interface 0 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 61 [ 536.422613][ T8067] usb 5-1: config 0 interface 0 has no altsetting 0 [ 536.425390][ T8067] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 536.425406][ T8067] usb 5-1: Product: syz [ 536.425414][ T8067] usb 5-1: Manufacturer: syz [ 536.425421][ T8067] usb 5-1: SerialNumber: syz [ 536.434628][ T8067] usb 5-1: config 0 descriptor?? [ 536.436762][T15008] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 536.514378][ T8067] usb 5-1: selecting invalid altsetting 0 [ 536.744752][T15008] usb 5-1: BOGUS urb xfer, pipe 0 != type 3 [ 537.607852][T15023] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 537.611007][T15023] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 537.709226][ T8076] usb 8-1: new high-speed USB device number 89 using dummy_hcd [ 537.859317][ T8076] usb 8-1: Using ep0 maxpacket: 32 [ 537.860884][ T8076] usb 8-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 537.864227][ T8076] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.864251][ T8076] usb 8-1: Product: syz [ 537.864267][ T8076] usb 8-1: Manufacturer: syz [ 537.864290][ T8076] usb 8-1: SerialNumber: syz [ 537.867885][ T8076] usb 8-1: config 0 descriptor?? [ 538.073865][ T8076] airspy 8-1:0.0: Board ID: 00 [ 538.073959][ T8076] airspy 8-1:0.0: Firmware version: [ 538.160127][T15034] syzkaller0: entered promiscuous mode [ 538.160146][T15034] syzkaller0: entered allmulticast mode [ 538.163740][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.164764][T15034] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.168645][T15034] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2237'. [ 538.290451][ T8076] airspy 8-1:0.0: Registered as swradio24 [ 538.290475][ T8076] airspy 8-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 538.535707][ T8076] usb 5-1: USB disconnect, device number 19 [ 538.704700][T15049] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 538.831464][T15051] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2242'. [ 538.887299][T15052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.887861][T15052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.906974][T15052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.907373][T15052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.038592][T15057] raw_sendmsg: syz.8.2244 forgot to set AF_INET. Fix it! [ 539.055867][T15057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.058138][T15057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.165314][T15061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2246'. [ 540.130144][T15084] netlink: 'syz.6.2250': attribute type 4 has an invalid length. [ 540.437210][ T5725] usb 8-1: USB disconnect, device number 89 [ 540.497028][T15097] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 540.497450][T15097] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 540.499833][T15098] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 540.502610][T15098] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 540.524776][ T989] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 540.580890][T15100] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 540.660144][ T989] usb 5-1: device descriptor read/64, error -71 [ 540.899300][ T989] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 541.029229][ T989] usb 5-1: device descriptor read/64, error -71 [ 541.095916][T15118] netlink: 100 bytes leftover after parsing attributes in process `syz.7.2259'. [ 541.095939][T15118] tc_dump_action: action bad kind [ 541.131879][T15118] ip_tables: iptables: counters copy to user failed while replacing table [ 541.149860][ T989] usb usb5-port1: attempt power cycle [ 541.479278][ T5725] usb 8-1: new high-speed USB device number 90 using dummy_hcd [ 541.497050][ T989] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 541.520511][ T989] usb 5-1: device descriptor read/8, error -71 [ 541.629996][ T5725] usb 8-1: Using ep0 maxpacket: 32 [ 541.630618][ T5725] usb 8-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 541.631619][ T5725] usb 8-1: config 0 has an invalid interface number: 67 but max is 0 [ 541.631644][ T5725] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 541.631663][ T5725] usb 8-1: config 0 has no interface number 0 [ 541.631702][ T5725] usb 8-1: config 0 interface 67 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 541.637245][ T5725] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.637268][ T5725] usb 8-1: Product: syz [ 541.637281][ T5725] usb 8-1: Manufacturer: syz [ 541.637294][ T5725] usb 8-1: SerialNumber: syz [ 541.716007][ T5725] usb 8-1: config 0 descriptor?? [ 541.727874][ T5725] smsc95xx 8-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 541.728110][ T5725] smsc95xx 8-1:0.67: probe with driver smsc95xx failed with error -22 [ 541.769222][ T989] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 541.790533][ T989] usb 5-1: device descriptor read/8, error -71 [ 541.902040][ T989] usb usb5-port1: unable to enumerate USB device [ 541.973852][T15136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 541.974270][T15136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 542.616043][T15143] loop2: detected capacity change from 0 to 7 [ 542.617335][T15143] Dev loop2: unable to read RDB block 7 [ 542.617377][T15143] loop2: unable to read partition table [ 542.617503][T15143] loop2: partition table beyond EOD, truncated [ 542.617521][T15143] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 542.683058][T15145] input: syz0 as /devices/virtual/input/input59 [ 542.960684][T15152] CUSE: unknown device info "n|zQC*" [ 542.960704][T15152] CUSE: unknown device info ">2a" V|#ySioL89IܥѮÇ[<^Q>nHw'0QV,${\d+" [ 542.960728][T15152] CUSE: unknown device info "" [ 542.960739][T15152] CUSE: unknown device info "LPt|%IOKu GǪ|Q(o9{u[赨gIPYV" [ 542.960751][T15152] CUSE: DEVNAME unspecified [ 543.422963][T15165] batadv0: entered promiscuous mode [ 543.442668][T15165] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 543.446202][T15165] batadv0: left promiscuous mode [ 543.609434][ T1191] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 543.664072][T15167] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 543.739334][ T1191] usb 5-1: device descriptor read/64, error -71 [ 543.979342][ T1191] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 544.109325][ T1191] usb 5-1: device descriptor read/64, error -71 [ 544.222618][ T1191] usb usb5-port1: attempt power cycle [ 544.237722][ T8076] usb 8-1: USB disconnect, device number 90 [ 544.504309][T15188] vim2m vim2m.0: Fourcc format (0x42474752) invalid. [ 544.559813][ T1191] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 544.592664][ T1191] usb 5-1: device descriptor read/8, error -71 [ 544.815554][T15200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 544.815813][T15200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 544.836737][ T1191] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 544.839398][T15200] fuse: Unknown parameter '90xffffffffffffffffUv1tz}' [ 544.870001][ T1191] usb 5-1: device descriptor read/8, error -71 [ 544.979711][ T1191] usb usb5-port1: unable to enumerate USB device [ 545.518134][T15215] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2280'. [ 545.518162][T15215] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2280'. [ 545.518198][T15215] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2280'. [ 545.717698][T15222] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 545.739761][T15219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 545.741884][T15219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.881527][T15225] syzkaller1: entered promiscuous mode [ 545.881543][T15225] syzkaller1: entered allmulticast mode [ 546.408843][T15231] syzkaller1: entered promiscuous mode [ 546.412242][T15231] syzkaller1: entered allmulticast mode [ 546.752008][T15246] kvm: pic: non byte write [ 546.752163][T15246] kvm: pic: non byte write [ 546.754356][T15246] kvm: pic: non byte write [ 546.755382][T15246] kvm: pic: non byte write [ 546.755519][T15246] kvm: pic: non byte write [ 546.757025][T15246] kvm: pic: non byte write [ 546.757167][T15246] kvm: pic: non byte write [ 546.757296][T15246] kvm: pic: non byte write [ 546.757747][T15246] kvm: pic: non byte write [ 546.757988][T15246] kvm: pic: non byte write [ 547.009295][ T989] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 547.184451][ T989] usb 5-1: unable to get BOS descriptor or descriptor too short [ 547.184911][ T989] usb 5-1: not running at top speed; connect to a high speed hub [ 547.184940][ T989] usb 5-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=df.d2 [ 547.186209][ T989] usb 5-1: config 2 has an invalid interface number: 72 but max is 0 [ 547.186233][ T989] usb 5-1: config 2 has no interface number 0 [ 547.186269][ T989] usb 5-1: config 2 interface 72 altsetting 8 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 547.186297][ T989] usb 5-1: config 2 interface 72 has no altsetting 0 [ 547.230795][ T989] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.230812][ T989] usb 5-1: Product: syz [ 547.230820][ T989] usb 5-1: Manufacturer: syz [ 547.230828][ T989] usb 5-1: SerialNumber: syz [ 547.419808][T15251] tipc: Started in network mode [ 547.419843][T15251] tipc: Node identity ac1414aa, cluster identity 8 [ 547.475101][ T989] ati_remote 5-1:2.72: ati_remote_probe: Unexpected endpoint_in [ 547.502308][ T989] usb 5-1: USB disconnect, device number 28 [ 547.524431][T15251] tipc: Enabled bearer , priority 10 [ 547.566996][T15251] tipc: Enabling of bearer rejected, failed to enable media [ 547.741950][T15256] netlink: 100 bytes leftover after parsing attributes in process `syz.6.2294'. [ 547.742026][T15256] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2294'. [ 547.742035][T15256] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2294'. [ 547.942503][T15258] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2295'. [ 548.114495][T15265] vim2m vim2m.0: Fourcc format (0x42474752) invalid. [ 548.212377][T15269] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.213113][T15269] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.277507][T15269] bridge0: port 1(wlan1) entered blocking state [ 548.277866][T15269] bridge0: port 1(wlan1) entered disabled state [ 548.277985][T15269] mac80211_hwsim hwsim4 wlan1: entered allmulticast mode [ 548.589231][ T5725] tipc: Node number set to 2886997162 [ 548.655885][T15282] program syz.8.2302 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 548.656164][T15282] netlink: 60 bytes leftover after parsing attributes in process `syz.8.2302'. [ 548.677623][ T8067] usb 8-1: new high-speed USB device number 91 using dummy_hcd [ 548.799352][ T8067] usb 8-1: device descriptor read/64, error -71 [ 548.816450][T15282] 8021q: adding VLAN 0 to HW filter on device bond0 [ 548.826920][T15282] 8021q: adding VLAN 0 to HW filter on device team0 [ 548.843138][T15282] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 548.987441][T15282] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 548.987458][T15282] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 549.024960][T15282] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 549.049361][ T8067] usb 8-1: new high-speed USB device number 92 using dummy_hcd [ 549.179793][ T8067] usb 8-1: device descriptor read/64, error -71 [ 549.289409][ T8067] usb usb8-port1: attempt power cycle [ 549.293260][T15294] syzkaller1: entered promiscuous mode [ 549.293275][T15294] syzkaller1: entered allmulticast mode [ 549.550697][T15296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.550954][T15296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.629217][ T8067] usb 8-1: new high-speed USB device number 93 using dummy_hcd [ 549.649891][ T8067] usb 8-1: device descriptor read/8, error -71 [ 549.700346][ T31] audit: type=1326 audit(1790929837.407:11528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3717b9e159 code=0x7ffc0000 [ 549.700894][ T31] audit: type=1326 audit(1790929837.407:11529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f3717b9e159 code=0x7ffc0000 [ 549.702300][ T31] audit: type=1326 audit(1790929837.407:11530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3717b9e159 code=0x7ffc0000 [ 549.702696][ T31] audit: type=1326 audit(1790929837.407:11531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3717b9e159 code=0x7ffc0000 [ 549.720039][ T31] audit: type=1326 audit(1790929837.427:11532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f3717b9ddeb code=0x7ffc0000 [ 549.720257][ T31] audit: type=1326 audit(1790929837.427:11533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3717b9e159 code=0x7ffc0000 [ 549.720535][ T31] audit: type=1326 audit(1790929837.427:11534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3717b9e159 code=0x7ffc0000 [ 549.727804][ T31] audit: type=1326 audit(1790929837.427:11535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f3717b9ddeb code=0x7ffc0000 [ 549.820269][ T31] audit: type=1326 audit(1790929837.527:11536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3717b9e159 code=0x7ffc0000 [ 549.820492][ T31] audit: type=1326 audit(1790929837.527:11537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15299 comm="syz.2.2308" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3717b9e159 code=0x7ffc0000 [ 550.037106][T15300] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2308'. [ 550.090486][ T8067] usb 8-1: new high-speed USB device number 94 using dummy_hcd [ 550.120164][ T8067] usb 8-1: device descriptor read/8, error -71 [ 550.229522][ T8067] usb usb8-port1: unable to enumerate USB device [ 550.262377][T15309] netlink: 44 bytes leftover after parsing attributes in process `syz.8.2312'. [ 551.072507][T15345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 551.072746][T15345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.354448][T15347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 551.355128][T15347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.358974][T15347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 551.388023][T15347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.848976][T15352] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 552.035760][T15362] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 552.052146][T15362] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 552.209228][ T989] usb 8-1: new high-speed USB device number 95 using dummy_hcd [ 552.366229][ T989] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 552.367520][ T989] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 552.367568][ T989] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 552.367582][ T989] usb 8-1: config 0 interface 0 has no altsetting 0 [ 552.405038][T13133] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 552.405520][ T989] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 552.405544][ T989] usb 8-1: Product: syz [ 552.405559][ T989] usb 8-1: Manufacturer: syz [ 552.405574][ T989] usb 8-1: SerialNumber: syz [ 552.409211][ T989] usb 8-1: config 0 descriptor?? [ 552.411776][ T989] hub 8-1:0.0: bad descriptor, ignoring hub [ 552.411799][ T989] hub 8-1:0.0: probe with driver hub failed with error -5 [ 552.414934][ T989] usb 8-1: selecting invalid altsetting 0 [ 552.550075][T13133] usb 5-1: Using ep0 maxpacket: 16 [ 552.550773][T13133] usb 5-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 552.553124][T13133] usb 5-1: config 0 interface 0 altsetting 5 has an endpoint descriptor with address 0x38, changing to 0x8 [ 552.553155][T13133] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x8 has invalid maxpacket 51965, setting to 1024 [ 552.553182][T13133] usb 5-1: config 0 interface 0 altsetting 5 bulk endpoint 0x8 has invalid maxpacket 1024 [ 552.553205][T13133] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 552.553228][T13133] usb 5-1: config 0 interface 0 has no altsetting 0 [ 552.553247][T13133] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.556542][T13133] usb 5-1: config 0 descriptor?? [ 552.558547][T15369] raw-gadget.5 gadget.4: fail, usb_ep_enable returned -22 [ 552.651680][T13133] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 552.769458][ T989] usb 8-1: USB disconnect, device number 95 [ 552.826525][T15382] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 552.826546][T15382] IPv6: NLM_F_CREATE should be set when creating new route [ 553.535769][T15396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 553.536204][T15396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.078209][T15412] __nla_validate_parse: 2 callbacks suppressed [ 554.078231][T15412] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2343'. [ 554.439186][ T989] usb 8-1: new full-speed USB device number 96 using dummy_hcd [ 554.591070][ T989] usb 8-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 554.592110][ T989] usb 8-1: config 0 has an invalid interface number: 143 but max is 0 [ 554.592127][ T989] usb 8-1: config 0 has an invalid descriptor of length 129, skipping remainder of the config [ 554.592138][ T989] usb 8-1: config 0 has no interface number 0 [ 554.592328][ T989] usb 8-1: too many endpoints for config 0 interface 143 altsetting 112: 149, using maximum allowed: 30 [ 554.592373][ T989] usb 8-1: config 0 interface 143 altsetting 112 has 0 endpoint descriptors, different from the interface descriptor's value: 149 [ 554.592401][ T989] usb 8-1: config 0 interface 143 has no altsetting 0 [ 554.597116][ T989] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.597143][ T989] usb 8-1: Product: syz [ 554.597158][ T989] usb 8-1: Manufacturer: syz [ 554.597173][ T989] usb 8-1: SerialNumber: syz [ 554.646663][ T989] usb 8-1: config 0 descriptor?? [ 554.928057][ T989] usb 8-1: USB disconnect, device number 96 [ 555.118166][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118204][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118225][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118239][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118274][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118288][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118302][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118316][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118330][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118344][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118357][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118371][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118385][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118399][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118413][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.118426][T15412] IPVS: set_ctl: invalid protocol: 44 172.30.1.8:19999 [ 555.130968][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131019][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131042][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131065][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131087][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131109][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131130][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131153][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131174][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131204][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131226][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131248][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131270][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131292][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131314][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131335][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131358][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131380][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131402][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131423][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131445][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131467][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131488][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131510][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131532][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131553][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131575][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131597][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131619][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131641][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131662][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131684][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131707][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131728][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131749][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131771][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131793][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131814][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131836][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131857][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131878][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131901][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131922][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131943][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131965][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.131987][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.132009][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.132030][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.132051][T15412] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 555.654460][ T5725] usb 5-1: USB disconnect, device number 29 [ 556.340864][T15431] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2348'. [ 556.375653][T15431] bond3: Unable to set peer notification delay as MII monitoring is disabled [ 556.377233][T15431] bond3 (unregistering): Released all slaves [ 556.406709][T15433] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2348'. [ 556.459622][T15433] bond3: Unable to set peer notification delay as MII monitoring is disabled [ 556.461144][T15433] bond3 (unregistering): Released all slaves [ 558.079244][ T8067] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 558.160993][T15466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.163702][T15466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.253442][ T8067] usb 5-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 558.254562][ T8067] usb 5-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 558.254587][ T8067] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 558.254606][ T8067] usb 5-1: config 0 has no interfaces? [ 558.254636][ T8067] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.258633][ T8067] usb 5-1: config 0 descriptor?? [ 558.477687][ T5725] usb 5-1: USB disconnect, device number 30 [ 558.709183][ T8067] usb 8-1: new high-speed USB device number 97 using dummy_hcd [ 558.767711][T15477] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.767963][T15477] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.797714][T15477] netlink: 60 bytes leftover after parsing attributes in process `syz.8.2360'. [ 558.816633][T15477] fuse: Unknown parameter '90xffffffffffffffffUv1tz}' [ 558.869452][ T8067] usb 8-1: Using ep0 maxpacket: 16 [ 558.870179][ T8067] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 558.871288][ T8067] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 558.871306][ T8067] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 558.871319][ T8067] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 558.871342][ T8067] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.873394][ T8067] usb 8-1: config 0 descriptor?? [ 559.106675][T15473] ovs-dp0: entered promiscuous mode [ 559.331947][T15473] sctp: [Deprecated]: syz.7.2359 (pid 15473) Use of struct sctp_assoc_value in delayed_ack socket option. [ 559.331947][T15473] Use struct sctp_sack_info instead [ 559.358747][ T8067] usbhid 8-1:0.0: can't add hid device: -71 [ 559.358853][ T8067] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 559.385282][ T8067] usb 8-1: USB disconnect, device number 97 [ 559.399242][ T8063] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 559.425940][T15489] loop2: detected capacity change from 0 to 7 [ 559.445116][T15489] Dev loop2: unable to read RDB block 7 [ 559.445162][T15489] loop2: unable to read partition table [ 559.445370][T15489] loop2: partition table beyond EOD, truncated [ 559.445410][T15489] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 559.445605][T15491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.447253][T15491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.549242][ T8063] usb 5-1: Using ep0 maxpacket: 16 [ 559.549856][ T8063] usb 5-1: New USB device found, idVendor=056a, idProduct=033e, bcdDevice= 0.40 [ 559.550680][ T8063] usb 5-1: config 1 interface 0 altsetting 1 endpoint 0x2 has an invalid bInterval 128, changing to 11 [ 559.550701][ T8063] usb 5-1: config 1 interface 0 has no altsetting 0 [ 559.552838][ T8063] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.552853][ T8063] usb 5-1: Product: syz [ 559.552861][ T8063] usb 5-1: Manufacturer: ❬ᾇ鲖죁蟍㴌෮恂峛ꤙᨙ駊淂⠗疼섇撼㳥趉గ㿫鰦䪚卿鮬溁袴玎Ԝ硺該㯵ꛡꤠ媁ⴣズ븤岒禍崱淜飶ᅑ瀕㇄촇⩉땸骑࿒쁭ꢵιޡ：嵠祈痦ﰜ᱈懪⸠䚬㘙杙曟楜㣈쥗 [ 559.552875][ T8063] usb 5-1: SerialNumber: syz [ 559.697394][T15497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.698010][T15497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.704943][T15497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.705475][T15497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.772150][ T8063] usbhid 5-1:1.0: can't add hid device: -71 [ 559.772217][ T8063] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 559.777470][ T8063] usb 5-1: USB disconnect, device number 31 [ 560.452538][T15516] xt_ipcomp: unknown flags 1D [ 560.511262][T15519] FAULT_INJECTION: forcing a failure. [ 560.511262][T15519] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 560.511297][T15519] CPU: 0 UID: 0 PID: 15519 Comm: syz.2.2374 Tainted: G L syzkaller #0 PREEMPT(full) [ 560.511325][T15519] Tainted: [L]=SOFTLOCKUP [ 560.511333][T15519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 560.511345][T15519] Call Trace: [ 560.511354][T15519] [ 560.511364][T15519] dump_stack_lvl+0xe8/0x150 [ 560.511400][T15519] should_fail_ex+0x410/0x560 [ 560.511565][T15519] _copy_to_user+0x31/0xb0 [ 560.511656][T15519] simple_read_from_buffer+0xe1/0x170 [ 560.511693][T15519] proc_fail_nth_read+0x1bb/0x230 [ 560.511732][T15519] ? common_file_perm+0x20e/0x2b0 [ 560.511786][T15519] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 560.511811][T15519] ? rw_verify_area+0x24a/0x4c0 [ 560.511845][T15519] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 560.511865][T15519] vfs_read+0x213/0xa80 [ 560.511899][T15519] ? __pfx___mutex_lock+0x10/0x10 [ 560.511931][T15519] ? __pfx_vfs_read+0x10/0x10 [ 560.511962][T15519] ? __fget_files+0x2a/0x420 [ 560.511991][T15519] ? __fget_files+0x3a2/0x420 [ 560.512017][T15519] ? __fget_files+0x2a/0x420 [ 560.512059][T15519] ksys_read+0x150/0x270 [ 560.512080][T15519] ? __pfx_ksys_read+0x10/0x10 [ 560.512095][T15519] ? fput+0xa0/0xd0 [ 560.512124][T15519] do_syscall_64+0x166/0x520 [ 560.512149][T15519] ? trace_irq_disable+0x3b/0x140 [ 560.512170][T15519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.512191][T15519] ? clear_bhb_loop+0x70/0xc0 [ 560.512219][T15519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.512239][T15519] RIP: 0033:0x7f3717b5e98e [ 560.512259][T15519] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 560.512276][T15519] RSP: 002b:00007f3718b3dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 560.512298][T15519] RAX: ffffffffffffffda RBX: 00007f3718b3e6c0 RCX: 00007f3717b5e98e [ 560.512313][T15519] RDX: 000000000000000f RSI: 00007f3718b3e0a0 RDI: 0000000000000004 [ 560.512326][T15519] RBP: 00007f3718b3e090 R08: 0000000000000000 R09: 0000000000000000 [ 560.512340][T15519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 560.512353][T15519] R13: 00007f3717e26038 R14: 00007f3717e25fa0 R15: 00007f3717f4fa48 [ 560.512385][T15519] [ 560.812147][T15515] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2372'. [ 561.015337][T15528] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2376'. [ 561.128133][T15535] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.128549][T15535] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.289713][T13405] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 561.289787][T13405] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 561.289820][T13405] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 561.289853][T13405] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 561.644748][T15549] IPVS: set_ctl: invalid protocol: 46 10.1.1.0:20001 [ 561.812758][T15553] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2384'. [ 561.875948][T15562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.876342][T15562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.898483][ T8067] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 561.989196][T13135] usb 8-1: new high-speed USB device number 98 using dummy_hcd [ 562.051853][ T8067] usb 5-1: unable to get BOS descriptor or descriptor too short [ 562.052346][ T8067] usb 5-1: not running at top speed; connect to a high speed hub [ 562.052378][ T8067] usb 5-1: New USB device found, idVendor=15ca, idProduct=0101, bcdDevice= 0.40 [ 562.052412][ T8067] usb 5-1: too many configurations: 17, using maximum allowed: 8 [ 562.053344][ T8067] usb 5-1: config 1 has an invalid descriptor of length 59, skipping remainder of the config [ 562.053388][ T8067] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 562.054359][ T8067] usb 5-1: config 1 has an invalid descriptor of length 59, skipping remainder of the config [ 562.054403][ T8067] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 562.055372][ T8067] usb 5-1: config 1 has an invalid descriptor of length 59, skipping remainder of the config [ 562.055423][ T8067] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 562.056301][ T8067] usb 5-1: config 1 has an invalid descriptor of length 59, skipping remainder of the config [ 562.056343][ T8067] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 562.057254][ T8067] usb 5-1: config 1 has an invalid descriptor of length 59, skipping remainder of the config [ 562.057305][ T8067] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 562.058190][ T8067] usb 5-1: config 1 has an invalid descriptor of length 59, skipping remainder of the config [ 562.058233][ T8067] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 562.067306][ T8067] usb 5-1: config 1 has an invalid descriptor of length 59, skipping remainder of the config [ 562.067344][ T8067] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 562.079991][T15563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.080397][T15563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.140951][ T8067] usb 5-1: config 1 has an invalid descriptor of length 59, skipping remainder of the config [ 562.141004][ T8067] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 562.213208][T13135] usb 8-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 562.223917][ T8067] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.223945][ T8067] usb 5-1: Product: syz [ 562.223960][ T8067] usb 5-1: Manufacturer: syz [ 562.223975][ T8067] usb 5-1: SerialNumber: syz [ 562.334189][T13135] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.334216][T13135] usb 8-1: Product: syz [ 562.334231][T13135] usb 8-1: Manufacturer: syz [ 562.334247][T13135] usb 8-1: SerialNumber: syz [ 562.390846][T13135] usb 8-1: config 0 descriptor?? [ 562.404528][T13135] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 562.544040][T15549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.544484][T15549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.598331][ T8067] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 562.598373][ T8067] usb 5-1: MIDIStreaming interface descriptor not found [ 562.721792][ T8067] usb 5-1: USB disconnect, device number 32 [ 562.762870][ T5632] udevd[5632]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 562.804470][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.804530][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.311775][T15590] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2392'. [ 563.339976][T15590] syzkaller0: entered promiscuous mode [ 563.340011][T15590] syzkaller0: entered allmulticast mode [ 563.892505][T15599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 563.895415][T15599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.406959][T15604] could not allocate digest TFM handle [ 564.569237][ T8067] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 564.669781][T15613] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.670212][T15613] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.720096][ T8067] usb 5-1: Using ep0 maxpacket: 16 [ 564.722255][ T8067] usb 5-1: unable to get BOS descriptor or descriptor too short [ 564.722319][ T8067] usb 5-1: New USB device found, idVendor=1608, idProduct=0243, bcdDevice=c3.b4 [ 564.723240][ T8067] usb 5-1: config 6 has an invalid interface number: 233 but max is 0 [ 564.723265][ T8067] usb 5-1: config 6 has no interface number 0 [ 564.723304][ T8067] usb 5-1: config 6 interface 233 altsetting 8 endpoint 0xB has invalid maxpacket 1479, setting to 64 [ 564.723320][ T8067] usb 5-1: config 6 interface 233 altsetting 8 bulk endpoint 0xA has invalid maxpacket 1024 [ 564.723333][ T8067] usb 5-1: config 6 interface 233 has no altsetting 0 [ 564.725275][ T8067] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.725297][ T8067] usb 5-1: Product: syz [ 564.725306][ T8067] usb 5-1: Manufacturer: syz [ 564.725313][ T8067] usb 5-1: SerialNumber: syz [ 564.728499][T15603] raw-gadget.6 gadget.4: fail, usb_ep_enable returned -22 [ 564.762483][ T8063] usb 8-1: USB disconnect, device number 98 [ 564.837677][T15615] openvswitch: netlink: Multiple metadata blocks provided [ 564.886417][T15617] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 564.935818][ T8067] io_ti 5-1:6.233: required endpoints missing [ 564.954497][ T31] kauditd_printk_skb: 107 callbacks suppressed [ 564.954515][ T31] audit: type=1326 audit(1790929852.657:11645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 564.955046][ T8067] usb 5-1: USB disconnect, device number 33 [ 564.956515][ T31] audit: type=1326 audit(1790929852.657:11646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 564.957018][ T31] audit: type=1326 audit(1790929852.657:11647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 564.958924][ T31] audit: type=1326 audit(1790929852.657:11648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 564.958968][ T31] audit: type=1326 audit(1790929852.657:11649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 564.962051][ T31] audit: type=1326 audit(1790929852.667:11650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fec0439ddeb code=0x7ffc0000 [ 564.965658][ T31] audit: type=1326 audit(1790929852.667:11651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 564.965701][ T31] audit: type=1326 audit(1790929852.667:11652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 564.966341][ T31] audit: type=1326 audit(1790929852.667:11653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fec0439ddeb code=0x7ffc0000 [ 564.966383][ T31] audit: type=1326 audit(1790929852.667:11654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15619 comm="syz.7.2399" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec0439e159 code=0x7ffc0000 [ 565.055268][ T5633] udevd[5633]: setting mode of /dev/bus/usb/005/033 to 020664 failed: No such file or directory [ 565.055387][ T5633] udevd[5633]: setting owner of /dev/bus/usb/005/033 to uid=0, gid=0 failed: No such file or directory [ 565.407858][T15627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.408282][T15627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.604858][T15636] fuse: Unknown parameter '&' [ 565.627912][T15627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.643108][T15627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.898442][T15644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.898885][T15644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.907522][T15644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.919581][T15644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.921338][T15644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.921882][T15644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.930711][T15644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.931489][T15644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 566.672234][T15657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 566.678180][T15657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 566.750954][T15659] netlink: 14 bytes leftover after parsing attributes in process `syz.7.2411'. [ 566.757704][T15651] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 567.300906][T15670] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2413'. [ 567.617437][T15685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.617683][T15685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 567.872273][T15695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.872531][T15695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 567.990759][T15695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.998149][T15695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.025906][T15695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.026613][T15695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.061789][T15695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.062061][T15695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.063082][T15689] bond2: option packets_per_slave: mode dependency failed, not supported in mode balance-xor(2) [ 568.103963][T15689] bond2 (unregistering): Released all slaves [ 568.522963][T15703] ip_tables: iptables: counters copy to user failed while replacing table [ 568.610703][T15711] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.611191][T15711] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.874883][T15716] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2424'. [ 568.915621][T15716] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2424'. [ 568.916053][T15716] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2424'. [ 569.310759][T15727] input: syz1 as /devices/virtual/input/input60 [ 569.328564][T15727] vlan2: entered allmulticast mode [ 569.328585][T15727] bridge_slave_0: entered allmulticast mode [ 569.332366][T15727] bridge0: port 1(vlan2) entered blocking state [ 569.332634][T15727] bridge0: port 1(vlan2) entered disabled state [ 569.334950][T15727] vlan2: entered promiscuous mode [ 569.334969][T15727] bridge_slave_0: entered promiscuous mode [ 569.460339][ T1191] usb 8-1: new high-speed USB device number 99 using dummy_hcd [ 569.574995][T15729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 569.575419][T15729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.609231][ T1191] usb 8-1: Using ep0 maxpacket: 32 [ 569.611628][ T1191] usb 8-1: unable to get BOS descriptor or descriptor too short [ 569.611677][ T1191] usb 8-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0 [ 569.612716][ T1191] usb 8-1: config 3 has an invalid interface number: 223 but max is 1 [ 569.612740][ T1191] usb 8-1: config 3 has an invalid interface number: 25 but max is 1 [ 569.612760][ T1191] usb 8-1: config 3 has an invalid interface number: 223 but max is 1 [ 569.612779][ T1191] usb 8-1: config 3 has no interface number 0 [ 569.612795][ T1191] usb 8-1: config 3 has no interface number 1 [ 569.612842][ T1191] usb 8-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 569.612864][ T1191] usb 8-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30 [ 569.612901][ T1191] usb 8-1: config 3 interface 223 altsetting 155 has 0 endpoint descriptors, different from the interface descriptor's value: 82 [ 569.612928][ T1191] usb 8-1: config 3 interface 223 has no altsetting 1 [ 569.612975][ T1191] usb 8-1: config 3 interface 25 has no altsetting 0 [ 569.615402][ T1191] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 569.615426][ T1191] usb 8-1: Product: syz [ 569.615441][ T1191] usb 8-1: Manufacturer: syz [ 569.615456][ T1191] usb 8-1: SerialNumber: syz [ 570.010428][T15737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.012462][T15737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 570.127205][T15739] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.127741][T15739] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 570.146725][T15739] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.148507][T15739] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 570.216839][ T31] kauditd_printk_skb: 48 callbacks suppressed [ 570.216857][ T31] audit: type=1326 audit(1790929857.917:11703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15741 comm="syz.8.2433" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efc3b59e159 code=0x0 [ 570.276683][T15743] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.277215][T15743] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 570.782806][ T1191] usb 8-1: USB disconnect, device number 99 [ 570.838131][T15749] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 571.022436][T15760] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2435'. [ 571.070166][T15750] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2435'. [ 571.070951][T15750] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2435'. [ 571.142980][ T8067] hid_parser_main: 1 callbacks suppressed [ 571.143002][ T8067] hid-generic 0000:0000:0000.0025: unknown main item tag 0x0 [ 571.172545][ T8067] hid-generic 0000:0000:0000.0025: hidraw0: HID v0.00 Device [syz1] on syz0 [ 571.191014][ T1191] usb 8-1: new high-speed USB device number 100 using dummy_hcd [ 571.350221][ T1191] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 571.356309][ T1191] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.356337][ T1191] usb 8-1: Product: syz [ 571.356353][ T1191] usb 8-1: Manufacturer: syz [ 571.356369][ T1191] usb 8-1: SerialNumber: syz [ 571.436961][ T8067] usb 8-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 571.634607][T15778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.635143][T15778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.826262][T15783] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 572.316047][T13135] usb 8-1: USB disconnect, device number 100 [ 572.638106][T15787] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2445'. [ 572.684393][T15787] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2445'. [ 572.684481][T15787] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2445'. [ 572.811153][ T8067] usb 8-1: Service connection timeout for: 256 [ 572.811178][ T8067] ath9k_htc 8-1:1.0: ath9k_htc: Unable to initialize HTC services [ 572.811810][ T8067] ath9k_htc: Failed to initialize the device [ 572.812602][ C0] ================================================================== [ 572.812615][ C0] BUG: KASAN: slab-use-after-free in tasklet_action_common+0x103/0x490 [ 572.812665][ C0] Read of size 8 at addr ffff88803586e158 by task kworker/u8:1/13 [ 572.812681][ C0] [ 572.812694][ C0] CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 572.812720][ C0] Tainted: [L]=SOFTLOCKUP [ 572.812728][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 572.812741][ C0] Workqueue: iou_exit io_ring_exit_work [ 572.812780][ C0] Call Trace: [ 572.812788][ C0] [ 572.812798][ C0] dump_stack_lvl+0xe8/0x150 [ 572.812826][ C0] print_address_description+0x55/0x1e0 [ 572.812852][ C0] ? tasklet_action_common+0x103/0x490 [ 572.812879][ C0] print_report+0x58/0x70 [ 572.812902][ C0] kasan_report+0x117/0x150 [ 572.812931][ C0] ? tasklet_action_common+0x103/0x490 [ 572.812961][ C0] tasklet_action_common+0x103/0x490 [ 572.812989][ C0] handle_softirqs+0x226/0x860 [ 572.813015][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 572.813042][ C0] __irq_exit_rcu+0xcb/0x220 [ 572.813067][ C0] irq_exit_rcu+0x9/0x30 [ 572.813091][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 572.813121][ C0] [ 572.813128][ C0] [ 572.813136][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 572.813158][ C0] RIP: 0010:__read_once_word_nocheck+0x3/0x10 [ 572.813185][ C0] Code: f3 cf bf 00 e9 1e fd ff ff 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 8b 07 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 572.813204][ C0] RSP: 0018:ffffc900001273b8 EFLAGS: 00000202 [ 572.813222][ C0] RAX: ffffffff818fa8ad RBX: 1ffff92000024e8e RCX: 1ffff92000024e01 [ 572.813239][ C0] RDX: ffffc90000127ad8 RSI: 0000000000000002 RDI: ffffc90000127ad8 [ 572.813254][ C0] RBP: 1ffffffff22187bd R08: ffffc90000127ae0 R09: 0000000000000000 [ 572.813269][ C0] R10: ffffc900001274b8 R11: ffffffff81b2a310 R12: 1ffff92000024e8f [ 572.813286][ C0] R13: ffffc90000128000 R14: ffffc90000127468 R15: ffffc90000120000 [ 572.813304][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 572.813328][ C0] ? process_scheduled_works+0xc3d/0x1630 [ 572.813357][ C0] unwind_next_frame+0xca5/0x2550 [ 572.813382][ C0] ? io_ring_exit_work+0x43e/0x9a0 [ 572.813409][ C0] ? unwind_next_frame+0x8f/0x2550 [ 572.813430][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 572.813451][ C0] arch_stack_walk+0x11b/0x150 [ 572.813496][ C0] ? io_ring_exit_work+0x43e/0x9a0 [ 572.813528][ C0] stack_trace_save+0xa9/0x100 [ 572.813548][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 572.813573][ C0] kasan_save_stack+0x3e/0x60 [ 572.813595][ C0] ? kasan_save_stack+0x3e/0x60 [ 572.813616][ C0] ? kasan_record_aux_stack+0xbd/0xd0 [ 572.813648][ C0] ? call_rcu+0xee/0x8b0 [ 572.813671][ C0] ? kmem_cache_free+0x471/0x650 [ 572.813692][ C0] ? __io_req_caches_free+0x1be/0x270 [ 572.813719][ C0] ? io_req_caches_free+0x21/0x30 [ 572.813746][ C0] ? io_ring_exit_work+0x43e/0x9a0 [ 572.813791][ C0] ? __io_req_caches_free+0x1be/0x270 [ 572.813818][ C0] kasan_record_aux_stack+0xbd/0xd0 [ 572.813845][ C0] ? __pfx_slab_free_after_rcu_debug+0x10/0x10 [ 572.813870][ C0] call_rcu+0xee/0x8b0 [ 572.813895][ C0] ? __io_req_caches_free+0x1be/0x270 [ 572.813923][ C0] kmem_cache_free+0x471/0x650 [ 572.813947][ C0] __io_req_caches_free+0x1be/0x270 [ 572.813979][ C0] io_req_caches_free+0x21/0x30 [ 572.814008][ C0] io_ring_exit_work+0x43e/0x9a0 [ 572.814037][ C0] ? trace_hrtimer_start+0x82/0x200 [ 572.814063][ C0] ? __pfx_io_ring_exit_work+0x10/0x10 [ 572.814099][ C0] ? rcu_is_watching+0x16/0xb0 [ 572.814125][ C0] ? process_scheduled_works+0x97a/0x1630 [ 572.814152][ C0] process_scheduled_works+0xc3d/0x1630 [ 572.814192][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 572.814222][ C0] ? assign_work+0x3cf/0x5d0 [ 572.814249][ C0] worker_thread+0xa47/0xfb0 [ 572.814287][ C0] kthread+0x38b/0x480 [ 572.814307][ C0] ? __pfx_worker_thread+0x10/0x10 [ 572.814334][ C0] ? __pfx_kthread+0x10/0x10 [ 572.814355][ C0] ret_from_fork+0x514/0xb70 [ 572.814375][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 572.814395][ C0] ? __switch_to+0xc89/0x1420 [ 572.814438][ C0] ? __pfx_kthread+0x10/0x10 [ 572.814458][ C0] ret_from_fork_asm+0x1a/0x30 [ 572.814501][ C0] [ 572.814509][ C0] [ 572.814515][ C0] Allocated by task 8067: [ 572.814526][ C0] kasan_save_track+0x3e/0x80 [ 572.814548][ C0] __kasan_kmalloc+0x93/0xb0 [ 572.814570][ C0] __kmalloc_cache_noprof+0x321/0x600 [ 572.814590][ C0] ath9k_init_wmi+0x4f/0x2b0 [ 572.814695][ C0] ath9k_htc_probe_device+0x1e5/0x2370 [ 572.814716][ C0] ath9k_htc_hw_init+0x32/0x70 [ 572.814735][ C0] ath9k_hif_usb_firmware_cb+0x214/0x4b0 [ 572.814757][ C0] request_firmware_work_func+0xf7/0x2d0 [ 572.814837][ C0] process_scheduled_works+0xc3d/0x1630 [ 572.814857][ C0] worker_thread+0xa47/0xfb0 [ 572.814880][ C0] kthread+0x38b/0x480 [ 572.814897][ C0] ret_from_fork+0x514/0xb70 [ 572.814914][ C0] ret_from_fork_asm+0x1a/0x30 [ 572.814940][ C0] [ 572.814944][ C0] Freed by task 8067: [ 572.814953][ C0] kasan_save_track+0x3e/0x80 [ 572.814973][ C0] kasan_save_free_info+0x40/0x50 [ 572.814998][ C0] __kasan_slab_free+0x5c/0x80 [ 572.815020][ C0] kfree+0x1c5/0x650 [ 572.815044][ C0] ath9k_htc_probe_device+0x11a9/0x2370 [ 572.815064][ C0] ath9k_htc_hw_init+0x32/0x70 [ 572.815084][ C0] ath9k_hif_usb_firmware_cb+0x214/0x4b0 [ 572.815106][ C0] request_firmware_work_func+0xf7/0x2d0 [ 572.815125][ C0] process_scheduled_works+0xc3d/0x1630 [ 572.815146][ C0] worker_thread+0xa47/0xfb0 [ 572.815168][ C0] kthread+0x38b/0x480 [ 572.815183][ C0] ret_from_fork+0x514/0xb70 [ 572.815200][ C0] ret_from_fork_asm+0x1a/0x30 [ 572.815225][ C0] [ 572.815231][ C0] The buggy address belongs to the object at ffff88803586e000 [ 572.815231][ C0] which belongs to the cache kmalloc-2k of size 2048 [ 572.815249][ C0] The buggy address is located 344 bytes inside of [ 572.815249][ C0] freed 2048-byte region [ffff88803586e000, ffff88803586e800) [ 572.815270][ C0] [ 572.815276][ C0] The buggy address belongs to the physical page: [ 572.815287][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803586d000 pfn:0x35868 [ 572.815307][ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 572.815322][ C0] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 572.815342][ C0] page_type: f5(slab) [ 572.815361][ C0] raw: 00fff00000000240 ffff88801b042000 ffffea0001a7be10 ffffea0001dbb810 [ 572.815378][ C0] raw: ffff88803586d000 0000000000080007 00000000f5000000 0000000000000000 [ 572.815397][ C0] head: 00fff00000000240 ffff88801b042000 ffffea0001a7be10 ffffea0001dbb810 [ 572.815414][ C0] head: ffff88803586d000 0000000000080007 00000000f5000000 0000000000000000 [ 572.815432][ C0] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 572.815450][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 572.815461][ C0] page dumped because: kasan: bad access detected [ 572.815480][ C0] page_owner tracks the page as allocated [ 572.815494][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5636, tgid 5636 (syz-executor), ts 69478562252 [ 572.815528][ C0] post_alloc_hook+0x1f9/0x250 [ 572.815557][ C0] get_page_from_freelist+0x2209/0x2280 [ 572.815578][ C0] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 572.815599][ C0] allocate_slab+0x7d/0x620 [ 572.815623][ C0] refill_objects+0x2d5/0x350 [ 572.815648][ C0] __pcs_replace_empty_main+0x2c8/0x6c0 [ 572.815672][ C0] __kmalloc_cache_noprof+0x39b/0x600 [ 572.815691][ C0] rxrpc_alloc_connection+0x7b/0x590 [ 572.815833][ C0] rxrpc_prealloc_service_connection+0x26/0x300 [ 572.815861][ C0] rxrpc_service_prealloc_one+0x2d6/0xe10 [ 572.815881][ C0] rxrpc_kernel_charge_accept+0xc7/0x120 [ 572.815900][ C0] afs_charge_preallocation+0x22f/0x570 [ 572.815978][ C0] afs_open_socket+0x33c/0x3f0 [ 572.815998][ C0] afs_net_init+0x67d/0x880 [ 572.816018][ C0] ops_init+0x35d/0x5d0 [ 572.816127][ C0] setup_net+0x118/0x350 [ 572.816156][ C0] page last free pid 0 tgid 0 ts 65673574627 stack trace: [ 572.816172][ C0] __free_frozen_pages+0xc93/0xd90 [ 572.816190][ C0] __folio_put+0x4b3/0x590 [ 572.816230][ C0] skb_release_data+0x55f/0xa80 [ 572.816282][ C0] __kfree_skb+0x5d/0x210 [ 572.816306][ C0] tcp_ack+0x2bbd/0x8500 [ 572.816370][ C0] tcp_rcv_established+0x95f/0x2940 [ 572.816392][ C0] tcp_v4_do_rcv+0x727/0x13b0 [ 572.816449][ C0] tcp_v4_rcv+0x27d4/0x3170 [ 572.816475][ C0] ip_protocol_deliver_rcu+0x21d/0x440 [ 572.816556][ C0] ip_local_deliver_finish+0x3bb/0x6f0 [ 572.816582][ C0] NF_HOOK+0x336/0x3c0 [ 572.816607][ C0] ip_sublist_rcv_finish+0x1f0/0x240 [ 572.816635][ C0] ip_sublist_rcv+0x767/0xa70 [ 572.816660][ C0] ip_list_rcv+0x3ec/0x440 [ 572.816685][ C0] __netif_receive_skb_list_core+0x804/0x830 [ 572.816738][ C0] netif_receive_skb_list_internal+0x995/0xcf0 [ 572.816785][ C0] [ 572.816791][ C0] Memory state around the buggy address: [ 572.816803][ C0] ffff88803586e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 572.816818][ C0] ffff88803586e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 572.816833][ C0] >ffff88803586e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 572.816844][ C0] ^ [ 572.816857][ C0] ffff88803586e180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 572.816871][ C0] ffff88803586e200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 572.816882][ C0] ================================================================== [ 572.816922][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 573.792607][ C0] CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 573.803447][ C0] Tainted: [L]=SOFTLOCKUP [ 573.807754][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 573.817797][ C0] Workqueue: iou_exit io_ring_exit_work [ 573.823348][ C0] Call Trace: [ 573.826615][ C0] [ 573.829452][ C0] vpanic+0x56d/0xa60 [ 573.833427][ C0] ? rcu_is_watching+0x16/0xb0 [ 573.838180][ C0] ? __pfx_vpanic+0x10/0x10 [ 573.842680][ C0] panic+0xc5/0xd0 [ 573.846403][ C0] ? __pfx_panic+0x10/0x10 [ 573.850812][ C0] ? tasklet_action_common+0x103/0x490 [ 573.856267][ C0] ? tasklet_action_common+0x103/0x490 [ 573.861716][ C0] check_panic_on_warn+0x89/0xb0 [ 573.866660][ C0] ? tasklet_action_common+0x103/0x490 [ 573.872112][ C0] end_report+0x73/0x170 [ 573.876345][ C0] ? tasklet_action_common+0x103/0x490 [ 573.881796][ C0] kasan_report+0x128/0x150 [ 573.886296][ C0] ? tasklet_action_common+0x103/0x490 [ 573.891763][ C0] tasklet_action_common+0x103/0x490 [ 573.897044][ C0] handle_softirqs+0x226/0x860 [ 573.901799][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 573.906560][ C0] __irq_exit_rcu+0xcb/0x220 [ 573.911143][ C0] irq_exit_rcu+0x9/0x30 [ 573.915378][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 573.921007][ C0] [ 573.923926][ C0] [ 573.926841][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 573.932811][ C0] RIP: 0010:__read_once_word_nocheck+0x3/0x10 [ 573.938871][ C0] Code: f3 cf bf 00 e9 1e fd ff ff 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 8b 07 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 573.958463][ C0] RSP: 0018:ffffc900001273b8 EFLAGS: 00000202 [ 573.964520][ C0] RAX: ffffffff818fa8ad RBX: 1ffff92000024e8e RCX: 1ffff92000024e01 [ 573.972478][ C0] RDX: ffffc90000127ad8 RSI: 0000000000000002 RDI: ffffc90000127ad8 [ 573.980437][ C0] RBP: 1ffffffff22187bd R08: ffffc90000127ae0 R09: 0000000000000000 [ 573.988394][ C0] R10: ffffc900001274b8 R11: ffffffff81b2a310 R12: 1ffff92000024e8f [ 573.996349][ C0] R13: ffffc90000128000 R14: ffffc90000127468 R15: ffffc90000120000 [ 574.004317][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 574.010463][ C0] ? process_scheduled_works+0xc3d/0x1630 [ 574.016175][ C0] unwind_next_frame+0xca5/0x2550 [ 574.021196][ C0] ? io_ring_exit_work+0x43e/0x9a0 [ 574.026329][ C0] ? unwind_next_frame+0x8f/0x2550 [ 574.031434][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 574.037578][ C0] arch_stack_walk+0x11b/0x150 [ 574.042346][ C0] ? io_ring_exit_work+0x43e/0x9a0 [ 574.047469][ C0] stack_trace_save+0xa9/0x100 [ 574.052232][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 574.057610][ C0] kasan_save_stack+0x3e/0x60 [ 574.062284][ C0] ? kasan_save_stack+0x3e/0x60 [ 574.067128][ C0] ? kasan_record_aux_stack+0xbd/0xd0 [ 574.072496][ C0] ? call_rcu+0xee/0x8b0 [ 574.076729][ C0] ? kmem_cache_free+0x471/0x650 [ 574.081660][ C0] ? __io_req_caches_free+0x1be/0x270 [ 574.087029][ C0] ? io_req_caches_free+0x21/0x30 [ 574.092049][ C0] ? io_ring_exit_work+0x43e/0x9a0 [ 574.097171][ C0] ? __io_req_caches_free+0x1be/0x270 [ 574.102538][ C0] kasan_record_aux_stack+0xbd/0xd0 [ 574.107746][ C0] ? __pfx_slab_free_after_rcu_debug+0x10/0x10 [ 574.113903][ C0] call_rcu+0xee/0x8b0 [ 574.117969][ C0] ? __io_req_caches_free+0x1be/0x270 [ 574.123344][ C0] kmem_cache_free+0x471/0x650 [ 574.128102][ C0] __io_req_caches_free+0x1be/0x270 [ 574.133299][ C0] io_req_caches_free+0x21/0x30 [ 574.138147][ C0] io_ring_exit_work+0x43e/0x9a0 [ 574.143098][ C0] ? trace_hrtimer_start+0x82/0x200 [ 574.148307][ C0] ? __pfx_io_ring_exit_work+0x10/0x10 [ 574.153772][ C0] ? rcu_is_watching+0x16/0xb0 [ 574.158540][ C0] ? process_scheduled_works+0x97a/0x1630 [ 574.164258][ C0] process_scheduled_works+0xc3d/0x1630 [ 574.169820][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 574.175803][ C0] ? assign_work+0x3cf/0x5d0 [ 574.180393][ C0] worker_thread+0xa47/0xfb0 [ 574.184987][ C0] kthread+0x38b/0x480 [ 574.189043][ C0] ? __pfx_worker_thread+0x10/0x10 [ 574.194150][ C0] ? __pfx_kthread+0x10/0x10 [ 574.198728][ C0] ret_from_fork+0x514/0xb70 [ 574.203308][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 574.208405][ C0] ? __switch_to+0xc89/0x1420 [ 574.213083][ C0] ? __pfx_kthread+0x10/0x10 [ 574.217661][ C0] ret_from_fork_asm+0x1a/0x30 [ 574.222426][ C0] [ 574.225745][ C0] Kernel Offset: disabled [ 574.230061][ C0] Rebooting in 86400 seconds..