last executing test programs: 24.045570695s ago: executing program 2 (id=1990): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x4a0c00, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={@rand_addr=' \x01\x00', @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x1000, 0x0, 0x0, 0x1, 0x1000200}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x7, 0x1, 0x1, 0x0, 0x80}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x1}, 0x94) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(0x0, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0xc000) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f00000000c0)={'dt2815\x00', [0x8002f, 0x80, 0x10002, 0x4, 0x1, 0xcc7, 0x80000008, 0x17, 0xa, 0x24c, 0xfff, 0x7, 0x5, 0x5, 0x2, 0x105, 0x8, 0x2, 0x2009, 0x1, 0x488, 0x6, 0x4000000, 0x20001e5a, 0x1000b, 0x7, 0x9, 0x800008, 0x4, 0x401, 0xfffffffd]}) sendfile(r1, r1, 0x0, 0x8) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {}, [{0x84, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4, 0x2}, {0xc}, {0xc}}}, @m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0xfffffffffffffffe}}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x34}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000b40)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 21.933942785s ago: executing program 1 (id=1991): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x4a0c00, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={@rand_addr=' \x01\x00', @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x1000, 0x0, 0x0, 0x1, 0x1000200}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x7, 0x1, 0x1, 0x0, 0x80}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x1}, 0x94) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(0x0, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0xc000) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f00000000c0)={'dt2815\x00', [0x8002f, 0x80, 0x10002, 0x4, 0x1, 0xcc7, 0x80000008, 0x17, 0xa, 0x24c, 0xfff, 0x7, 0x5, 0x5, 0x2, 0x105, 0x8, 0x2, 0x2009, 0x1, 0x488, 0x6, 0x4000000, 0x20001e5a, 0x1000b, 0x7, 0x9, 0x800008, 0x4, 0x401, 0xfffffffd]}) sendfile(r1, r1, 0x0, 0x8) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {}, [{0x84, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4, 0x2}, {0xc}, {0xc}}}, @m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0xfffffffffffffffe}}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x34}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000b40)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 21.850133582s ago: executing program 3 (id=1993): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) socket$caif_stream(0x25, 0x1, 0x1) unshare(0x22020400) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[], 0x50) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) 20.46556392s ago: executing program 2 (id=1996): r0 = socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000100)='cifs\x00', 0x0) socket$inet6(0xa, 0x3, 0x1ff) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000300)={0x1, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r1, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x37b, @tick=0x340, 0xff, {}, 0x0, 0x0, 0xfb}) sendmsg$nl_generic(r0, 0x0, 0x4000) r2 = memfd_create(&(0x7f0000000000)='\xff\x00l\x1e\xa0,\xc1\x8d\\Rxt\'\xb6\xbf\xc8*\n\xaf\x1b\xec\xfd\xbbY\x99\xb3\x06c\xd6\xf6\xb0\xcd=\xf3\x03`\x93\xff\x05e\xaa$\x00\xeaw\xd9\x10\x0f\x1d\x888\x8cS\x12?R\x99\xda7\xce)\x8f\xcc\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd32J\xd7\x9f\xea:=\xcc\x17(|L\xda\xc3\x1ca\xe8s\xb6\xebw\xc7\xabS\xd7pJ\xd2\xa1\xcf\xae\x1f2\x9f\x98\xa80\r\x85\xb4\x86\xbc\xd0\xea\xbf\xb1Z\xb7e$\xcf<\ra\x9b\xa5\xdc\v\x1e\xfd\xc7\x91\xf22\xcf\x96\x99\xc1\xbb\xa1j\xe5\xa8\x7f\a\xa9\xa7G\xad\xa3\x8b\xf1\xdb\\]R\x8cf\xac1\xd7V\xaf\xb5\x8e\x10\x95\x9f=2\xd0-\xe1K:\xc3b\x89\x15OS\xa5\x98Ky\x12\xe7Qt#\xeb\x99\a\x10\x1c\xb3N\x85\xeb\x80\x05\x82_\x15\xdc\xbc\xf93\xdd\xf5g\x98\xd4\x8az\xe4`\xa5\x00\x00\x00\x00\xcd\x13\xfc+\xac\xe5\x8bI\f\xd6\x89\xc7HY\xcf\x00O\x88\xe6\x8b\x8bF/\x82u\xffCnG\x02\x82\xfc\xe9Od\x92\x06\xdeg@y\xa6=4\xb1}\xa8Yr\xad9\xb9b)\xec}\x87=\x91:IV\xab\xdf\xa2\xba+6D\x1fuf\xdeJYw$L\xa1\x83NH\xe3\xf2\x91\x8cW\xb7\b\x04\x12\x8b\x8bV\x19\xf1\r\xcb\x94\xa3\xf4\xe4\x97$\x99c\rG\xd7#\xe2\xfd\x80\xadR\x83\xdc\xb8d\x15|\xac\xb8g$\x0f@\xca3\x9f\xb1\xea\xc6vQ\x1b\xdb#\xa3\"\x9f\x9e\xd8\xba\x13d\x9bx\x9a\xbf\xee\xf2kQ\xe0\xc4/~7\xcd\xd1\x06\xe5\x17\x9b\bW|\xbc\x86D\x05\xaf<\xdfy,I2f\xa7G\xe3Qp<\'6 x\n\x94f\xf8\xa2\xea\xf4\xa5\x9eY\xf80C\x91\x7f\x16u\x8c(Xl\x90\xd2\x9f\xa9\xb9kJy[F!{\xe5\x1a\xe9\xb7T\x19;\xb9\t\xe7\x0ei\xfaZ\xfbS:\x9b\xc1r\xcbM.\xf8\xb8wR\xb3p~b\xcb\v1-\a-\x8a#\xaa1\xa9\x9a\x88\a\xc5\xb9*\xd3?\xac\n\x9c\xcd\xe2\xc9\xbd\xeb\xb3\xf65\xbdaP\t\xd6\x06\x1c\xeeNg\x92>\x92>\xaf\b3\x05\xfdM\xd2F\v\xbd\xeb\x83 \x9d\x90S\x11w\xefg\\\xca\xe2\xfc~w\xbe\xefh#\x96\xa5h\xec\xbfr\xc8Bi\x90\"(\xf2\xc6\xcc\xfbX\x14{\x9e5\x87\x91\xe2\x9b\xd4\xc6\xc2whk+\x0f\x82\xca\xc1@\xcb~P\xe4\x18\xf9E\'\xab\xc7z\xd7\x05V{\xa1X\xa3\x10\x13.]tlz\x12\xde\xf2\xa43\xee#\x92J~\xda \x9b\xc4\xc0V\xb3\x9dCO\x1fu\x1c4\x1d\v}\x1b\xe5>w\xfbsm\xa3\fI|\x96-p\x86\xd3O\xfa\x9a\x8f\xb2\x8e\x88qGEG\x98\x8f\xefF\x9a\x16a\x9a,\xab1\x1aRc0\xdd\xf3\xa3\x0e@\x0f\xfd\xf4nd\xf4\x82\xff\xf4?s\xbb\xc7B0\fl\'\x8b\x1f\xe9\xfc%\xa5\xd6\xdfH5\x80\x80\x12\xe8s?\x10\xf0z3\x97r\xe7k\xa7it\x1f\x91\xee\xaa\xa8p\x04b\x9f\x8a\xae\x9e\x90\xed\x81L\xe7', 0x6) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000b, 0x4a092, r2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000200)={0x6, 0x6, 0x1}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$VT_OPENQRY(0xffffffffffffffff, 0x4b46, &(0x7f0000000000)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000240)='wlan0\x00', 0x10) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r3, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r3, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x180204}], 0x1) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) 20.091708133s ago: executing program 2 (id=1998): syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000500)='./bus\x00', 0x1000c40, &(0x7f0000000c40)={[{@orlov}, {@nombcache}, {@nouid32}, {@barrier}, {@usrjquota}, {@stripe={'stripe', 0x3d, 0x6}}, {@minixdf}, {@nouser_xattr}, {@journal_checksum}]}, 0x5, 0x51c, &(0x7f0000000700)="$eJzs3cFvI1cZAPBvZjebNE2bFCoVENClFBa0WjvxtlHVU7mAUFUJUXHikIbEG0Vx4ih2ShNWavI/IFGJA4ITZyQQHCr1xBHBDW69lANSgRWoQeJgNONx1t3YG3c3awv795NGM29mMt97Y8178RfHL4CJdTUijiLiSkS8ERHzxf6kWOKV9pKd99Gd22snd26vJdFqvf6PJD+e7Yuun8k8XlxzJiK++62IHyRn4zYODrdWa7XqXlEuN7d3y42Dwxub26sb1Y3qTqWyvLS8+NLNFysDtWNmgHOe3f7Vh9/cfPV77/7uCx/86ejrP8qqNVcc627HRWo3feo0TuZyRLz6KIKNwKWiPVdGXREeSBoRn4qI5/Lnfz4u5a/mYHo81gDA/4FWaz5a891lAGDcpXkOLElLRS5gLtK0VGrn8J6O2bRWbzSv36rv76y3c2ULMZXe2qxVF4tc4UJMJVl56e1s+265Eh8v34yIpyLix9OP5eXS2uB5BgDgYj1+z/j/7+n2+A8AjLmeH57pfn++Mry6AADDMciHZwGA8WL8B4DJc3f8nx1pPQCA4fH+HwAmj/EfACbN+53x/9KoawIADMV3XnstW1onxfdfr795sL9Vf/PGerWxVdreXyut1fd2Sxv1+katWlqrb593vVq9vrv0Quy/VW5WG81y4+BwZbu+v9Ncyb/Xe6U6NZRWAQD389Sz7/0liYijlx/Ll+iay8FYDeMtHXUFgJGR84fJ5Vu4YXJ5jw+T69fFf/yeN5dn348Iv/MAQVtvP8APARft2mfl/2FSyf/D5JL/h8kl/w+Tq9VK+s35n56eAgCMlU+Y4/cnARhDQ/37PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIyJuXxZ6CqnaakU8URELMRUcmuzVl2MiCcj4s/TU9NZeWmkNQYAHl76t6SY/+va/PNz9x69kvxnOl9HxA9/+vpP3lptNveWsv3/PN3ffKfYXxlF/QGA83TG6c443vHRndtrnWWY9fnwG+3JRbO4J8XSPnI5LmerP87kkw7P/itplwvZ7yuXLiD+0XFEfKZX+5M8N7JQzHx6b/ws9hNDjZ9+LH6aH2uvs3vx6TNXnu4b87y5XmFSvJf1P6/0ev7SuJqvZ3pOfjyT91APr9P/nZzp/zrP+0ze1/Tq/64OGuOF33+777HjiM9d7hU/OY2f9In//IDx3//8F5/rd6z184hr0Tt+d6xyc3u33Dg4vJHd+OpGdadSWV5aXnzp5ouVcp6jLncy1d3aI8TfX77+ZN/2//K3RUd5Nv7MOe3/yn1b3TrtgH/x3ze+/6V+8Y8jvvbl3q//0/eJn42JXy22+/f0bauzv+k7fXcWf719/48/6et//Zy4HR/89XB9wFMBgCFoHBxurdZq1b0L3ZiKC75g10byiOpsYwQbMcRY2a/JD3udZ4qU2Wrn+ek+5w8/e/eZbN/I7+qFbIyuTwKG4+5DP+qaAAAAAAAAAAAAAAAA/TzyfydKR91CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxtn/AgAA//8LKMVX") r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x4, 0x0) read$msr(r0, &(0x7f0000000600)=""/251, 0xfb) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000005c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) getpgid(r1) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r5 = io_uring_setup(0x4a86, &(0x7f0000000300)={0x0, 0x4178, 0x40, 0x8001002, 0x3d7}) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x7, 0x4, 0x100, 0x3, 0x20}, 0x50) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) socket$isdn_base(0x22, 0x3, 0x0) close_range(r5, r4, 0x0) 17.663846359s ago: executing program 3 (id=2001): write(0xffffffffffffffff, &(0x7f0000000340)="1c0000005e001f", 0x7) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=ANY=[], 0x188}}], 0x1, 0x810) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) pwritev(0xffffffffffffffff, &(0x7f0000000d80)=[{&(0x7f0000000780)="42ebe7f5d8dde5f3e9c5c7e7bc09d8d80f373ae4dc85e6cb597bd322663b986ff272399bec41d811a763bcd2cdc221d2ac6cdeeca815ce250ce959444e7f296cb11433530cfccd0c6f450147b46eb5bbe281810c76577aaf554801815d1ee516cc0752832233d7610ce165a593e43cbaa4f52db28e5aead94767ad0d0c", 0x7d}, {&(0x7f0000000540)}, {&(0x7f0000000580)="1ab9a1fec95331b4b1bb5f840b0a198cb5add980a1e5cd402aaabeb7a27d1418376394238ae0a1ca9c", 0x29}, {&(0x7f0000000ac0)}], 0x4, 0x4d9e, 0x8) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 16.26361841s ago: executing program 3 (id=2004): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000054c0)=@newtfilter={0x30, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x18, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r4, 0xc}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 15.934937205s ago: executing program 1 (id=2005): syz_mount_image$udf(&(0x7f00000001c0), &(0x7f0000000100)='./file1\x00', 0x1004000, &(0x7f0000000440)=ANY=[@ANYBLOB="6769643d69676e6f72652c756e64656c6574652c616e63686f723d30303030303030303030303030303030303031312c6c6f6e6761642c756d61736b3d30303030303030303030303030303030303030303030342c756e686964652c756e64656c6574652c696f636861727365743d757466382c7569643d666f726765742c6e6f7374726963742c6c617374626c6f636b3d30303030303030303030303030303030303030312c6e6f7374726963742c7569643d69676e6f72652c6d6f64653d30303030303030303030303030303030303030303030352c0058290fc34cb3509fda5ac914c5b263dd70f4530ea447e8211074867af16c3c57581a329456bb56f93cc73532d673a7d28e3ac1f7ea684ca0ae8cb2a053b209942df624b1aa36d290f93d334d5e01658df013b341d33430503f7f34f39fc52e32b011"], 0x1, 0xc32, &(0x7f0000001bc0)="$eJzs3U9sXNd5N+D3XHHEofx9FRM7ipPGxaQtUlmxXP2LqViFO6pptgFkWQjF7AJwJFLqwBRJkFQjG2nBdNNFFwGKoousCLRGgRQNjKYIumRaF0g2XhRZdUW0sBEUXbBFgKwCFvfOGXFIkTYjkhJpP49N/WbunHPnnHvH98qC3jkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAET83iuXz5xNj3sUAMCjdHX0q2fOuf8DwMfKdf//DwAAAAAAAAAAAAAAB12KIp6MFLNXV9N49byjfqVdu3tvbHhk624Dqep5pGpf/tTPnjt/4UsvDF3s5pX29Af032ufjddGr19uvDxzZ3Zucn5+cqIxNt2+OTMxueM97Lb/ZqeqA9C48/rdiVu35hvnnj+/4eV7g+/3P3Fi8NLQs6ef6bYdGx4ZGV1vUt/y4UParsLjaBRxOlI8972fplZEFLH7Y1F/tOd+s4FqEqeqSYwNj1QTmWq3phfKF691D0QR0ejp1Oweo63PRfTVHukctteMWCyHXw74VDm90dnWXOvG1GTjWmtuob3Qnpm+ljqjLefTiCIupoiliFjpf3B3tSiiL1J85/hquhERR7rH4YtVYfD24yj2cY47UI6zUYtYKg7BOTvA+qOIVyPFz945GTfLY5Z/4gsRr5b5g4i3ynwpIpUfjAsR723xOeJw6osi/rw8/5dW00R1PeheV658rfGV6VszPW2715Vf8v7wwJXiMd0fBjblo3HAr031KKJVXfFX08P/ZgcAAAAAAAAAAAAAAACAvTYQRXwmUrzyb39U1RVHVZd+/NLQ7w/+/96a8ac/ZD9l2+cjYrHYWU3u0VwYeC1dS2mntcTqTvdcPYr441z/963HPRgAAAAAAAAAAAAAAAAAAICPtSJ+EilefPdkWoreNcXb07cb11s3pjqrwnbX/u2umb62trbWSJ1s5hzPuZhzKedyzpWcUeT+OZs5xwc6O17Mz5dyLudcyRlHcv+czZzjORdzLuVczrmSM/py/5zNnOM5F3Mu5VzOuZIzDsjavQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHyVFFPGLSPHtb6ymSBHRjBiPTi73P+7RAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACl/lTE9yNF4w+a97f1RUSq/u04Wf5yIZpHy/xkNIfKfCmal3O2quxrfusxjJ/dqaUifhwp+utv3z/h+fzXOs/ufwzirW+uP/tsXyePdF8cfL//iRPHLw2N/NrT2z1OWw3g1JX29N17jbHhkZHRns19+d0/2bNtML9vsTdTJyLm33jz9dbU1OTcwz8oPwK76H6IHqS+gz/T2oEf4SF6EH0HYhiPZ+58DJT3//cixW+/++/dG37n/l+P/9d5dv8OHz//k/X7/4ubd7TD+3/f5n75/l/e07e6/z/Zs+3F/LuRWl9EfeHObO1ERH3+jTdPt++0bk/enpy+cObMl4eGvnz+TO1oRP1We2qy59GeHC4AAAAAAAAAAAAAAACARycV8buRovXj1dSIiHtVvdbgpaFnTz9zJI5U9VYb6rZfG71+ufHyzJ3Zucn5+cmJxth0++bMxORO365elXuNDY/sy2Q+1MA+j3+g/vLM7Btz7dt/uLDl68fql2/ML8y1bm79cgxEEdHs3XKqGvDY8Eg16Kl2a7rqem3LYvpfXi0V8R+R4uaFRvp83pbr/zdX+G+o/1/cvKN9qv//RM+28j1TKuLnkeK3/uLp+Hw1zmPxwDHL7f4mUpy6+LncLo6W7bpj6HyvQKcysGz7P5HiH36xsW23HvLJ9bZnd3xgD4ny/B+PFN//s+/Gr+dtG7//Yevzf2zzjvbp/D/Vs+3Yhu8r2PXUyef/dKR46cm34zfytg/6/o/ud2+czI3vfz/HPp3/T/VsG8zv+5t7M3UAAAAAAAAAAIBDrZaK+NtI8cORvvRC3raTv/83sXlH+/T3vz7ds21ib9Yr+tAHuz6oAAAAAHBA1FIRP4kUtxfevl9DvbH+u6f+83fW6z+H06ZXqz/n+5XqewP28s//eg3m9x3f/bQBAAAAAAAAAAAAAAAAAADgQEmpiBfyeurjVT3/xLbrqS9Hilf+67ncLp0o23XXgR+sfq1fnZk+fXlqauZma6F1Y2qyMTrbujlZ9n0qUqz+9edy36JaX7273nxnjff1tdjnIsXI33XbdtZi765N/tR627Nl209Eiv/8+41tu+tYf2q97bmy7V9Fiq//09ZtT6y3PV+2/W6k+NHXG922x8q23e9H/fR62+dvzhT7cFYAAAAAAAAAAAAAAAAAAAD4uKmlIv40Uvz3naX7tfx5/f9az9PKW988tu1+7lXr/A9W6/9v9/hh1v+vvldgccueAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwkZWiiDcjxezV1bTcXz7vqF9pT9+9NzY8snW3gVT1PFK1L3/qZ8+dv/ClF4YudvOD+++1z8Rro9cvN16euTM7Nzk/PznRGJtu35yZmNzxHnbbf7NT1QFo3Hn97sStW/ONc8+f3/DyvcH3+584MXhp6NnTz3Tbjg2PjIz2tOmrPfS7PyBts/1oFPGXkeK57/00/bA/oojdH4sP+ezst4FqEqeqSYwNj1QTmWq3phfKF691D0QR0ejp1Oweo0dwLnalGbFYDr8c8KlyeqOzrbnWjanJxrXW3EJ7oT0zfS11RlvOpxFFXEwRSxGx0v/g7mpRxOuR4jvHV9M/90cc6R6HL14d/eqZc9uPo9jHOe5AOc5GLWKpOATn7ADrjyL+MVL87J2T8S/9EX3R+YkvRLxa5g8i3orO+U7lB+NCxHtbfI44nPqiiP8tz/+l1fROf3k96F5Xrnyt8ZXpWzM9bbvXlUN/f3iUDvi1qR5F/Ki64q+mf/XfNQAAAAAAAAAAAAAAAMABUsSvRooX3z2Zqvrg+zXF7enbjeutG1Odsr5u7V+3ZnptbW2tkTrZzDmeczHnUs7lnCs5o8j9czbLrK+tjefnizmXci7nXMkZR3L/nM2c4zkXcy7lXM65kjP6cv+czZzjORdzLuVczrmSMw5I7R4AAAAAAAAAAAAAAAAAAPDRUlT/pPj2N1bTWn9nfenx6OSy9UA/8v4vAAD///RZ9vs=") openat$dir(0xffffffffffffff9c, 0x0, 0x204000, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x100000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000540)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x2f, 0xfd, 0x4, 0xb753, 0x20, @loopback, @mcast2={0xff, 0x3}, 0x8000, 0xba08, 0x0, 0x1004}}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) socket(0x29, 0xa, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'comedi_parport\x00', [0x4f27, 0x0, 0x4, 0x4, 0x5, 0x5, 0x7, 0x7, 0x54c6cff3, 0xfd, 0x2, 0x7, 0x1, 0x1, 0x6, 0x5, 0x0, 0x7f, 0x3, 0x40000003, 0x89, 0xcaa3, 0x0, 0x20001e5b, 0x3, 0xe66, 0x3, 0x8, 0x4086, 0x0, 0xfffffff8]}) socket$nl_route(0x10, 0x3, 0x0) 14.770615268s ago: executing program 0 (id=2007): prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) dup2(r0, r1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="5000000002060500000000010000000000000000050005000a000000050004000000000005000100070000000900020073797a310000000016000300686173683a6e65742c706f72742c6e6574"], 0x50}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 13.921954486s ago: executing program 0 (id=2008): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000180)=@id={0x1e, 0x3, 0x3, {0x4e21}}, 0x10) r3 = socket(0x2, 0x3, 0xff) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x4b52, &(0x7f0000000000)={0x2, {0x2, 0x200, 0x7e, 0x0, 0xff91, 0xf}}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f"], 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) connect$inet(r3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$binfmt_elf32(r3, &(0x7f0000000180)=ANY=[], 0x14) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) mmap(&(0x7f00000ca000/0x3000)=nil, 0x3000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) 13.640249428s ago: executing program 2 (id=2010): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) socket$caif_stream(0x25, 0x1, 0x1) unshare(0x22020400) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[], 0x50) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000180)=0x10000000005) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) write$sequencer(0xffffffffffffffff, 0x0, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 9.860492031s ago: executing program 0 (id=2013): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='source', &(0x7f0000000640)='//\xf2b\x06\b\xba\xdfXo\xdc\xea\x95\x9a\x9b/Q9\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce\x14//\\\x00\x00\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b,\xc1\x8d\\Rxt\'\xb6\xbf\xc8*\n\xaf\x1b\xec\xfd\xbbY\x99\xb3\x06c\xd6\xf6\xb0\xcd=\xf3\x03`\x93\xff\x05e\xaa$\x00\xeaw\xd9\x10\x0f\x1d\x888\x8cS\x12?R\x99\xda7\xce)\x8f\xcc\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd32J\xd7\x9f\xea:=\xcc\x17(|L\xda\xc3\x1ca\xe8s\xb6\xebw\xc7\xabS\xd7pJ\xd2\xa1\xcf\xae\x1f2\x9f\x98\xa80\r\x85\xb4\x86\xbc\xd0\xea\xbf\xb1Z\xb7e$\xcf<\ra\x9b\xa5\xdc\v\x1e\xfd\xc7\x91\xf22\xcf\x96\x99\xc1\xbb\xa1j\xe5\xa8\x7f\a\xa9\xa7G\xad\xa3\x8b\xf1\xdb\\]R\x8cf\xac1\xd7V\xaf\xb5\x8e\x10\x95\x9f=2\xd0-\xe1K:\xc3b\x89\x15OS\xa5\x98Ky\x12\xe7Qt#\xeb\x99\a\x10\x1c\xb3N\x85\xeb\x80\x05\x82_\x15\xdc\xbc\xf93\xdd\xf5g\x98\xd4\x8az\xe4`\xa5\x00\x00\x00\x00\xcd\x13\xfc+\xac\xe5\x8bI\f\xd6\x89\xc7HY\xcf\x00O\x88\xe6\x8b\x8bF/\x82u\xffCnG\x02\x82\xfc\xe9Od\x92\x06\xdeg@y\xa6=4\xb1}\xa8Yr\xad9\xb9b)\xec}\x87=\x91:IV\xab\xdf\xa2\xba+6D\x1fuf\xdeJYw$L\xa1\x83NH\xe3\xf2\x91\x8cW\xb7\b\x04\x12\x8b\x8bV\x19\xf1\r\xcb\x94\xa3\xf4\xe4\x97$\x99c\rG\xd7#\xe2\xfd\x80\xadR\x83\xdc\xb8d\x15|\xac\xb8g$\x0f@\xca3\x9f\xb1\xea\xc6vQ\x1b\xdb#\xa3\"\x9f\x9e\xd8\xba\x13d\x9bx\x9a\xbf\xee\xf2kQ\xe0\xc4/~7\xcd\xd1\x06\xe5\x17\x9b\bW|\xbc\x86D\x05\xaf<\xdfy,I2f\xa7G\xe3Qp<\'6 x\n\x94f\xf8\xa2\xea\xf4\xa5\x9eY\xf80C\x91\x7f\x16u\x8c(Xl\x90\xd2\x9f\xa9\xb9kJy[F!{\xe5\x1a\xe9\xb7T\x19;\xb9\t\xe7\x0ei\xfaZ\xfbS:\x9b\xc1r\xcbM.\xf8\xb8wR\xb3p~b\xcb\v1-\a-\x8a#\xaa1\xa9\x9a\x88\a\xc5\xb9*\xd3?\xac\n\x9c\xcd\xe2\xc9\xbd\xeb\xb3\xf65\xbdaP\t\xd6\x06\x1c\xeeNg\x92>\x92>\xaf\b3\x05\xfdM\xd2F\v\xbd\xeb\x83 \x9d\x90S\x11w\xefg\\\xca\xe2\xfc~w\xbe\xefh#\x96\xa5h\xec\xbfr\xc8Bi\x90\"(\xf2\xc6\xcc\xfbX\x14{\x9e5\x87\x91\xe2\x9b\xd4\xc6\xc2whk+\x0f\x82\xca\xc1@\xcb~P\xe4\x18\xf9E\'\xab\xc7z\xd7\x05V{\xa1X\xa3\x10\x13.]tlz\x12\xde\xf2\xa43\xee#\x92J~\xda \x9b\xc4\xc0V\xb3\x9dCO\x1fu\x1c4\x1d\v}\x1b\xe5>w\xfbsm\xa3\fI|\x96-p\x86\xd3O\xfa\x9a\x8f\xb2\x8e\x88qGEG\x98\x8f\xefF\x9a\x16a\x9a,\xab1\x1aRc0\xdd\xf3\xa3\x0e@\x0f\xfd\xf4nd\xf4\x82\xff\xf4?s\xbb\xc7B0\fl\'\x8b\x1f\xe9\xfc%\xa5\xd6\xdfH5\x80\x80\x12\xe8s?\x10\xf0z3\x97r\xe7k\xa7it\x1f\x91\xee\xaa\xa8p\x04b\x9f\x8a\xae\x9e\x90\xed\x81L\xe7', 0x6) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000b, 0x4a092, r3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000200)={0x6, 0x6, 0x1}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$VT_OPENQRY(0xffffffffffffffff, 0x4b46, &(0x7f0000000000)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, 0x0, 0x0) bind$inet(r5, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r5, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r5, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x180204}], 0x1) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) 9.693580246s ago: executing program 0 (id=2014): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000180)=@id={0x1e, 0x3, 0x3, {0x4e21}}, 0x10) r3 = socket(0x2, 0x3, 0xff) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x4b52, &(0x7f0000000000)={0x2, {0x2, 0x200, 0x7e, 0x0, 0xff91, 0xf}}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f"], 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) connect$inet(r3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$binfmt_elf32(r3, &(0x7f0000000180)=ANY=[], 0x14) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) mmap(&(0x7f00000ca000/0x3000)=nil, 0x3000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) 8.077846166s ago: executing program 1 (id=2015): syz_mount_image$udf(&(0x7f00000001c0), &(0x7f0000000100)='./file1\x00', 0x1004000, &(0x7f0000000440)=ANY=[@ANYBLOB="6769643d69676e6f72652c756e64656c6574652c616e63686f723d30303030303030303030303030303030303031312c6c6f6e6761642c756d61736b3d30303030303030303030303030303030303030303030342c756e686964652c756e64656c6574652c696f636861727365743d757466382c7569643d666f726765742c6e6f7374726963742c6c617374626c6f636b3d30303030303030303030303030303030303030312c6e6f7374726963742c7569643d69676e6f72652c6d6f64653d30303030303030303030303030303030303030303030352c0058290fc34cb3509fda5ac914c5b263dd70f4530ea447e8211074867af16c3c57581a329456bb56f93cc73532d673a7d28e3ac1f7ea684ca0ae8cb2a053b209942df624b1aa36d290f93d334d5e01658df013b341d33430503f7f34f39fc52e32b011"], 0x1, 0xc32, &(0x7f0000001bc0)="$eJzs3U9sXNd5N+D3XHHEofx9FRM7ipPGxaQtUlmxXP2LqViFO6pptgFkWQjF7AJwJFLqwBRJkFQjG2nBdNNFFwGKoousCLRGgRQNjKYIumRaF0g2XhRZdUW0sBEUXbBFgKwCFvfOGXFIkTYjkhJpP49N/WbunHPnnHvH98qC3jkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAET83iuXz5xNj3sUAMCjdHX0q2fOuf8DwMfKdf//DwAAAAAAAAAAAAAAB12KIp6MFLNXV9N49byjfqVdu3tvbHhk624Dqep5pGpf/tTPnjt/4UsvDF3s5pX29Af032ufjddGr19uvDxzZ3Zucn5+cqIxNt2+OTMxueM97Lb/ZqeqA9C48/rdiVu35hvnnj+/4eV7g+/3P3Fi8NLQs6ef6bYdGx4ZGV1vUt/y4UParsLjaBRxOlI8972fplZEFLH7Y1F/tOd+s4FqEqeqSYwNj1QTmWq3phfKF691D0QR0ejp1Oweo63PRfTVHukctteMWCyHXw74VDm90dnWXOvG1GTjWmtuob3Qnpm+ljqjLefTiCIupoiliFjpf3B3tSiiL1J85/hquhERR7rH4YtVYfD24yj2cY47UI6zUYtYKg7BOTvA+qOIVyPFz945GTfLY5Z/4gsRr5b5g4i3ynwpIpUfjAsR723xOeJw6osi/rw8/5dW00R1PeheV658rfGV6VszPW2715Vf8v7wwJXiMd0fBjblo3HAr031KKJVXfFX08P/ZgcAAAAAAAAAAAAAAACAvTYQRXwmUrzyb39U1RVHVZd+/NLQ7w/+/96a8ac/ZD9l2+cjYrHYWU3u0VwYeC1dS2mntcTqTvdcPYr441z/963HPRgAAAAAAAAAAAAAAAAAAICPtSJ+EilefPdkWoreNcXb07cb11s3pjqrwnbX/u2umb62trbWSJ1s5hzPuZhzKedyzpWcUeT+OZs5xwc6O17Mz5dyLudcyRlHcv+czZzjORdzLuVczrmSM/py/5zNnOM5F3Mu5VzOuZIzDsjavQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHyVFFPGLSPHtb6ymSBHRjBiPTi73P+7RAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACl/lTE9yNF4w+a97f1RUSq/u04Wf5yIZpHy/xkNIfKfCmal3O2quxrfusxjJ/dqaUifhwp+utv3z/h+fzXOs/ufwzirW+uP/tsXyePdF8cfL//iRPHLw2N/NrT2z1OWw3g1JX29N17jbHhkZHRns19+d0/2bNtML9vsTdTJyLm33jz9dbU1OTcwz8oPwK76H6IHqS+gz/T2oEf4SF6EH0HYhiPZ+58DJT3//cixW+/++/dG37n/l+P/9d5dv8OHz//k/X7/4ubd7TD+3/f5n75/l/e07e6/z/Zs+3F/LuRWl9EfeHObO1ERH3+jTdPt++0bk/enpy+cObMl4eGvnz+TO1oRP1We2qy59GeHC4AAAAAAAAAAAAAAACARycV8buRovXj1dSIiHtVvdbgpaFnTz9zJI5U9VYb6rZfG71+ufHyzJ3Zucn5+cmJxth0++bMxORO365elXuNDY/sy2Q+1MA+j3+g/vLM7Btz7dt/uLDl68fql2/ML8y1bm79cgxEEdHs3XKqGvDY8Eg16Kl2a7rqem3LYvpfXi0V8R+R4uaFRvp83pbr/zdX+G+o/1/cvKN9qv//RM+28j1TKuLnkeK3/uLp+Hw1zmPxwDHL7f4mUpy6+LncLo6W7bpj6HyvQKcysGz7P5HiH36xsW23HvLJ9bZnd3xgD4ny/B+PFN//s+/Gr+dtG7//Yevzf2zzjvbp/D/Vs+3Yhu8r2PXUyef/dKR46cm34zfytg/6/o/ud2+czI3vfz/HPp3/T/VsG8zv+5t7M3UAAAAAAAAAAIBDrZaK+NtI8cORvvRC3raTv/83sXlH+/T3vz7ds21ib9Yr+tAHuz6oAAAAAHBA1FIRP4kUtxfevl9DvbH+u6f+83fW6z+H06ZXqz/n+5XqewP28s//eg3m9x3f/bQBAAAAAAAAAAAAAAAAAADgQEmpiBfyeurjVT3/xLbrqS9Hilf+67ncLp0o23XXgR+sfq1fnZk+fXlqauZma6F1Y2qyMTrbujlZ9n0qUqz+9edy36JaX7273nxnjff1tdjnIsXI33XbdtZi765N/tR627Nl209Eiv/8+41tu+tYf2q97bmy7V9Fiq//09ZtT6y3PV+2/W6k+NHXG922x8q23e9H/fR62+dvzhT7cFYAAAAAAAAAAAAAAAAAAAD4uKmlIv40Uvz3naX7tfx5/f9az9PKW988tu1+7lXr/A9W6/9v9/hh1v+vvldgccueAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwkZWiiDcjxezV1bTcXz7vqF9pT9+9NzY8snW3gVT1PFK1L3/qZ8+dv/ClF4YudvOD+++1z8Rro9cvN16euTM7Nzk/PznRGJtu35yZmNzxHnbbf7NT1QFo3Hn97sStW/ONc8+f3/DyvcH3+584MXhp6NnTz3Tbjg2PjIz2tOmrPfS7PyBts/1oFPGXkeK57/00/bA/oojdH4sP+ezst4FqEqeqSYwNj1QTmWq3phfKF691D0QR0ejp1Oweo0dwLnalGbFYDr8c8KlyeqOzrbnWjanJxrXW3EJ7oT0zfS11RlvOpxFFXEwRSxGx0v/g7mpRxOuR4jvHV9M/90cc6R6HL14d/eqZc9uPo9jHOe5AOc5GLWKpOATn7ADrjyL+MVL87J2T8S/9EX3R+YkvRLxa5g8i3orO+U7lB+NCxHtbfI44nPqiiP8tz/+l1fROf3k96F5Xrnyt8ZXpWzM9bbvXlUN/f3iUDvi1qR5F/Ki64q+mf/XfNQAAAAAAAAAAAAAAAMABUsSvRooX3z2Zqvrg+zXF7enbjeutG1Odsr5u7V+3ZnptbW2tkTrZzDmeczHnUs7lnCs5o8j9czbLrK+tjefnizmXci7nXMkZR3L/nM2c4zkXcy7lXM65kjP6cv+czZzjORdzLuVczrmSMw5I7R4AAAAAAAAAAAAAAAAAAPDRUlT/pPj2N1bTWn9nfenx6OSy9UA/8v4vAAD///RZ9vs=") openat$dir(0xffffffffffffff9c, 0x0, 0x204000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000540)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x2f, 0xfd, 0x4, 0xb753, 0x20, @loopback, @mcast2={0xff, 0x3}, 0x8000, 0xba08, 0x0, 0x1004}}) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) 7.907446877s ago: executing program 2 (id=2016): syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0xc0c00) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r2 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x82403) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x2, 0x80805, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x44) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) io_getevents(0x0, 0x6, 0x0, &(0x7f00000003c0), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x40) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r6, 0xb) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000140)=0x5c, 0x4) ioctl$CEC_S_MODE(r2, 0x40046109, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000540)={'wlan1\x00', &(0x7f0000000000)=@ethtool_gstrings={0x1b, 0x1}}) 7.842078191s ago: executing program 3 (id=2017): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x4a0c00, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={@rand_addr=' \x01\x00', @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x1000, 0x0, 0x0, 0x1, 0x1000200}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x7, 0x1, 0x1, 0x0, 0x80}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x1}, 0x94) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(0x0, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0xc000) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f00000000c0)={'dt2815\x00', [0x8002f, 0x80, 0x10002, 0x4, 0x1, 0xcc7, 0x80000008, 0x17, 0xa, 0x24c, 0xfff, 0x7, 0x5, 0x5, 0x2, 0x105, 0x8, 0x2, 0x2009, 0x1, 0x488, 0x6, 0x4000000, 0x20001e5a, 0x1000b, 0x7, 0x9, 0x800008, 0x4, 0x401, 0xfffffffd]}) sendfile(r1, r1, 0x0, 0x8) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x8000000000015) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {}, [{0x84, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4, 0x2}, {0xc}, {0xc}}}, @m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0xfffffffffffffffe}}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x34}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000b40)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 6.761004712s ago: executing program 4 (id=2019): r0 = creat(&(0x7f0000000240)='./bus\x00', 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r4, 0x0, 0xd2, &(0x7f0000000040)={@broadcast, @multicast1, 0x1, "0d5011f02b7fab96e0aa834d3a9e861e6227c2b6ddaa5effda90000000000009", 0x5, 0x16, 0xfffffffe, 0x1}, 0x3c) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000000)={@broadcast, @multicast1, 0x0, "12ceaac82ab7d944e84b6fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) setsockopt$MRT_FLUSH(r5, 0x0, 0xd4, &(0x7f0000000100)=0xe, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)) chdir(&(0x7f00000001c0)='./bus\x00') rmdir(&(0x7f0000000380)='./file0/../file0\x00') 6.654978353s ago: executing program 1 (id=2020): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='source', &(0x7f0000000640)='//\xf2b\x06\b\xba\xdfXo\xdc\xea\x95\x9a\x9b/Q9\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce\x14//\\\x00\x00\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b,\xc1\x8d\\Rxt\'\xb6\xbf\xc8*\n\xaf\x1b\xec\xfd\xbbY\x99\xb3\x06c\xd6\xf6\xb0\xcd=\xf3\x03`\x93\xff\x05e\xaa$\x00\xeaw\xd9\x10\x0f\x1d\x888\x8cS\x12?R\x99\xda7\xce)\x8f\xcc\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd32J\xd7\x9f\xea:=\xcc\x17(|L\xda\xc3\x1ca\xe8s\xb6\xebw\xc7\xabS\xd7pJ\xd2\xa1\xcf\xae\x1f2\x9f\x98\xa80\r\x85\xb4\x86\xbc\xd0\xea\xbf\xb1Z\xb7e$\xcf<\ra\x9b\xa5\xdc\v\x1e\xfd\xc7\x91\xf22\xcf\x96\x99\xc1\xbb\xa1j\xe5\xa8\x7f\a\xa9\xa7G\xad\xa3\x8b\xf1\xdb\\]R\x8cf\xac1\xd7V\xaf\xb5\x8e\x10\x95\x9f=2\xd0-\xe1K:\xc3b\x89\x15OS\xa5\x98Ky\x12\xe7Qt#\xeb\x99\a\x10\x1c\xb3N\x85\xeb\x80\x05\x82_\x15\xdc\xbc\xf93\xdd\xf5g\x98\xd4\x8az\xe4`\xa5\x00\x00\x00\x00\xcd\x13\xfc+\xac\xe5\x8bI\f\xd6\x89\xc7HY\xcf\x00O\x88\xe6\x8b\x8bF/\x82u\xffCnG\x02\x82\xfc\xe9Od\x92\x06\xdeg@y\xa6=4\xb1}\xa8Yr\xad9\xb9b)\xec}\x87=\x91:IV\xab\xdf\xa2\xba+6D\x1fuf\xdeJYw$L\xa1\x83NH\xe3\xf2\x91\x8cW\xb7\b\x04\x12\x8b\x8bV\x19\xf1\r\xcb\x94\xa3\xf4\xe4\x97$\x99c\rG\xd7#\xe2\xfd\x80\xadR\x83\xdc\xb8d\x15|\xac\xb8g$\x0f@\xca3\x9f\xb1\xea\xc6vQ\x1b\xdb#\xa3\"\x9f\x9e\xd8\xba\x13d\x9bx\x9a\xbf\xee\xf2kQ\xe0\xc4/~7\xcd\xd1\x06\xe5\x17\x9b\bW|\xbc\x86D\x05\xaf<\xdfy,I2f\xa7G\xe3Qp<\'6 x\n\x94f\xf8\xa2\xea\xf4\xa5\x9eY\xf80C\x91\x7f\x16u\x8c(Xl\x90\xd2\x9f\xa9\xb9kJy[F!{\xe5\x1a\xe9\xb7T\x19;\xb9\t\xe7\x0ei\xfaZ\xfbS:\x9b\xc1r\xcbM.\xf8\xb8wR\xb3p~b\xcb\v1-\a-\x8a#\xaa1\xa9\x9a\x88\a\xc5\xb9*\xd3?\xac\n\x9c\xcd\xe2\xc9\xbd\xeb\xb3\xf65\xbdaP\t\xd6\x06\x1c\xeeNg\x92>\x92>\xaf\b3\x05\xfdM\xd2F\v\xbd\xeb\x83 \x9d\x90S\x11w\xefg\\\xca\xe2\xfc~w\xbe\xefh#\x96\xa5h\xec\xbfr\xc8Bi\x90\"(\xf2\xc6\xcc\xfbX\x14{\x9e5\x87\x91\xe2\x9b\xd4\xc6\xc2whk+\x0f\x82\xca\xc1@\xcb~P\xe4\x18\xf9E\'\xab\xc7z\xd7\x05V{\xa1X\xa3\x10\x13.]tlz\x12\xde\xf2\xa43\xee#\x92J~\xda \x9b\xc4\xc0V\xb3\x9dCO\x1fu\x1c4\x1d\v}\x1b\xe5>w\xfbsm\xa3\fI|\x96-p\x86\xd3O\xfa\x9a\x8f\xb2\x8e\x88qGEG\x98\x8f\xefF\x9a\x16a\x9a,\xab1\x1aRc0\xdd\xf3\xa3\x0e@\x0f\xfd\xf4nd\xf4\x82\xff\xf4?s\xbb\xc7B0\fl\'\x8b\x1f\xe9\xfc%\xa5\xd6\xdfH5\x80\x80\x12\xe8s?\x10\xf0z3\x97r\xe7k\xa7it\x1f\x91\xee\xaa\xa8p\x04b\x9f\x8a\xae\x9e\x90\xed\x81L\xe7', 0x6) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000b, 0x4a092, r3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000200)={0x6, 0x6, 0x1}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$VT_OPENQRY(0xffffffffffffffff, 0x4b46, &(0x7f0000000000)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000240)='wlan0\x00', 0x10) bind$inet(r5, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r5, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r5, &(0x7f0000000900), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x180204}], 0x1) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) 5.6182406s ago: executing program 4 (id=2021): r0 = creat(&(0x7f0000000240)='./bus\x00', 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r4, 0x0, 0xd2, &(0x7f0000000040)={@broadcast, @multicast1, 0x1, "0d5011f02b7fab96e0aa834d3a9e861e6227c2b6ddaa5effda90000000000009", 0x5, 0x16, 0xfffffffe, 0x1}, 0x3c) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000000)={@broadcast, @multicast1, 0x0, "12ceaac82ab7d944e84b6fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) setsockopt$MRT_FLUSH(r5, 0x0, 0xd4, &(0x7f0000000100)=0xe, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') rmdir(&(0x7f0000000380)='./file0/../file0\x00') 5.576595968s ago: executing program 0 (id=2022): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) socket$caif_stream(0x25, 0x1, 0x1) unshare(0x22020400) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[], 0x50) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) 3.768614912s ago: executing program 1 (id=2023): syz_mount_image$udf(&(0x7f00000001c0), &(0x7f0000000100)='./file1\x00', 0x1004000, &(0x7f0000000440)=ANY=[@ANYBLOB="6769643d69676e6f72652c756e64656c6574652c616e63686f723d30303030303030303030303030303030303031312c6c6f6e6761642c756d61736b3d30303030303030303030303030303030303030303030342c756e686964652c756e64656c6574652c696f636861727365743d757466382c7569643d666f726765742c6e6f7374726963742c6c617374626c6f636b3d30303030303030303030303030303030303030312c6e6f7374726963742c7569643d69676e6f72652c6d6f64653d30303030303030303030303030303030303030303030352c0058290fc34cb3509fda5ac914c5b263dd70f4530ea447e8211074867af16c3c57581a329456bb56f93cc73532d673a7d28e3ac1f7ea684ca0ae8cb2a053b209942df624b1aa36d290f93d334d5e01658df013b341d33430503f7f34f39fc52e32b011"], 0x1, 0xc32, &(0x7f0000001bc0)="$eJzs3U9sXNd5N+D3XHHEofx9FRM7ipPGxaQtUlmxXP2LqViFO6pptgFkWQjF7AJwJFLqwBRJkFQjG2nBdNNFFwGKoousCLRGgRQNjKYIumRaF0g2XhRZdUW0sBEUXbBFgKwCFvfOGXFIkTYjkhJpP49N/WbunHPnnHvH98qC3jkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAET83iuXz5xNj3sUAMCjdHX0q2fOuf8DwMfKdf//DwAAAAAAAAAAAAAAB12KIp6MFLNXV9N49byjfqVdu3tvbHhk624Dqep5pGpf/tTPnjt/4UsvDF3s5pX29Af032ufjddGr19uvDxzZ3Zucn5+cqIxNt2+OTMxueM97Lb/ZqeqA9C48/rdiVu35hvnnj+/4eV7g+/3P3Fi8NLQs6ef6bYdGx4ZGV1vUt/y4UParsLjaBRxOlI8972fplZEFLH7Y1F/tOd+s4FqEqeqSYwNj1QTmWq3phfKF691D0QR0ejp1Oweo63PRfTVHukctteMWCyHXw74VDm90dnWXOvG1GTjWmtuob3Qnpm+ljqjLefTiCIupoiliFjpf3B3tSiiL1J85/hquhERR7rH4YtVYfD24yj2cY47UI6zUYtYKg7BOTvA+qOIVyPFz945GTfLY5Z/4gsRr5b5g4i3ynwpIpUfjAsR723xOeJw6osi/rw8/5dW00R1PeheV658rfGV6VszPW2715Vf8v7wwJXiMd0fBjblo3HAr031KKJVXfFX08P/ZgcAAAAAAAAAAAAAAACAvTYQRXwmUrzyb39U1RVHVZd+/NLQ7w/+/96a8ac/ZD9l2+cjYrHYWU3u0VwYeC1dS2mntcTqTvdcPYr441z/963HPRgAAAAAAAAAAAAAAAAAAICPtSJ+EilefPdkWoreNcXb07cb11s3pjqrwnbX/u2umb62trbWSJ1s5hzPuZhzKedyzpWcUeT+OZs5xwc6O17Mz5dyLudcyRlHcv+czZzjORdzLuVczrmSM/py/5zNnOM5F3Mu5VzOuZIzDsjavQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHyVFFPGLSPHtb6ymSBHRjBiPTi73P+7RAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACl/lTE9yNF4w+a97f1RUSq/u04Wf5yIZpHy/xkNIfKfCmal3O2quxrfusxjJ/dqaUifhwp+utv3z/h+fzXOs/ufwzirW+uP/tsXyePdF8cfL//iRPHLw2N/NrT2z1OWw3g1JX29N17jbHhkZHRns19+d0/2bNtML9vsTdTJyLm33jz9dbU1OTcwz8oPwK76H6IHqS+gz/T2oEf4SF6EH0HYhiPZ+58DJT3//cixW+/++/dG37n/l+P/9d5dv8OHz//k/X7/4ubd7TD+3/f5n75/l/e07e6/z/Zs+3F/LuRWl9EfeHObO1ERH3+jTdPt++0bk/enpy+cObMl4eGvnz+TO1oRP1We2qy59GeHC4AAAAAAAAAAAAAAACARycV8buRovXj1dSIiHtVvdbgpaFnTz9zJI5U9VYb6rZfG71+ufHyzJ3Zucn5+cmJxth0++bMxORO365elXuNDY/sy2Q+1MA+j3+g/vLM7Btz7dt/uLDl68fql2/ML8y1bm79cgxEEdHs3XKqGvDY8Eg16Kl2a7rqem3LYvpfXi0V8R+R4uaFRvp83pbr/zdX+G+o/1/cvKN9qv//RM+28j1TKuLnkeK3/uLp+Hw1zmPxwDHL7f4mUpy6+LncLo6W7bpj6HyvQKcysGz7P5HiH36xsW23HvLJ9bZnd3xgD4ny/B+PFN//s+/Gr+dtG7//Yevzf2zzjvbp/D/Vs+3Yhu8r2PXUyef/dKR46cm34zfytg/6/o/ud2+czI3vfz/HPp3/T/VsG8zv+5t7M3UAAAAAAAAAAIBDrZaK+NtI8cORvvRC3raTv/83sXlH+/T3vz7ds21ib9Yr+tAHuz6oAAAAAHBA1FIRP4kUtxfevl9DvbH+u6f+83fW6z+H06ZXqz/n+5XqewP28s//eg3m9x3f/bQBAAAAAAAAAAAAAAAAAADgQEmpiBfyeurjVT3/xLbrqS9Hilf+67ncLp0o23XXgR+sfq1fnZk+fXlqauZma6F1Y2qyMTrbujlZ9n0qUqz+9edy36JaX7273nxnjff1tdjnIsXI33XbdtZi765N/tR627Nl209Eiv/8+41tu+tYf2q97bmy7V9Fiq//09ZtT6y3PV+2/W6k+NHXG922x8q23e9H/fR62+dvzhT7cFYAAAAAAAAAAAAAAAAAAAD4uKmlIv40Uvz3naX7tfx5/f9az9PKW988tu1+7lXr/A9W6/9v9/hh1v+vvldgccueAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwkZWiiDcjxezV1bTcXz7vqF9pT9+9NzY8snW3gVT1PFK1L3/qZ8+dv/ClF4YudvOD+++1z8Rro9cvN16euTM7Nzk/PznRGJtu35yZmNzxHnbbf7NT1QFo3Hn97sStW/ONc8+f3/DyvcH3+584MXhp6NnTz3Tbjg2PjIz2tOmrPfS7PyBts/1oFPGXkeK57/00/bA/oojdH4sP+ezst4FqEqeqSYwNj1QTmWq3phfKF691D0QR0ejp1Oweo0dwLnalGbFYDr8c8KlyeqOzrbnWjanJxrXW3EJ7oT0zfS11RlvOpxFFXEwRSxGx0v/g7mpRxOuR4jvHV9M/90cc6R6HL14d/eqZc9uPo9jHOe5AOc5GLWKpOATn7ADrjyL+MVL87J2T8S/9EX3R+YkvRLxa5g8i3orO+U7lB+NCxHtbfI44nPqiiP8tz/+l1fROf3k96F5Xrnyt8ZXpWzM9bbvXlUN/f3iUDvi1qR5F/Ki64q+mf/XfNQAAAAAAAAAAAAAAAMABUsSvRooX3z2Zqvrg+zXF7enbjeutG1Odsr5u7V+3ZnptbW2tkTrZzDmeczHnUs7lnCs5o8j9czbLrK+tjefnizmXci7nXMkZR3L/nM2c4zkXcy7lXM65kjP6cv+czZzjORdzLuVczrmSMw5I7R4AAAAAAAAAAAAAAAAAAPDRUlT/pPj2N1bTWn9nfenx6OSy9UA/8v4vAAD///RZ9vs=") openat$dir(0xffffffffffffff9c, 0x0, 0x204000, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x100000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000540)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x2f, 0xfd, 0x4, 0xb753, 0x20, @loopback, @mcast2={0xff, 0x3}, 0x8000, 0xba08, 0x0, 0x1004}}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) socket(0x29, 0xa, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'comedi_parport\x00', [0x4f27, 0x0, 0x4, 0x4, 0x5, 0x5, 0x7, 0x7, 0x54c6cff3, 0xfd, 0x2, 0x7, 0x1, 0x1, 0x6, 0x5, 0x0, 0x7f, 0x3, 0x40000003, 0x89, 0xcaa3, 0x0, 0x20001e5b, 0x3, 0xe66, 0x3, 0x8, 0x4086, 0x0, 0xfffffff8]}) socket$nl_route(0x10, 0x3, 0x0) 3.678118895s ago: executing program 4 (id=2024): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x4a0c00, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={@rand_addr=' \x01\x00', @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x1000, 0x0, 0x0, 0x1, 0x1000200}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x40, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x80}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x1}, 0x94) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(0x0, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0xc000) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f00000000c0)={'dt2815\x00', [0x8002f, 0x80, 0x10002, 0x4, 0x1, 0xcc7, 0x80000008, 0x17, 0xa, 0x24c, 0xfff, 0x7, 0x5, 0x5, 0x2, 0x105, 0x8, 0x2, 0x2009, 0x1, 0x488, 0x6, 0x4000000, 0x20001e5a, 0x1000b, 0x7, 0x9, 0x800008, 0x4, 0x401, 0xfffffffd]}) sendfile(r1, r1, 0x0, 0x8) 3.61087702s ago: executing program 3 (id=2025): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r0 = fanotify_init(0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = epoll_create1(0x0) epoll_wait(r1, &(0x7f0000000180)=[{}], 0x1, 0x86) r2 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x103000) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)}, &(0x7f00000007c0)=0x10) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f00000006c0)={0x0, 'bridge0\x00', {0x101}, 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x2241, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f00000001c0)={"f2efe21e", 0x0, 0x6, 0x4d, 0x0, 0x1ff, "2179d46fd08e3c0ced34c7d0c7e6d7", "7ca24a13", '\x00', "a2d1d4a2", ["1af0b1ba1cb8fd54c9c9b587", "bed0f3d6ce7a5f7389827f04", "33af343c60abc64f2fdc9ddf", "9b3842fc63849f62b6eb1c3c"]}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000740)) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000880)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x89) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x2c, r5, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x40}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000}, 0x4000020) r6 = syz_open_dev$cec(&(0x7f0000000d00), 0x0, 0xc0b02) ioctl$CEC_TRANSMIT(r6, 0xc0386105, &(0x7f0000000d40)={0x0, 0x1, 0x4, 0x0, 0x0, 0x4063, "57c1169b6664ea61326ac71ae7213059"}) ioctl$CEC_TRANSMIT(r6, 0xc0386105, &(0x7f0000000140)={0x100000000, 0x800, 0xf, 0x80000001, 0xfe1c, 0x6, "72aba977db089b65fdfdc5bd97abc350", 0x74, 0x3, 0xa7, 0x7, 0x8, 0x7, 0x29}) r7 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r7, 0xc05c6104, &(0x7f0000000340)={"6d71f879", 0x5, 0x0, 0x0, 0x0, 0x0, "244a18d1c4e6469a005caf0c0ff58a", "ce4250d8", "bf513d1d", "136712b9", ["27e203a56a36ac4f0b8b8c4f", "5e10229555954b0f02cd1469", "cb0e83d3a15978155c384d00", "79f56ca74227234da829edb7"]}) close_range(r0, 0xffffffffffffffff, 0x0) 3.556819494s ago: executing program 0 (id=2026): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) socket$caif_stream(0x25, 0x1, 0x1) unshare(0x22020400) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[], 0x50) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000180)=0x10000000005) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) write$sequencer(0xffffffffffffffff, 0x0, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 2.371940357s ago: executing program 1 (id=2027): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, 0x0, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000054c0)=@newtfilter={0x30, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x18, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r5, 0xc}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 2.281007306s ago: executing program 3 (id=2028): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000180)=@id={0x1e, 0x3, 0x3, {0x4e21}}, 0x10) r3 = socket(0x2, 0x3, 0xff) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x4b52, &(0x7f0000000000)={0x2, {0x2, 0x200, 0x7e, 0x0, 0xff91, 0xf}}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f"], 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) connect$inet(r3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$binfmt_elf32(r3, &(0x7f0000000180)=ANY=[], 0x14) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) mmap(&(0x7f00000ca000/0x3000)=nil, 0x3000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) 2.159421179s ago: executing program 4 (id=2029): prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) dup2(r0, r1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="5000000002060500000000010000000000000000050005000a000000050004000000000005000100070000000900020073797a310000000016000300686173683a6e65742c706f72742c6e6574"], 0x50}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f00000500070084"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.120283065s ago: executing program 4 (id=2030): syz_mount_image$udf(&(0x7f00000001c0), &(0x7f0000000100)='./file1\x00', 0x1004000, &(0x7f0000000440)=ANY=[@ANYBLOB="6769643d69676e6f72652c756e64656c6574652c616e63686f723d30303030303030303030303030303030303031312c6c6f6e6761642c756d61736b3d30303030303030303030303030303030303030303030342c756e686964652c756e64656c6574652c696f636861727365743d757466382c7569643d666f726765742c6e6f7374726963742c6c617374626c6f636b3d30303030303030303030303030303030303030312c6e6f7374726963742c7569643d69676e6f72652c6d6f64653d30303030303030303030303030303030303030303030352c0058290fc34cb3509fda5ac914c5b263dd70f4530ea447e8211074867af16c3c57581a329456bb56f93cc73532d673a7d28e3ac1f7ea684ca0ae8cb2a053b209942df624b1aa36d290f93d334d5e01658df013b341d33430503f7f34f39fc52e32b011"], 0x1, 0xc32, &(0x7f0000001bc0)="$eJzs3U9sXNd5N+D3XHHEofx9FRM7ipPGxaQtUlmxXP2LqViFO6pptgFkWQjF7AJwJFLqwBRJkFQjG2nBdNNFFwGKoousCLRGgRQNjKYIumRaF0g2XhRZdUW0sBEUXbBFgKwCFvfOGXFIkTYjkhJpP49N/WbunHPnnHvH98qC3jkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAET83iuXz5xNj3sUAMCjdHX0q2fOuf8DwMfKdf//DwAAAAAAAAAAAAAAB12KIp6MFLNXV9N49byjfqVdu3tvbHhk624Dqep5pGpf/tTPnjt/4UsvDF3s5pX29Af032ufjddGr19uvDxzZ3Zucn5+cqIxNt2+OTMxueM97Lb/ZqeqA9C48/rdiVu35hvnnj+/4eV7g+/3P3Fi8NLQs6ef6bYdGx4ZGV1vUt/y4UParsLjaBRxOlI8972fplZEFLH7Y1F/tOd+s4FqEqeqSYwNj1QTmWq3phfKF691D0QR0ejp1Oweo63PRfTVHukctteMWCyHXw74VDm90dnWXOvG1GTjWmtuob3Qnpm+ljqjLefTiCIupoiliFjpf3B3tSiiL1J85/hquhERR7rH4YtVYfD24yj2cY47UI6zUYtYKg7BOTvA+qOIVyPFz945GTfLY5Z/4gsRr5b5g4i3ynwpIpUfjAsR723xOeJw6osi/rw8/5dW00R1PeheV658rfGV6VszPW2715Vf8v7wwJXiMd0fBjblo3HAr031KKJVXfFX08P/ZgcAAAAAAAAAAAAAAACAvTYQRXwmUrzyb39U1RVHVZd+/NLQ7w/+/96a8ac/ZD9l2+cjYrHYWU3u0VwYeC1dS2mntcTqTvdcPYr441z/963HPRgAAAAAAAAAAAAAAAAAAICPtSJ+EilefPdkWoreNcXb07cb11s3pjqrwnbX/u2umb62trbWSJ1s5hzPuZhzKedyzpWcUeT+OZs5xwc6O17Mz5dyLudcyRlHcv+czZzjORdzLuVczrmSM/py/5zNnOM5F3Mu5VzOuZIzDsjavQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHyVFFPGLSPHtb6ymSBHRjBiPTi73P+7RAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACl/lTE9yNF4w+a97f1RUSq/u04Wf5yIZpHy/xkNIfKfCmal3O2quxrfusxjJ/dqaUifhwp+utv3z/h+fzXOs/ufwzirW+uP/tsXyePdF8cfL//iRPHLw2N/NrT2z1OWw3g1JX29N17jbHhkZHRns19+d0/2bNtML9vsTdTJyLm33jz9dbU1OTcwz8oPwK76H6IHqS+gz/T2oEf4SF6EH0HYhiPZ+58DJT3//cixW+/++/dG37n/l+P/9d5dv8OHz//k/X7/4ubd7TD+3/f5n75/l/e07e6/z/Zs+3F/LuRWl9EfeHObO1ERH3+jTdPt++0bk/enpy+cObMl4eGvnz+TO1oRP1We2qy59GeHC4AAAAAAAAAAAAAAACARycV8buRovXj1dSIiHtVvdbgpaFnTz9zJI5U9VYb6rZfG71+ufHyzJ3Zucn5+cmJxth0++bMxORO365elXuNDY/sy2Q+1MA+j3+g/vLM7Btz7dt/uLDl68fql2/ML8y1bm79cgxEEdHs3XKqGvDY8Eg16Kl2a7rqem3LYvpfXi0V8R+R4uaFRvp83pbr/zdX+G+o/1/cvKN9qv//RM+28j1TKuLnkeK3/uLp+Hw1zmPxwDHL7f4mUpy6+LncLo6W7bpj6HyvQKcysGz7P5HiH36xsW23HvLJ9bZnd3xgD4ny/B+PFN//s+/Gr+dtG7//Yevzf2zzjvbp/D/Vs+3Yhu8r2PXUyef/dKR46cm34zfytg/6/o/ud2+czI3vfz/HPp3/T/VsG8zv+5t7M3UAAAAAAAAAAIBDrZaK+NtI8cORvvRC3raTv/83sXlH+/T3vz7ds21ib9Yr+tAHuz6oAAAAAHBA1FIRP4kUtxfevl9DvbH+u6f+83fW6z+H06ZXqz/n+5XqewP28s//eg3m9x3f/bQBAAAAAAAAAAAAAAAAAADgQEmpiBfyeurjVT3/xLbrqS9Hilf+67ncLp0o23XXgR+sfq1fnZk+fXlqauZma6F1Y2qyMTrbujlZ9n0qUqz+9edy36JaX7273nxnjff1tdjnIsXI33XbdtZi765N/tR627Nl209Eiv/8+41tu+tYf2q97bmy7V9Fiq//09ZtT6y3PV+2/W6k+NHXG922x8q23e9H/fR62+dvzhT7cFYAAAAAAAAAAAAAAAAAAAD4uKmlIv40Uvz3naX7tfx5/f9az9PKW988tu1+7lXr/A9W6/9v9/hh1v+vvldgccueAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwkZWiiDcjxezV1bTcXz7vqF9pT9+9NzY8snW3gVT1PFK1L3/qZ8+dv/ClF4YudvOD+++1z8Rro9cvN16euTM7Nzk/PznRGJtu35yZmNzxHnbbf7NT1QFo3Hn97sStW/ONc8+f3/DyvcH3+584MXhp6NnTz3Tbjg2PjIz2tOmrPfS7PyBts/1oFPGXkeK57/00/bA/oojdH4sP+ezst4FqEqeqSYwNj1QTmWq3phfKF691D0QR0ejp1Oweo0dwLnalGbFYDr8c8KlyeqOzrbnWjanJxrXW3EJ7oT0zfS11RlvOpxFFXEwRSxGx0v/g7mpRxOuR4jvHV9M/90cc6R6HL14d/eqZc9uPo9jHOe5AOc5GLWKpOATn7ADrjyL+MVL87J2T8S/9EX3R+YkvRLxa5g8i3orO+U7lB+NCxHtbfI44nPqiiP8tz/+l1fROf3k96F5Xrnyt8ZXpWzM9bbvXlUN/f3iUDvi1qR5F/Ki64q+mf/XfNQAAAAAAAAAAAAAAAMABUsSvRooX3z2Zqvrg+zXF7enbjeutG1Odsr5u7V+3ZnptbW2tkTrZzDmeczHnUs7lnCs5o8j9czbLrK+tjefnizmXci7nXMkZR3L/nM2c4zkXcy7lXM65kjP6cv+czZzjORdzLuVczrmSMw5I7R4AAAAAAAAAAAAAAAAAAPDRUlT/pPj2N1bTWn9nfenx6OSy9UA/8v4vAAD///RZ9vs=") openat$dir(0xffffffffffffff9c, 0x0, 0x204000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000540)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x2f, 0xfd, 0x4, 0xb753, 0x20, @loopback, @mcast2={0xff, 0x3}, 0x8000, 0xba08, 0x0, 0x1004}}) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) 965.375505ms ago: executing program 2 (id=2031): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x4a0c00, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={@rand_addr=' \x01\x00', @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x1000, 0x0, 0x0, 0x1, 0x1000200}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x7, 0x1, 0x1, 0x0, 0x80}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x1}, 0x94) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(0x0, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0xc000) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f00000000c0)={'dt2815\x00', [0x8002f, 0x80, 0x10002, 0x4, 0x1, 0xcc7, 0x80000008, 0x17, 0xa, 0x24c, 0xfff, 0x7, 0x5, 0x5, 0x2, 0x105, 0x8, 0x2, 0x2009, 0x1, 0x488, 0x6, 0x4000000, 0x20001e5a, 0x1000b, 0x7, 0x9, 0x800008, 0x4, 0x401, 0xfffffffd]}) sendfile(r1, r1, 0x0, 0x8) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x8000000000015) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {}, [{0x84, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4, 0x2}, {0xc}, {0xc}}}, @m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0xfffffffffffffffe}}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x34}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000b40)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 0s ago: executing program 4 (id=2032): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='source', &(0x7f0000000640)='//\xf2b\x06\b\xba\xdfXo\xdc\xea\x95\x9a\x9b/Q9\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce\x14//\\\x00\x00\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b,\xc1\x8d\\Rxt\'\xb6\xbf\xc8*\n\xaf\x1b\xec\xfd\xbbY\x99\xb3\x06c\xd6\xf6\xb0\xcd=\xf3\x03`\x93\xff\x05e\xaa$\x00\xeaw\xd9\x10\x0f\x1d\x888\x8cS\x12?R\x99\xda7\xce)\x8f\xcc\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd32J\xd7\x9f\xea:=\xcc\x17(|L\xda\xc3\x1ca\xe8s\xb6\xebw\xc7\xabS\xd7pJ\xd2\xa1\xcf\xae\x1f2\x9f\x98\xa80\r\x85\xb4\x86\xbc\xd0\xea\xbf\xb1Z\xb7e$\xcf<\ra\x9b\xa5\xdc\v\x1e\xfd\xc7\x91\xf22\xcf\x96\x99\xc1\xbb\xa1j\xe5\xa8\x7f\a\xa9\xa7G\xad\xa3\x8b\xf1\xdb\\]R\x8cf\xac1\xd7V\xaf\xb5\x8e\x10\x95\x9f=2\xd0-\xe1K:\xc3b\x89\x15OS\xa5\x98Ky\x12\xe7Qt#\xeb\x99\a\x10\x1c\xb3N\x85\xeb\x80\x05\x82_\x15\xdc\xbc\xf93\xdd\xf5g\x98\xd4\x8az\xe4`\xa5\x00\x00\x00\x00\xcd\x13\xfc+\xac\xe5\x8bI\f\xd6\x89\xc7HY\xcf\x00O\x88\xe6\x8b\x8bF/\x82u\xffCnG\x02\x82\xfc\xe9Od\x92\x06\xdeg@y\xa6=4\xb1}\xa8Yr\xad9\xb9b)\xec}\x87=\x91:IV\xab\xdf\xa2\xba+6D\x1fuf\xdeJYw$L\xa1\x83NH\xe3\xf2\x91\x8cW\xb7\b\x04\x12\x8b\x8bV\x19\xf1\r\xcb\x94\xa3\xf4\xe4\x97$\x99c\rG\xd7#\xe2\xfd\x80\xadR\x83\xdc\xb8d\x15|\xac\xb8g$\x0f@\xca3\x9f\xb1\xea\xc6vQ\x1b\xdb#\xa3\"\x9f\x9e\xd8\xba\x13d\x9bx\x9a\xbf\xee\xf2kQ\xe0\xc4/~7\xcd\xd1\x06\xe5\x17\x9b\bW|\xbc\x86D\x05\xaf<\xdfy,I2f\xa7G\xe3Qp<\'6 x\n\x94f\xf8\xa2\xea\xf4\xa5\x9eY\xf80C\x91\x7f\x16u\x8c(Xl\x90\xd2\x9f\xa9\xb9kJy[F!{\xe5\x1a\xe9\xb7T\x19;\xb9\t\xe7\x0ei\xfaZ\xfbS:\x9b\xc1r\xcbM.\xf8\xb8wR\xb3p~b\xcb\v1-\a-\x8a#\xaa1\xa9\x9a\x88\a\xc5\xb9*\xd3?\xac\n\x9c\xcd\xe2\xc9\xbd\xeb\xb3\xf65\xbdaP\t\xd6\x06\x1c\xeeNg\x92>\x92>\xaf\b3\x05\xfdM\xd2F\v\xbd\xeb\x83 \x9d\x90S\x11w\xefg\\\xca\xe2\xfc~w\xbe\xefh#\x96\xa5h\xec\xbfr\xc8Bi\x90\"(\xf2\xc6\xcc\xfbX\x14{\x9e5\x87\x91\xe2\x9b\xd4\xc6\xc2whk+\x0f\x82\xca\xc1@\xcb~P\xe4\x18\xf9E\'\xab\xc7z\xd7\x05V{\xa1X\xa3\x10\x13.]tlz\x12\xde\xf2\xa43\xee#\x92J~\xda \x9b\xc4\xc0V\xb3\x9dCO\x1fu\x1c4\x1d\v}\x1b\xe5>w\xfbsm\xa3\fI|\x96-p\x86\xd3O\xfa\x9a\x8f\xb2\x8e\x88qGEG\x98\x8f\xefF\x9a\x16a\x9a,\xab1\x1aRc0\xdd\xf3\xa3\x0e@\x0f\xfd\xf4nd\xf4\x82\xff\xf4?s\xbb\xc7B0\fl\'\x8b\x1f\xe9\xfc%\xa5\xd6\xdfH5\x80\x80\x12\xe8s?\x10\xf0z3\x97r\xe7k\xa7it\x1f\x91\xee\xaa\xa8p\x04b\x9f\x8a\xae\x9e\x90\xed\x81L\xe7', 0x6) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000b, 0x4a092, r3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000200)={0x6, 0x6, 0x1}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$VT_OPENQRY(0xffffffffffffffff, 0x4b46, &(0x7f0000000000)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000240)='wlan0\x00', 0x10) bind$inet(r5, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r5, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r5, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180), 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): ess `syz.0.242'. [ 115.164177][ T6684] netlink: 8 bytes leftover after parsing attributes in process `syz.0.242'. [ 115.261289][ T6697] netlink: 'syz.0.242': attribute type 4 has an invalid length. [ 117.037467][ T803] hid-generic 0005:0006:5508.0002: hidraw0: BLUETOOTH HID vc3.36 Device [syz0] on aa:aa:aa:aa:aa:aa [ 117.268829][ T6755] fido_id[6755]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci4/hci4:200/report_descriptor': No such file or directory [ 117.642105][ T5947] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 117.830626][ T5947] usb 3-1: Using ep0 maxpacket: 16 [ 117.848838][ T5947] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 117.877050][ T5947] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 117.899608][ T5947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.923293][ T30] audit: type=1326 audit(1772652348.937:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe6fb19c799 code=0x7ffc0000 [ 117.949149][ T5947] usb 3-1: Product: syz [ 117.959088][ T5947] usb 3-1: Manufacturer: syz [ 117.976232][ T5947] usb 3-1: SerialNumber: syz [ 117.999542][ T5947] usb 3-1: config 0 descriptor?? [ 118.012753][ T30] audit: type=1326 audit(1772652348.957:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 118.055996][ T5947] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 118.080684][ T5947] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 118.111379][ T30] audit: type=1326 audit(1772652348.957:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 118.246264][ T30] audit: type=1326 audit(1772652348.957:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 118.349896][ T30] audit: type=1326 audit(1772652348.957:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 118.466010][ T30] audit: type=1326 audit(1772652348.957:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 118.535852][ T30] audit: type=1326 audit(1772652348.957:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 118.617547][ T30] audit: type=1326 audit(1772652348.957:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 118.724266][ T30] audit: type=1326 audit(1772652348.957:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 118.764918][ T5947] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 118.820794][ T30] audit: type=1326 audit(1772652348.957:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6768 comm="syz.1.266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe6fb19c42b code=0x7ffc0000 [ 119.198117][ T5947] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 119.250732][ T5947] em28xx 3-1:0.0: board has no eeprom [ 119.365150][ T5947] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 119.390968][ T5947] em28xx 3-1:0.0: dvb set to bulk mode. [ 119.413263][ T10] em28xx 3-1:0.0: Binding DVB extension [ 119.438494][ T5947] usb 3-1: USB disconnect, device number 7 [ 119.554529][ T5947] em28xx 3-1:0.0: Disconnecting em28xx [ 119.674784][ T10] em28xx 3-1:0.0: Registering input extension [ 119.706591][ T5947] em28xx 3-1:0.0: Closing input extension [ 119.773938][ T5947] em28xx 3-1:0.0: Freeing device [ 120.762468][ T6830] netlink: 8 bytes leftover after parsing attributes in process `syz.0.281'. [ 120.796058][ T6830] netlink: 8 bytes leftover after parsing attributes in process `syz.0.281'. [ 120.870066][ T6827] netlink: 'syz.0.281': attribute type 4 has an invalid length. [ 122.685152][ T6869] netlink: 'syz.3.296': attribute type 1 has an invalid length. [ 123.180334][ T6869] 8021q: adding VLAN 0 to HW filter on device bond1 [ 123.265827][ T6870] vlan2: entered allmulticast mode [ 123.299512][ T6870] vlan0: entered allmulticast mode [ 123.326823][ T6870] veth0_vlan: entered allmulticast mode [ 123.405568][ T6870] bond1: (slave vlan2): making interface the new active one [ 123.483834][ T6870] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 124.170846][ T6896] fuse: Bad value for 'user_id' [ 124.186016][ T6896] fuse: Bad value for 'user_id' [ 125.077343][ T6919] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input9 [ 126.695973][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 126.695993][ T30] audit: type=1326 audit(1772652357.707:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa20e79c799 code=0x7ffc0000 [ 126.786508][ T30] audit: type=1326 audit(1772652357.737:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa20e79c799 code=0x7ffc0000 [ 126.867994][ T30] audit: type=1326 audit(1772652357.737:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 126.894554][ T30] audit: type=1326 audit(1772652357.737:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 126.930619][ T30] audit: type=1326 audit(1772652357.737:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 127.029628][ T30] audit: type=1326 audit(1772652357.737:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 127.101063][ T30] audit: type=1326 audit(1772652357.737:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 127.149063][ T30] audit: type=1326 audit(1772652357.737:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 127.197405][ T30] audit: type=1326 audit(1772652357.737:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 127.236969][ T30] audit: type=1326 audit(1772652357.737:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6950 comm="syz.4.321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 127.280875][ T5947] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 127.406371][ T6974] binder: 6973:6974 ioctl c0306201 2000000003c0 returned -14 [ 127.440603][ T5947] usb 5-1: Using ep0 maxpacket: 16 [ 127.453495][ T5947] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 127.474872][ T5947] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 127.485376][ T5947] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.508741][ T5947] usb 5-1: Product: syz [ 127.517286][ T5947] usb 5-1: Manufacturer: syz [ 127.529584][ T5947] usb 5-1: SerialNumber: syz [ 127.566077][ T5947] usb 5-1: config 0 descriptor?? [ 127.586862][ T5947] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 127.602011][ T5947] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 128.004039][ T6987] netlink: 8 bytes leftover after parsing attributes in process `syz.3.330'. [ 128.021955][ T6987] netlink: 8 bytes leftover after parsing attributes in process `syz.3.330'. [ 128.080328][ T6982] netlink: 'syz.3.330': attribute type 4 has an invalid length. [ 128.190725][ T5947] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 128.603011][ T5947] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 128.632881][ T5947] em28xx 5-1:0.0: board has no eeprom [ 128.730583][ T5947] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 128.756063][ T5947] em28xx 5-1:0.0: dvb set to bulk mode. [ 128.781107][ T10] em28xx 5-1:0.0: Binding DVB extension [ 128.823380][ T5947] usb 5-1: USB disconnect, device number 4 [ 128.890666][ T5947] em28xx 5-1:0.0: Disconnecting em28xx [ 128.989002][ T10] em28xx 5-1:0.0: Registering input extension [ 129.018710][ T5947] em28xx 5-1:0.0: Closing input extension [ 129.162972][ T5947] em28xx 5-1:0.0: Freeing device [ 130.286246][ T7025] syzkaller0: entered promiscuous mode [ 130.335187][ T7025] syzkaller0: entered allmulticast mode [ 130.517572][ T7037] syzkaller1: entered promiscuous mode [ 130.526935][ T7037] syzkaller1: entered allmulticast mode [ 132.601675][ T7076] fuse: Unknown parameter 'use00000000000000000000' [ 132.928416][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.937320][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.003051][ T7118] netlink: 8 bytes leftover after parsing attributes in process `syz.2.366'. [ 134.026450][ T7118] netlink: 8 bytes leftover after parsing attributes in process `syz.2.366'. [ 134.096095][ T7113] netlink: 'syz.2.366': attribute type 4 has an invalid length. [ 134.483012][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 134.483031][ T30] audit: type=1326 audit(1772652365.497:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 134.591962][ T30] audit: type=1326 audit(1772652365.497:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 134.737040][ T30] audit: type=1326 audit(1772652365.527:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 134.802416][ T30] audit: type=1326 audit(1772652365.527:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 134.914382][ T30] audit: type=1326 audit(1772652365.527:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 135.024271][ T30] audit: type=1326 audit(1772652365.527:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 135.112159][ T30] audit: type=1326 audit(1772652365.527:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 135.228081][ T30] audit: type=1326 audit(1772652365.527:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 135.306642][ T30] audit: type=1326 audit(1772652365.527:148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 135.396996][ T30] audit: type=1326 audit(1772652365.527:149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7124 comm="syz.3.369" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 136.190824][ T5947] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 136.382145][ T5947] usb 4-1: config index 0 descriptor too short (expected 65183, got 72) [ 136.414084][ T5947] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 136.439222][ T5947] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.473084][ T5947] usb 4-1: Product: syz [ 136.486484][ T5947] usb 4-1: Manufacturer: syz [ 136.506643][ T5947] usb 4-1: SerialNumber: syz [ 136.554368][ T5947] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 136.581149][ T10] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 136.809830][ T7165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.845405][ T7165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.899106][ T7165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.928925][ T7165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.079861][ T5888] usb 4-1: USB disconnect, device number 5 [ 137.722888][ T10] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 137.743894][ T7184] capability: warning: `syz.0.386' uses 32-bit capabilities (legacy support in use) [ 137.755751][ T10] ath9k_htc: Failed to initialize the device [ 137.791564][ T5888] usb 4-1: ath9k_htc: USB layer deinitialized [ 137.839499][ C0] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 137.937997][ T7188] overlayfs: failed to resolve './file0': -2 [ 138.045752][ T7193] overlayfs: failed to resolve './file0': -2 [ 138.142137][ T5888] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 138.310618][ T5888] usb 4-1: Using ep0 maxpacket: 32 [ 138.335741][ T5888] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 138.374040][ T5888] usb 4-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice=d2.a2 [ 138.408622][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.436246][ T7208] kvm: vcpu 0: requested 3328 ns lapic timer period limited to 200000 ns [ 138.463295][ T5888] usb 4-1: Product: syz [ 138.491674][ T5888] usb 4-1: Manufacturer: syz [ 138.506161][ T5888] usb 4-1: SerialNumber: syz [ 138.528245][ T5888] usb 4-1: config 0 descriptor?? [ 138.570974][ T5888] mos7840 4-1:0.0: required endpoints missing [ 139.682259][ T5830] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 139.728036][ T7238] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 139.777776][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 139.816993][ T24] usb 4-1: USB disconnect, device number 6 [ 139.840643][ T5830] usb 2-1: device descriptor read/64, error -71 [ 139.886278][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 139.886297][ T30] audit: type=1326 audit(1772652370.887:175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa20e79c799 code=0x7ffc0000 [ 139.930308][ T30] audit: type=1326 audit(1772652370.897:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.020399][ T30] audit: type=1326 audit(1772652370.897:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.079489][ T30] audit: type=1326 audit(1772652370.897:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.122305][ T30] audit: type=1326 audit(1772652370.897:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.145866][ T5830] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 140.167165][ T30] audit: type=1326 audit(1772652370.897:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.192836][ T30] audit: type=1326 audit(1772652370.897:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.218591][ T30] audit: type=1326 audit(1772652370.897:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.254623][ T30] audit: type=1326 audit(1772652370.927:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.280294][ T30] audit: type=1326 audit(1772652370.927:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7239 comm="syz.4.404" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 140.303079][ T5830] usb 2-1: device descriptor read/64, error -71 [ 140.423825][ T5830] usb usb2-port1: attempt power cycle [ 140.773500][ T5830] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 140.813387][ T5830] usb 2-1: device descriptor read/8, error -71 [ 140.991110][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 141.061478][ T5830] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 141.104595][ T5830] usb 2-1: device descriptor read/8, error -71 [ 141.145636][ T7274] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 141.231016][ T5830] usb usb2-port1: unable to enumerate USB device [ 141.257524][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 141.364306][ T7282] fuse: Invalid rootmode [ 141.963376][ T7302] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 142.094271][ T7308] fuse: Invalid rootmode [ 142.482530][ T7325] fuse: Unknown parameter 'user_id00000000000000000000' [ 142.617286][ T7327] overlayfs: failed to resolve './file1': -2 [ 142.725772][ T7334] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 142.895487][ T7341] fuse: Invalid rootmode [ 142.949280][ T7343] fuse: Unknown parameter 'user_i00000000000000000000' [ 143.334462][ T7357] fuse: Unknown parameter 'user_id00000000000000000000' [ 143.600467][ T7367] fuse: Bad value for 'rootmode' [ 143.759340][ T7369] syzkaller1: entered promiscuous mode [ 143.766035][ T7371] fuse: Unknown parameter 'user_id00000000000000000000' [ 143.780310][ T7369] syzkaller1: entered allmulticast mode [ 145.241683][ T5888] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 145.407011][ T7435] fuse: Bad value for 'fd' [ 145.440608][ T5888] usb 4-1: Using ep0 maxpacket: 32 [ 145.464535][ T5888] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 145.522283][ T5888] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 145.559328][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 145.583521][ T5888] usb 4-1: Product: syz [ 145.604389][ T5888] usb 4-1: Manufacturer: syz [ 145.619866][ T5888] usb 4-1: SerialNumber: syz [ 145.665170][ T5888] usb 4-1: config 0 descriptor?? [ 145.698530][ T7424] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 145.718825][ T5888] hub 4-1:0.0: bad descriptor, ignoring hub [ 145.752321][ T5888] hub 4-1:0.0: probe with driver hub failed with error -5 [ 146.458439][ T30] kauditd_printk_skb: 92 callbacks suppressed [ 146.458459][ T30] audit: type=1326 audit(1772652377.467:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa20e79c799 code=0x7ffc0000 [ 146.511693][ T30] audit: type=1326 audit(1772652377.497:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 146.537834][ T30] audit: type=1326 audit(1772652377.497:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 146.615153][ T7465] overlayfs: failed to resolve './file1': -2 [ 146.626338][ T30] audit: type=1326 audit(1772652377.497:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 146.703350][ T30] audit: type=1326 audit(1772652377.497:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 146.798876][ T30] audit: type=1326 audit(1772652377.497:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 146.879379][ T30] audit: type=1326 audit(1772652377.497:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 146.936850][ T30] audit: type=1326 audit(1772652377.497:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 147.002073][ C0] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 147.032287][ T30] audit: type=1326 audit(1772652377.497:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 147.072046][ T30] audit: type=1326 audit(1772652377.497:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7461 comm="syz.4.479" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa20e79c42b code=0x7ffc0000 [ 147.151517][ C0] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 147.343498][ T7480] overlayfs: failed to resolve './file1': -2 [ 147.375610][ T7482] fuse: Unknown parameter 'use00000000000000000000' [ 147.771317][ T5830] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 147.861558][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 147.952485][ T5830] usb 3-1: Using ep0 maxpacket: 32 [ 147.969188][ T5830] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 147.983735][ T5830] usb 3-1: config 0 has no interface number 0 [ 147.998226][ T5830] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 148.026782][ T5830] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 148.044827][ T5830] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.062810][ T5830] usb 3-1: Product: syz [ 148.074377][ T5830] usb 3-1: Manufacturer: syz [ 148.086020][ T5830] usb 3-1: SerialNumber: syz [ 148.100254][ T5830] usb 3-1: config 0 descriptor?? [ 148.110263][ T7488] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 148.262554][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 148.328605][ T7488] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 148.370874][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 148.960310][ T7522] overlayfs: failed to resolve './file0': -2 [ 149.156775][ T5830] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 149.185535][ T5830] asix 3-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 149.198629][ T5830] asix 3-1:0.188: probe with driver asix failed with error -61 [ 149.259583][ T7524] overlayfs: failed to resolve './file1': -2 [ 150.214796][ T803] usb 4-1: USB disconnect, device number 7 [ 150.580584][ C0] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 150.604615][ T5888] usb 3-1: USB disconnect, device number 8 [ 150.872674][ T803] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 151.043359][ T803] usb 4-1: config index 0 descriptor too short (expected 65183, got 72) [ 151.090315][ T803] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 151.123160][ T803] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.140106][ T803] usb 4-1: Product: syz [ 151.148235][ T803] usb 4-1: Manufacturer: syz [ 151.163742][ T803] usb 4-1: SerialNumber: syz [ 151.204790][ T803] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 151.248728][ T24] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 151.472302][ T7593] netlink: 8 bytes leftover after parsing attributes in process `syz.1.521'. [ 151.487830][ T7593] netlink: 16 bytes leftover after parsing attributes in process `syz.1.521'. [ 151.488086][ T7568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.557865][ T7568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.609116][ T7568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.661024][ T7568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.701105][ T7568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.734458][ T7568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.752277][ T7597] binder: 7596:7597 ioctl c0306201 2000000003c0 returned -14 [ 151.780452][ T5888] usb 4-1: USB disconnect, device number 8 [ 152.361769][ T24] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 152.389324][ T24] ath9k_htc: Failed to initialize the device [ 152.408052][ T5888] usb 4-1: ath9k_htc: USB layer deinitialized [ 152.415848][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 152.551787][ T5830] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 152.743256][ T5830] usb 2-1: Using ep0 maxpacket: 32 [ 152.767254][ T5830] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 152.781460][ T5888] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 152.798080][ T5830] usb 2-1: config 0 has no interface number 0 [ 152.813729][ T5830] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 152.856332][ T5830] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 152.884404][ T5830] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.907762][ T5830] usb 2-1: Product: syz [ 152.914883][ T5830] usb 2-1: Manufacturer: syz [ 152.919570][ T5830] usb 2-1: SerialNumber: syz [ 152.943441][ T5830] usb 2-1: config 0 descriptor?? [ 152.951709][ T5888] usb 4-1: Using ep0 maxpacket: 32 [ 152.957817][ T7608] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 152.967615][ T5888] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 152.999507][ T5888] usb 4-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice=d2.a2 [ 153.011414][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.019619][ T5888] usb 4-1: Product: syz [ 153.024351][ T5888] usb 4-1: Manufacturer: syz [ 153.029081][ T5888] usb 4-1: SerialNumber: syz [ 153.048984][ T5888] usb 4-1: config 0 descriptor?? [ 153.066387][ T5888] mos7840 4-1:0.0: required endpoints missing [ 153.182276][ T7608] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 153.965680][ T7656] netlink: 8 bytes leftover after parsing attributes in process `syz.0.540'. [ 153.982957][ T7656] netlink: 8 bytes leftover after parsing attributes in process `syz.0.540'. [ 154.009464][ T5830] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 154.036536][ T7652] netlink: 'syz.0.540': attribute type 4 has an invalid length. [ 154.046819][ T5830] asix 2-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffc3 [ 154.109881][ T5830] asix 2-1:0.188: probe with driver asix failed with error -61 [ 154.335930][ T5947] usb 4-1: USB disconnect, device number 9 [ 155.383120][ T5888] usb 2-1: USB disconnect, device number 9 [ 155.941223][ T803] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 156.099259][ T7695] overlayfs: failed to clone upperpath [ 156.122251][ T803] usb 3-1: Using ep0 maxpacket: 8 [ 156.142402][ T803] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 156.166888][ T803] usb 3-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 156.221470][ T803] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 156.257394][ T803] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.480587][ T803] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 156.601891][ T5845] Bluetooth: hci4: command 0x0405 tx timeout [ 156.643534][ T803] usb 4-1: config index 0 descriptor too short (expected 65183, got 72) [ 156.658574][ T803] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 156.671324][ T803] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.682810][ T803] usb 4-1: Product: syz [ 156.688451][ T803] usb 4-1: Manufacturer: syz [ 156.695357][ T803] usb 4-1: SerialNumber: syz [ 156.708003][ T803] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 156.731463][ T24] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 156.910208][ T5845] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 156.920572][ T5845] CPU: 1 UID: 0 PID: 5845 Comm: kworker/u9:8 Not tainted syzkaller #0 PREEMPT(full) [ 156.920601][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 156.920615][ T5845] Workqueue: hci0 hci_rx_work [ 156.920663][ T5845] Call Trace: [ 156.920675][ T5845] [ 156.920684][ T5845] dump_stack_lvl+0xe8/0x150 [ 156.920720][ T5845] sysfs_create_dir_ns+0x271/0x2a0 [ 156.920749][ T5845] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 156.920778][ T5845] ? do_raw_spin_unlock+0xf5/0x210 [ 156.920808][ T5845] kobject_add_internal+0x62b/0xd00 [ 156.920838][ T5845] kobject_add+0x163/0x240 [ 156.920863][ T5845] ? __pfx_kobject_add+0x10/0x10 [ 156.920885][ T5845] ? _raw_spin_unlock+0x28/0x50 [ 156.920918][ T5845] ? get_device_parent+0x366/0x3a0 [ 156.920955][ T5845] device_add+0x408/0xb70 [ 156.920989][ T5845] hci_conn_add_sysfs+0xd5/0x210 [ 156.921020][ T5845] le_conn_complete_evt+0xf1d/0x1430 [ 156.921055][ T5845] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 156.921076][ T5845] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 156.921112][ T5845] ? __pfx___mutex_lock+0x10/0x10 [ 156.921141][ T5845] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 156.921173][ T5845] ? skb_pull_data+0xfb/0x200 [ 156.921201][ T5845] hci_le_enh_conn_complete_evt+0x189/0x490 [ 156.921226][ T5845] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 156.921255][ T5845] hci_event_packet+0x7af/0x12c0 [ 156.921292][ T5845] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 156.921314][ T5845] ? __pfx_hci_event_packet+0x10/0x10 [ 156.921349][ T5845] ? kcov_remote_start+0x49a/0x7a0 [ 156.921375][ T5845] ? hci_send_to_monitor+0xe2/0x590 [ 156.921403][ T5845] hci_rx_work+0x3ee/0x1040 [ 156.921445][ T5845] ? process_one_work+0x870/0x1720 [ 156.921474][ T5845] process_one_work+0x963/0x1720 [ 156.921528][ T5845] ? __pfx_process_one_work+0x10/0x10 [ 156.921555][ T5845] ? do_raw_spin_lock+0x12b/0x2f0 [ 156.921599][ T5845] worker_thread+0xb46/0x1140 [ 156.921638][ T5845] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 156.921683][ T5845] kthread+0x388/0x470 [ 156.921708][ T5845] ? __pfx_worker_thread+0x10/0x10 [ 156.921737][ T5845] ? __pfx_kthread+0x10/0x10 [ 156.921762][ T5845] ret_from_fork+0x51e/0xb90 [ 156.921794][ T5845] ? __pfx_ret_from_fork+0x10/0x10 [ 156.921826][ T5845] ? __switch_to+0xc7d/0x1450 [ 156.921857][ T5845] ? __pfx_kthread+0x10/0x10 [ 156.921883][ T5845] ret_from_fork_asm+0x1a/0x30 [ 156.921922][ T5845] [ 156.922328][ T5845] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 157.178178][ T5845] Bluetooth: hci0: failed to register connection device [ 157.245346][ T7698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.286064][ T7698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.337463][ T7698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.369691][ T7698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.422656][ T7698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.462512][ T7698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.496702][ T5888] usb 4-1: USB disconnect, device number 10 [ 157.801327][ T24] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 157.813234][ T24] ath9k_htc: Failed to initialize the device [ 157.827868][ T5888] usb 4-1: ath9k_htc: USB layer deinitialized [ 158.140602][ T5888] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 158.300708][ T5888] usb 4-1: Using ep0 maxpacket: 32 [ 158.313321][ T5888] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 158.336586][ T5888] usb 4-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice=d2.a2 [ 158.346996][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.361050][ T5888] usb 4-1: Product: syz [ 158.370789][ T5888] usb 4-1: Manufacturer: syz [ 158.378868][ T5888] usb 4-1: SerialNumber: syz [ 158.394654][ T5888] usb 4-1: config 0 descriptor?? [ 158.410463][ T5888] mos7840 4-1:0.0: required endpoints missing [ 158.735113][ T24] usb 3-1: USB disconnect, device number 9 [ 159.150625][ T24] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 159.340707][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 159.351961][ T24] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 159.376756][ T24] usb 3-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 159.393155][ T24] usb 3-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 159.404492][ T24] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 159.426176][ T24] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 159.436362][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.445442][ T24] usb 3-1: Product: syz [ 159.449739][ T24] usb 3-1: Manufacturer: syz [ 159.454547][ T24] usb 3-1: SerialNumber: syz [ 159.477078][ C1] imon 3-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 159.501005][ T24] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:155.0/input/input11 [ 159.664057][ T10] usb 4-1: USB disconnect, device number 11 [ 159.720614][ T24] imon 3-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 159.755632][ T24] (id 0x00) [ 159.890655][ T24] rc_core: IR keymap rc-imon-pad not found [ 159.898630][ T24] Registered IR keymap rc-empty [ 159.911720][ T24] imon 3-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 159.913889][ T7746] fuse: Unknown parameter 'fd0x0000000000000003' [ 159.930608][ T24] imon 3-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 159.983904][ T24] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:155.0/rc/rc0 [ 160.031926][ T24] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:155.0/rc/rc0/input12 [ 160.064701][ T24] imon 3-1:155.0: iMON device (15c2:ffdc, intf0) on usb<3:10> initialized [ 160.189529][ T7751] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 160.190436][ T24] usb 3-1: USB disconnect, device number 10 [ 161.098436][ T7778] fuse: Unknown parameter 'fd0xffffffffffffffff' [ 162.239700][ T7789] fuse: Bad value for 'group_id' [ 162.253096][ T7789] fuse: Bad value for 'group_id' [ 162.268530][ T5845] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 162.281700][ T5845] CPU: 1 UID: 0 PID: 5845 Comm: kworker/u9:8 Not tainted syzkaller #0 PREEMPT(full) [ 162.281734][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 162.281750][ T5845] Workqueue: hci1 hci_rx_work [ 162.281788][ T5845] Call Trace: [ 162.281798][ T5845] [ 162.281808][ T5845] dump_stack_lvl+0xe8/0x150 [ 162.281843][ T5845] sysfs_create_dir_ns+0x271/0x2a0 [ 162.281875][ T5845] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 162.281904][ T5845] ? do_raw_spin_unlock+0xf5/0x210 [ 162.281936][ T5845] kobject_add_internal+0x62b/0xd00 [ 162.281970][ T5845] kobject_add+0x163/0x240 [ 162.281997][ T5845] ? __pfx_kobject_add+0x10/0x10 [ 162.282020][ T5845] ? _raw_spin_unlock+0x28/0x50 [ 162.282052][ T5845] ? get_device_parent+0x366/0x3a0 [ 162.282088][ T5845] device_add+0x408/0xb70 [ 162.282125][ T5845] hci_conn_add_sysfs+0xd5/0x210 [ 162.282158][ T5845] le_conn_complete_evt+0xf1d/0x1430 [ 162.282193][ T5845] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 162.282213][ T5845] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 162.282248][ T5845] ? __pfx___mutex_lock+0x10/0x10 [ 162.282269][ T5845] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 162.282299][ T5845] ? skb_pull_data+0xfb/0x200 [ 162.282328][ T5845] hci_le_conn_complete_evt+0x187/0x470 [ 162.282360][ T5845] hci_event_packet+0x7af/0x12c0 [ 162.282396][ T5845] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 162.282419][ T5845] ? __pfx_hci_event_packet+0x10/0x10 [ 162.282464][ T5845] ? kcov_remote_start+0x49a/0x7a0 [ 162.282492][ T5845] ? hci_send_to_monitor+0xe2/0x590 [ 162.282525][ T5845] hci_rx_work+0x3ee/0x1040 [ 162.282572][ T5845] ? process_one_work+0x870/0x1720 [ 162.282601][ T5845] process_one_work+0x963/0x1720 [ 162.282661][ T5845] ? __pfx_process_one_work+0x10/0x10 [ 162.282688][ T5845] ? do_raw_spin_lock+0x12b/0x2f0 [ 162.282736][ T5845] worker_thread+0xb46/0x1140 [ 162.282778][ T5845] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 162.282822][ T5845] kthread+0x388/0x470 [ 162.282847][ T5845] ? __pfx_worker_thread+0x10/0x10 [ 162.282876][ T5845] ? __pfx_kthread+0x10/0x10 [ 162.282901][ T5845] ret_from_fork+0x51e/0xb90 [ 162.282934][ T5845] ? __pfx_ret_from_fork+0x10/0x10 [ 162.282962][ T5845] ? __switch_to+0xc7d/0x1450 [ 162.282993][ T5845] ? __pfx_kthread+0x10/0x10 [ 162.283017][ T5845] ret_from_fork_asm+0x1a/0x30 [ 162.283056][ T5845] [ 162.283643][ T5845] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 162.533399][ T5845] Bluetooth: hci1: failed to register connection device [ 162.848191][ T7787] Zero length message leads to an empty skb [ 163.211130][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 163.211149][ T30] audit: type=1326 audit(1772652394.227:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7a8f9c799 code=0x7ffc0000 [ 163.286983][ T30] audit: type=1326 audit(1772652394.257:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 163.350597][ T30] audit: type=1326 audit(1772652394.257:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 163.394512][ T30] audit: type=1326 audit(1772652394.257:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 163.434996][ T30] audit: type=1326 audit(1772652394.257:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 163.457602][ T30] audit: type=1326 audit(1772652394.257:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 163.495451][ T30] audit: type=1326 audit(1772652394.257:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 163.562550][ T30] audit: type=1326 audit(1772652394.257:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 163.639598][ T30] audit: type=1326 audit(1772652394.257:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 163.719425][ T30] audit: type=1326 audit(1772652394.257:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7806 comm="syz.2.597" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 164.040865][ T7839] overlayfs: failed to resolve './file1': -2 [ 164.288426][ T7849] netlink: 4 bytes leftover after parsing attributes in process `syz.4.611'. [ 164.592567][ T7849] bridge_slave_1: left allmulticast mode [ 164.610770][ T7849] bridge_slave_1: left promiscuous mode [ 164.630455][ T7849] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.755222][ T7849] bridge_slave_0: left allmulticast mode [ 164.768847][ T7849] bridge_slave_0: left promiscuous mode [ 164.785133][ T7849] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.055081][ T7880] overlayfs: failed to resolve './file1': -2 [ 165.162191][ T10] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 165.352063][ T10] usb 2-1: config index 0 descriptor too short (expected 65183, got 72) [ 165.375211][ T10] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 165.389856][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.398285][ T10] usb 2-1: Product: syz [ 165.408114][ T10] usb 2-1: Manufacturer: syz [ 165.414155][ T10] usb 2-1: SerialNumber: syz [ 165.449618][ T10] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 165.488705][ T5895] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 165.816043][ T7877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.836889][ T7877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.866936][ T7877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.897455][ T7877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.943811][ T7877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.969042][ T7877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.003572][ T10] usb 2-1: USB disconnect, device number 10 [ 166.602193][ T5895] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 166.623551][ T5895] ath9k_htc: Failed to initialize the device [ 166.640838][ T10] usb 2-1: ath9k_htc: USB layer deinitialized [ 166.656793][ T7900] syzkaller0: entered promiscuous mode [ 166.674389][ T7900] syzkaller0: entered allmulticast mode [ 166.942552][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 166.953033][ T7914] overlayfs: failed to resolve './file1': -2 [ 167.122567][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 167.150265][ T10] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 167.204378][ T10] usb 2-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice=d2.a2 [ 167.242035][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.262789][ T10] usb 2-1: Product: syz [ 167.272778][ T10] usb 2-1: Manufacturer: syz [ 167.279834][ T10] usb 2-1: SerialNumber: syz [ 167.319905][ T10] usb 2-1: config 0 descriptor?? [ 167.352618][ T10] mos7840 2-1:0.0: required endpoints missing [ 168.658348][ T10] usb 2-1: USB disconnect, device number 11 [ 169.060589][ T10] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 169.220931][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 169.235892][ T10] usb 2-1: config 0 has no interfaces? [ 169.249645][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 169.267288][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.283753][ T10] usb 2-1: Product: syz [ 169.290444][ T10] usb 2-1: Manufacturer: syz [ 169.297985][ T10] usb 2-1: SerialNumber: syz [ 169.310652][ T10] usb 2-1: config 0 descriptor?? [ 169.513470][ T7995] kvm: kvm [7992]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x40000074) = 0x81 [ 169.583205][ T10] usb 2-1: USB disconnect, device number 12 [ 171.394803][ T5845] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 171.406479][ T5845] CPU: 1 UID: 0 PID: 5845 Comm: kworker/u9:8 Not tainted syzkaller #0 PREEMPT(full) [ 171.406509][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 171.406523][ T5845] Workqueue: hci4 hci_rx_work [ 171.406558][ T5845] Call Trace: [ 171.406567][ T5845] [ 171.406575][ T5845] dump_stack_lvl+0xe8/0x150 [ 171.406610][ T5845] sysfs_create_dir_ns+0x271/0x2a0 [ 171.406640][ T5845] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 171.406667][ T5845] ? do_raw_spin_unlock+0xf5/0x210 [ 171.406697][ T5845] kobject_add_internal+0x62b/0xd00 [ 171.406728][ T5845] kobject_add+0x163/0x240 [ 171.406769][ T5845] ? __pfx_kobject_add+0x10/0x10 [ 171.406792][ T5845] ? _raw_spin_unlock+0x28/0x50 [ 171.406823][ T5845] ? get_device_parent+0x366/0x3a0 [ 171.406858][ T5845] device_add+0x408/0xb70 [ 171.406893][ T5845] hci_conn_add_sysfs+0xd5/0x210 [ 171.406924][ T5845] le_conn_complete_evt+0xf1d/0x1430 [ 171.406956][ T5845] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 171.406977][ T5845] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 171.407012][ T5845] ? __pfx___mutex_lock+0x10/0x10 [ 171.407031][ T5845] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 171.407060][ T5845] ? skb_pull_data+0xfb/0x200 [ 171.407088][ T5845] hci_le_conn_complete_evt+0x187/0x470 [ 171.407117][ T5845] hci_event_packet+0x7af/0x12c0 [ 171.407151][ T5845] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 171.407173][ T5845] ? __pfx_hci_event_packet+0x10/0x10 [ 171.407224][ T5845] ? kcov_remote_start+0x49a/0x7a0 [ 171.407251][ T5845] ? hci_send_to_monitor+0xe2/0x590 [ 171.407279][ T5845] hci_rx_work+0x3ee/0x1040 [ 171.407320][ T5845] ? process_one_work+0x870/0x1720 [ 171.407348][ T5845] process_one_work+0x963/0x1720 [ 171.407400][ T5845] ? __pfx_process_one_work+0x10/0x10 [ 171.407428][ T5845] ? do_raw_spin_lock+0x12b/0x2f0 [ 171.407470][ T5845] worker_thread+0xb46/0x1140 [ 171.407511][ T5845] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 171.407554][ T5845] kthread+0x388/0x470 [ 171.407577][ T5845] ? __pfx_worker_thread+0x10/0x10 [ 171.407606][ T5845] ? __pfx_kthread+0x10/0x10 [ 171.407631][ T5845] ret_from_fork+0x51e/0xb90 [ 171.407664][ T5845] ? __pfx_ret_from_fork+0x10/0x10 [ 171.407691][ T5845] ? __switch_to+0xc7d/0x1450 [ 171.407719][ T5845] ? __pfx_kthread+0x10/0x10 [ 171.407749][ T5845] ret_from_fork_asm+0x1a/0x30 [ 171.407787][ T5845] [ 171.407899][ T5845] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 171.660192][ T5845] Bluetooth: hci4: failed to register connection device [ 171.783685][ T8083] fuse: Unknown parameter 'grou00000000000000000000' [ 172.082098][ T8091] binder: 8090:8091 ioctl c0306201 2000000003c0 returned -14 [ 172.394774][ T5845] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 172.408743][ T5845] CPU: 1 UID: 0 PID: 5845 Comm: kworker/u9:8 Not tainted syzkaller #0 PREEMPT(full) [ 172.408777][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 172.408792][ T5845] Workqueue: hci0 hci_rx_work [ 172.408829][ T5845] Call Trace: [ 172.408839][ T5845] [ 172.408848][ T5845] dump_stack_lvl+0xe8/0x150 [ 172.408885][ T5845] sysfs_create_dir_ns+0x271/0x2a0 [ 172.408916][ T5845] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 172.408944][ T5845] ? do_raw_spin_unlock+0xf5/0x210 [ 172.408975][ T5845] kobject_add_internal+0x62b/0xd00 [ 172.409008][ T5845] kobject_add+0x163/0x240 [ 172.409035][ T5845] ? __pfx_kobject_add+0x10/0x10 [ 172.409058][ T5845] ? _raw_spin_unlock+0x28/0x50 [ 172.409090][ T5845] ? get_device_parent+0x366/0x3a0 [ 172.409127][ T5845] device_add+0x408/0xb70 [ 172.409163][ T5845] hci_conn_add_sysfs+0xd5/0x210 [ 172.409195][ T5845] le_conn_complete_evt+0xf1d/0x1430 [ 172.409229][ T5845] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 172.409250][ T5845] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 172.409286][ T5845] ? __pfx___mutex_lock+0x10/0x10 [ 172.409305][ T5845] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 172.409336][ T5845] ? skb_pull_data+0xfb/0x200 [ 172.409364][ T5845] hci_le_conn_complete_evt+0x187/0x470 [ 172.409395][ T5845] hci_event_packet+0x7af/0x12c0 [ 172.409431][ T5845] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 172.409453][ T5845] ? __pfx_hci_event_packet+0x10/0x10 [ 172.409489][ T5845] ? kcov_remote_start+0x49a/0x7a0 [ 172.409516][ T5845] ? hci_send_to_monitor+0xe2/0x590 [ 172.409544][ T5845] hci_rx_work+0x3ee/0x1040 [ 172.409585][ T5845] ? process_one_work+0x870/0x1720 [ 172.409614][ T5845] process_one_work+0x963/0x1720 [ 172.409677][ T5845] ? __pfx_process_one_work+0x10/0x10 [ 172.409717][ T5845] ? do_raw_spin_lock+0x12b/0x2f0 [ 172.409759][ T5845] worker_thread+0xb46/0x1140 [ 172.409798][ T5845] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 172.409839][ T5845] kthread+0x388/0x470 [ 172.409862][ T5845] ? __pfx_worker_thread+0x10/0x10 [ 172.409890][ T5845] ? __pfx_kthread+0x10/0x10 [ 172.409915][ T5845] ret_from_fork+0x51e/0xb90 [ 172.409947][ T5845] ? __pfx_ret_from_fork+0x10/0x10 [ 172.409975][ T5845] ? __switch_to+0xc7d/0x1450 [ 172.410004][ T5845] ? __pfx_kthread+0x10/0x10 [ 172.410028][ T5845] ret_from_fork_asm+0x1a/0x30 [ 172.410066][ T5845] [ 172.410096][ T5845] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 172.658767][ T5845] Bluetooth: hci0: failed to register connection device [ 172.769537][ T8109] fuse: Unknown parameter 'group_i00000000000000000000' [ 172.962104][ T8119] fuse: Unknown parameter '00000000000000000000003' [ 173.065814][ T8124] overlayfs: missing 'lowerdir' [ 173.934712][ T8159] fuse: Bad value for 'fd' [ 174.029161][ T8162] overlayfs: missing 'lowerdir' [ 174.632980][ T5845] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 174.645761][ T5845] CPU: 1 UID: 0 PID: 5845 Comm: kworker/u9:8 Not tainted syzkaller #0 PREEMPT(full) [ 174.645793][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 174.645808][ T5845] Workqueue: hci2 hci_rx_work [ 174.645844][ T5845] Call Trace: [ 174.645853][ T5845] [ 174.645862][ T5845] dump_stack_lvl+0xe8/0x150 [ 174.645897][ T5845] sysfs_create_dir_ns+0x271/0x2a0 [ 174.645928][ T5845] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 174.645957][ T5845] ? do_raw_spin_unlock+0xf5/0x210 [ 174.645988][ T5845] kobject_add_internal+0x62b/0xd00 [ 174.646021][ T5845] kobject_add+0x163/0x240 [ 174.646048][ T5845] ? __pfx_kobject_add+0x10/0x10 [ 174.646076][ T5845] ? _raw_spin_unlock+0x28/0x50 [ 174.646108][ T5845] ? get_device_parent+0x366/0x3a0 [ 174.646146][ T5845] device_add+0x408/0xb70 [ 174.646183][ T5845] hci_conn_add_sysfs+0xd5/0x210 [ 174.646215][ T5845] le_conn_complete_evt+0xf1d/0x1430 [ 174.646249][ T5845] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 174.646271][ T5845] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 174.646307][ T5845] ? __pfx___mutex_lock+0x10/0x10 [ 174.646327][ T5845] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 174.646358][ T5845] ? skb_pull_data+0xfb/0x200 [ 174.646386][ T5845] hci_le_conn_complete_evt+0x187/0x470 [ 174.646417][ T5845] hci_event_packet+0x7af/0x12c0 [ 174.646460][ T5845] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 174.646483][ T5845] ? __pfx_hci_event_packet+0x10/0x10 [ 174.646519][ T5845] ? kcov_remote_start+0x49a/0x7a0 [ 174.646547][ T5845] ? hci_send_to_monitor+0xe2/0x590 [ 174.646575][ T5845] hci_rx_work+0x3ee/0x1040 [ 174.646616][ T5845] ? process_one_work+0x870/0x1720 [ 174.646645][ T5845] process_one_work+0x963/0x1720 [ 174.646699][ T5845] ? __pfx_process_one_work+0x10/0x10 [ 174.646726][ T5845] ? do_raw_spin_lock+0x12b/0x2f0 [ 174.646778][ T5845] worker_thread+0xb46/0x1140 [ 174.646820][ T5845] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 174.646865][ T5845] kthread+0x388/0x470 [ 174.646890][ T5845] ? __pfx_worker_thread+0x10/0x10 [ 174.646919][ T5845] ? __pfx_kthread+0x10/0x10 [ 174.646945][ T5845] ret_from_fork+0x51e/0xb90 [ 174.646978][ T5845] ? __pfx_ret_from_fork+0x10/0x10 [ 174.647006][ T5845] ? __switch_to+0xc7d/0x1450 [ 174.647037][ T5845] ? __pfx_kthread+0x10/0x10 [ 174.647062][ T5845] ret_from_fork_asm+0x1a/0x30 [ 174.647101][ T5845] [ 174.647156][ T5845] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 174.898990][ T5845] Bluetooth: hci2: failed to register connection device [ 175.086490][ T8187] fuse: Bad value for 'fd' [ 175.298460][ T8196] binder: 8194:8196 ioctl c0306201 2000000003c0 returned -14 [ 175.855256][ T5845] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 176.512914][ T5845] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 177.966510][ T8312] netlink: 4 bytes leftover after parsing attributes in process `syz.4.775'. [ 178.157995][ C0] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 178.421647][ T5895] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 178.580586][ T5895] usb 3-1: Using ep0 maxpacket: 32 [ 178.598848][ T5895] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 178.619358][ T5895] usb 3-1: config 0 has no interface number 0 [ 178.639081][ T5895] usb 3-1: config 0 interface 184 has no altsetting 0 [ 178.656894][ T5895] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 178.674272][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.695984][ T5895] usb 3-1: Product: syz [ 178.704764][ T5895] usb 3-1: Manufacturer: syz [ 178.712192][ T5895] usb 3-1: SerialNumber: syz [ 178.727586][ T5895] usb 3-1: config 0 descriptor?? [ 179.073463][ T8343] netlink: 4 bytes leftover after parsing attributes in process `syz.4.788'. [ 179.244246][ T8347] overlayfs: missing 'lowerdir' [ 179.373292][ T5895] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 179.405668][ T5895] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 179.635424][ T5895] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 179.657314][ T5895] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 179.679003][ T5895] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 179.703916][ T5895] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -61 [ 179.827416][ T5845] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 179.894368][ T8375] overlayfs: missing 'lowerdir' [ 180.474817][ T8390] syzkaller0: entered promiscuous mode [ 180.486995][ T8390] syzkaller0: entered allmulticast mode [ 180.584299][ T5845] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 181.186361][ T5845] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 181.202950][ T5922] usb 3-1: USB disconnect, device number 11 [ 181.325099][ T8432] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 181.331870][ T8432] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 181.352555][ T8432] vhci_hcd vhci_hcd.0: Device attached [ 181.371082][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 181.582115][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 181.621352][ T10] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 181.720621][ T5922] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 181.883396][ T5922] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 181.907593][ T5922] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 181.939385][ T5922] usb 3-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 181.973108][ T5922] usb 3-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 181.995687][ T5922] usb 3-1: Manufacturer: syz [ 182.037066][ T5922] usb 3-1: config 0 descriptor?? [ 182.094442][ T5845] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 182.263969][ T8437] vhci_hcd: connection closed [ 182.266135][ T5922] usb 3-1: USB disconnect, device number 12 [ 182.289689][ T3534] vhci_hcd vhci_hcd.2: stop threads [ 182.312659][ T3534] vhci_hcd vhci_hcd.2: release socket [ 182.334785][ T3534] vhci_hcd vhci_hcd.2: disconnect device [ 183.064695][ T8509] overlayfs: failed to clone upperpath [ 183.153640][ T8511] netlink: 'syz.2.853': attribute type 6 has an invalid length. [ 183.168663][ T8511] netlink: 3936 bytes leftover after parsing attributes in process `syz.2.853'. [ 183.182573][ T8511] netlink: 'syz.2.853': attribute type 1 has an invalid length. [ 183.271599][ T8511] nbd0: detected capacity change from 0 to 339754496 [ 183.290221][ T5845] block nbd0: Receive control failed (result -104) [ 183.430768][ T8523] fuse: Bad value for 'fd' [ 183.752006][ T8539] binder: 8533:8539 unknown command 0 [ 183.779608][ T8539] binder: 8533:8539 ioctl c0306201 200000000640 returned -22 [ 184.110725][ T8556] fuse: Bad value for 'fd' [ 184.247489][ T8563] fuse: Bad value for 'fd' [ 184.366511][ T8567] overlayfs: failed to clone upperpath [ 184.753752][ T8583] fuse: Bad value for 'fd' [ 184.947967][ T8592] fuse: Bad value for 'fd' [ 185.061427][ T8595] kvm: pic: non byte write [ 185.385573][ T5947] IPVS: starting estimator thread 0... [ 185.502241][ T8608] IPVS: using max 25 ests per chain, 60000 per kthread [ 185.782778][ T8623] syzkaller0: entered promiscuous mode [ 185.796650][ T8623] syzkaller0: entered allmulticast mode [ 185.845616][ T30] kauditd_printk_skb: 84 callbacks suppressed [ 185.845636][ T30] audit: type=1326 audit(2000000008.480:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 185.929906][ T30] audit: type=1326 audit(2000000008.520:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 185.964605][ T30] audit: type=1326 audit(2000000008.520:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 186.014738][ T30] audit: type=1326 audit(2000000008.520:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 186.040134][ T30] audit: type=1326 audit(2000000008.520:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 186.063735][ T30] audit: type=1326 audit(2000000008.520:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 186.112281][ T30] audit: type=1326 audit(2000000008.520:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 186.159510][ T30] audit: type=1326 audit(2000000008.520:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 186.220378][ T30] audit: type=1326 audit(2000000008.520:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 186.271838][ T30] audit: type=1326 audit(2000000008.520:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8625 comm="syz.3.899" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c42b code=0x7ffc0000 [ 187.603131][ T8684] overlayfs: missing 'lowerdir' [ 187.613445][ T5895] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 187.740198][ T8691] overlayfs: failed to clone upperpath [ 187.791189][ T5895] usb 3-1: Using ep0 maxpacket: 32 [ 187.808774][ T5895] usb 3-1: config 0 has no interfaces? [ 187.820937][ T5895] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 187.837338][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.855205][ T5895] usb 3-1: Product: syz [ 187.865481][ T5895] usb 3-1: Manufacturer: syz [ 187.878437][ T5895] usb 3-1: SerialNumber: syz [ 187.899623][ T5895] usb 3-1: config 0 descriptor?? [ 187.940849][ T24] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 188.112659][ T24] usb 4-1: config index 0 descriptor too short (expected 65183, got 72) [ 188.115032][ T8704] syzkaller0: entered promiscuous mode [ 188.128304][ T24] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 188.144328][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.153537][ T803] usb 3-1: USB disconnect, device number 13 [ 188.164045][ T8704] syzkaller0: entered allmulticast mode [ 188.172233][ T24] usb 4-1: Product: syz [ 188.181194][ T24] usb 4-1: Manufacturer: syz [ 188.185919][ T24] usb 4-1: SerialNumber: syz [ 188.220895][ T24] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 188.246377][ T5830] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 188.315397][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 188.482232][ T8689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.503288][ T8689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.518858][ T8689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.528513][ T8689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.550119][ T8689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.573777][ T8689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.621853][ T803] usb 4-1: USB disconnect, device number 12 [ 188.779454][ T8724] binder_alloc: 8723: binder_alloc_buf, no vma [ 189.320701][ T5830] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 189.328099][ T5830] ath9k_htc: Failed to initialize the device [ 189.335476][ T803] usb 4-1: ath9k_htc: USB layer deinitialized [ 189.342431][ T24] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 189.500584][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 189.507876][ T24] usb 3-1: config 0 has no interfaces? [ 189.516334][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 189.526570][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.535183][ T24] usb 3-1: Product: syz [ 189.539533][ T24] usb 3-1: Manufacturer: syz [ 189.547602][ T24] usb 3-1: SerialNumber: syz [ 189.556287][ T24] usb 3-1: config 0 descriptor?? [ 189.651012][ T803] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 189.696051][ T5845] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 189.769833][ T5947] usb 3-1: USB disconnect, device number 14 [ 189.811344][ T803] usb 4-1: Using ep0 maxpacket: 32 [ 189.825985][ T803] usb 4-1: config index 0 descriptor too short (expected 241, got 72) [ 189.834965][ T803] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 189.847503][ T803] usb 4-1: config 0 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 1 [ 189.861140][ T803] usb 4-1: New USB device found, idVendor=110a, idProduct=2210, bcdDevice=bd.da [ 189.882342][ T803] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.903479][ T803] usb 4-1: config 0 descriptor?? [ 189.940967][ T803] mos7840 4-1:0.0: required endpoints missing [ 190.843284][ T8794] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 190.881009][ T8794] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 190.916639][ T5845] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 191.113190][ T8806] overlayfs: failed to resolve './file2': -2 [ 191.197076][ T5895] usb 4-1: USB disconnect, device number 13 [ 191.502586][ T5947] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 191.681272][ T5947] usb 2-1: Using ep0 maxpacket: 32 [ 191.712542][ T5947] usb 2-1: config 0 has no interfaces? [ 191.753026][ T5947] usb 2-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 191.770608][ T5947] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.816284][ T5947] usb 2-1: Product: syz [ 191.848877][ T5947] usb 2-1: Manufacturer: syz [ 191.865398][ T5947] usb 2-1: SerialNumber: syz [ 191.886165][ T5947] usb 2-1: config 0 descriptor?? [ 192.110654][ T5895] usb 2-1: USB disconnect, device number 13 [ 192.160345][ T5845] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 192.363806][ T8843] overlayfs: failed to resolve './file2': -2 [ 192.545841][ T8848] fuse: Unknown parameter '00000000000000000000' [ 193.040053][ T8866] syzkaller0: entered promiscuous mode [ 193.046377][ T8866] syzkaller0: entered allmulticast mode [ 193.408047][ T8879] fuse: Unknown parameter '00000000000000000000' [ 194.241318][ T8915] fuse: Unknown parameter '00000000000000000000' [ 194.367816][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.378232][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.850735][ T5895] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 194.994191][ T8952] binder: BINDER_SET_CONTEXT_MGR already set [ 195.003690][ T8952] binder: 8951:8952 ioctl 4018620d 200000004a80 returned -16 [ 195.030683][ T5895] usb 3-1: Using ep0 maxpacket: 16 [ 195.061657][ T5895] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 195.088272][ T5895] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 195.107849][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.138597][ T5895] usb 3-1: Product: syz [ 195.144660][ T5895] usb 3-1: Manufacturer: syz [ 195.159240][ T5895] usb 3-1: SerialNumber: syz [ 195.182343][ T5895] usb 3-1: config 0 descriptor?? [ 195.420653][ T8966] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 195.520417][ T8966] syzkaller0: entered promiscuous mode [ 195.526516][ T8966] syzkaller0: entered allmulticast mode [ 195.844686][ T8985] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1037'. [ 196.614102][ T9025] overlayfs: failed to clone upperpath [ 196.851335][ T9038] overlayfs: failed to clone upperpath [ 197.714924][ T9073] 9p: Could not find request transport: f [ 197.724192][ T24] usb 3-1: USB disconnect, device number 15 [ 199.597831][ T9151] syzkaller0: entered promiscuous mode [ 199.617119][ T9151] syzkaller0: entered allmulticast mode [ 200.358706][ T9182] kvm: pic: non byte write [ 200.479314][ T9186] syzkaller0: entered promiscuous mode [ 200.486501][ T9186] syzkaller0: entered allmulticast mode [ 200.606230][ T9188] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1114'. [ 201.132001][ T9209] fuse: Unknown parameter 'user_i00000000000000000000' [ 201.374624][ T9217] syzkaller0: entered promiscuous mode [ 201.380194][ T9217] syzkaller0: entered allmulticast mode [ 201.570401][ T5831] Bluetooth: hci0: command 0x0406 tx timeout [ 201.577131][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 201.583719][ T5841] Bluetooth: hci1: command 0x0406 tx timeout [ 201.584552][ T5837] Bluetooth: hci3: command 0x0406 tx timeout [ 201.780776][ T9235] overlayfs: failed to clone upperpath [ 202.378069][ T9258] overlayfs: failed to clone upperpath [ 202.717284][ T9277] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 202.970011][ T9294] overlayfs: failed to clone upperpath [ 203.449820][ T9317] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 203.613626][ T9325] overlayfs: failed to clone upperpath [ 203.789096][ T9330] fuse: Unknown parameter 'user_id00000000000000000000' [ 204.000862][ T9340] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1172'. [ 204.085055][ C1] workqueue function usb_giveback_urb_bh changed kcov_mode from 1073741824 to 0 [ 204.099897][ T9343] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 204.296511][ T9350] 9p: Bad value for 'trans' [ 204.315016][ T30] kauditd_printk_skb: 95 callbacks suppressed [ 204.315037][ T30] audit: type=1326 audit(2000000026.950:509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9346 comm="syz.3.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 204.390316][ T30] audit: type=1326 audit(2000000026.990:510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9346 comm="syz.3.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 204.415638][ T30] audit: type=1326 audit(2000000026.990:511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9346 comm="syz.3.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 204.499507][ T30] audit: type=1326 audit(2000000026.990:512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9346 comm="syz.3.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 204.610730][ T5845] Bluetooth: hci4: command 0x0405 tx timeout [ 204.620738][ T30] audit: type=1326 audit(2000000026.990:513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9346 comm="syz.3.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 204.645207][ T30] audit: type=1326 audit(2000000026.990:514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9346 comm="syz.3.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 204.668005][ T30] audit: type=1326 audit(2000000027.000:515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9346 comm="syz.3.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 204.691645][ T30] audit: type=1326 audit(2000000027.000:516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9346 comm="syz.3.1175" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f309f19c799 code=0x7ffc0000 [ 204.762465][ T9364] binder: 9363:9364 ioctl c0306201 2000000003c0 returned -14 [ 205.093469][ T9382] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 205.676048][ T9402] syzkaller0: entered promiscuous mode [ 205.697845][ T9402] syzkaller0: entered allmulticast mode [ 205.717672][ T9406] binder: 9405:9406 ioctl c0306201 2000000003c0 returned -14 [ 205.906303][ T9416] overlayfs: failed to resolve './file2': -2 [ 206.761146][ T5845] Bluetooth: hci4: command 0x0405 tx timeout [ 207.080281][ T9433] netlink: 'syz.0.1206': attribute type 1 has an invalid length. [ 207.757435][ T9434] batadv_slave_0: entered promiscuous mode [ 207.927428][ T9446] binder: 9445:9446 ioctl c0306201 2000000003c0 returned -14 [ 208.054234][ T9451] syzkaller0: entered promiscuous mode [ 208.065962][ T9451] syzkaller0: entered allmulticast mode [ 208.840864][ T5845] Bluetooth: hci4: command 0x0405 tx timeout [ 209.113483][ T9460] overlayfs: failed to resolve './file2': -2 [ 209.286919][ T9468] overlayfs: failed to resolve './file0': -2 [ 209.622461][ T9480] binder: 9479:9480 ioctl c0306201 2000000003c0 returned -14 [ 213.435703][ T9485] overlayfs: failed to resolve './file1': -2 [ 213.568687][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 30 seconds [ 214.583758][ T9541] syzkaller0: entered promiscuous mode [ 214.614811][ T9541] syzkaller0: entered allmulticast mode [ 216.169283][ T30] audit: type=1326 audit(2000000001.460:517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7a8f9c799 code=0x7ffc0000 [ 216.228661][ T30] audit: type=1326 audit(2000000001.460:518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff7a8f9c799 code=0x7ffc0000 [ 216.269995][ T30] audit: type=1326 audit(2000000001.460:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 216.354378][ T30] audit: type=1326 audit(2000000001.460:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 216.358650][ T9565] netlink: 'syz.4.1248': attribute type 1 has an invalid length. [ 216.447748][ T30] audit: type=1326 audit(2000000001.460:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 216.467785][ T9565] batadv_slave_0: entered promiscuous mode [ 216.500901][ T9565] batman_adv: batadv0: Adding interface: macvtap1 [ 216.507523][ T9565] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 216.534291][ T9565] batman_adv: batadv0: Interface activated: macvtap1 [ 216.554820][ T30] audit: type=1326 audit(2000000001.460:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 216.612358][ T30] audit: type=1326 audit(2000000001.460:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 216.640194][ T30] audit: type=1326 audit(2000000001.460:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 216.672126][ T30] audit: type=1326 audit(2000000001.460:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 216.718605][ T30] audit: type=1326 audit(2000000001.460:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9559 comm="syz.2.1234" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff7a8f9c42b code=0x7ffc0000 [ 218.285388][ T9579] loop0: detected capacity change from 0 to 128 [ 218.302378][ T9579] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 218.939914][ T9579] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 219.369122][ T9585] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.423191][ T9585] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.482222][ T9594] binder: 9593:9594 ioctl c0306201 200000000540 returned -22 [ 220.571076][ T9611] netlink: 'syz.3.1264': attribute type 1 has an invalid length. [ 222.370058][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 222.370074][ T30] audit: type=1326 audit(2000000007.660:585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd13419c799 code=0x7ffc0000 [ 222.432086][ T30] audit: type=1326 audit(2000000007.660:586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.468058][ T30] audit: type=1326 audit(2000000007.660:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.516743][ T30] audit: type=1326 audit(2000000007.660:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.571877][ T30] audit: type=1326 audit(2000000007.660:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.629577][ T30] audit: type=1326 audit(2000000007.660:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.670609][ T803] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 222.683424][ T30] audit: type=1326 audit(2000000007.660:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.773767][ T30] audit: type=1326 audit(2000000007.660:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.831484][ T803] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 222.852934][ T30] audit: type=1326 audit(2000000007.700:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.895890][ T803] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 222.914695][ T803] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 222.947698][ T30] audit: type=1326 audit(2000000007.700:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9637 comm="syz.0.1273" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd13419c42b code=0x7ffc0000 [ 222.971341][ T803] usb 4-1: config 0 interface 0 has no altsetting 0 [ 222.991368][ T803] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 223.006239][ T803] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 223.040626][ T803] usb 4-1: config 0 interface 0 has no altsetting 0 [ 223.058508][ T803] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 223.082630][ T803] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 223.122438][ T803] usb 4-1: config 0 interface 0 has no altsetting 0 [ 223.155470][ T803] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 223.197712][ T803] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 223.237865][ T803] usb 4-1: config 0 interface 0 has no altsetting 0 [ 223.261021][ T803] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 223.283961][ T803] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 223.329034][ T803] usb 4-1: config 0 interface 0 has no altsetting 0 [ 223.361583][ T803] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 223.385446][ T803] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 223.434658][ T803] usb 4-1: config 0 interface 0 has no altsetting 0 [ 223.463270][ T803] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 223.500739][ T803] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 223.537028][ T803] usb 4-1: config 0 interface 0 has no altsetting 0 [ 223.557245][ T803] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 223.587228][ T803] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 223.599265][ T9663] binder: 9662:9663 ioctl c0306201 200000000540 returned -22 [ 223.633157][ T803] usb 4-1: config 0 interface 0 has no altsetting 0 [ 223.663516][ T803] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 223.694091][ T803] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 223.714555][ T9665] netlink: 'syz.4.1281': attribute type 1 has an invalid length. [ 223.756457][ T803] usb 4-1: Product: syz [ 223.773791][ T803] usb 4-1: Manufacturer: syz [ 223.791495][ T803] usb 4-1: SerialNumber: syz [ 223.815788][ T9667] binder: 9666:9667 ioctl c0306201 2000000003c0 returned -14 [ 223.836945][ T803] usb 4-1: config 0 descriptor?? [ 224.006725][ T803] yurex 4-1:0.0: USB YUREX device now attached to Yurex #0 [ 224.340801][ T9676] netlink: 'syz.1.1287': attribute type 1 has an invalid length. [ 224.722396][ T9678] batadv_slave_0: entered promiscuous mode [ 224.756699][ T9678] batman_adv: batadv0: Adding interface: macvtap1 [ 224.763892][ T9678] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 224.789954][ T9678] batman_adv: batadv0: Interface activated: macvtap1 [ 225.427932][ C1] usb 4-1: yurex_control_callback - control failed: -2 [ 225.503562][ T803] usb 4-1: USB disconnect, device number 14 [ 225.525292][ T803] yurex 4-1:0.0: USB YUREX #0 now disconnected [ 225.639997][ T9688] loop0: detected capacity change from 0 to 128 [ 225.703534][ T9688] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 225.924975][ T9688] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 225.947361][ T9699] fuse: Unknown parameter 'fd0x0000000000000003' [ 230.291941][ T9725] overlayfs: missing 'lowerdir' [ 230.549646][ T9728] fuse: Unknown parameter 'fd0x0000000000000003' [ 230.622513][ T24] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 230.833198][ T24] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 230.871568][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 230.903211][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 230.943567][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 230.978367][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 231.009697][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 231.046207][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 231.076793][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 231.108783][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 231.140017][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 231.170889][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 231.200678][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 231.238617][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 231.266132][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 231.299471][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 231.338927][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 231.372805][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 231.408433][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 231.454907][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 231.480780][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 231.512483][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 231.552504][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 231.582065][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 231.614864][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 231.655943][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 231.691474][ T24] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 231.720561][ T24] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 231.750297][ T24] usb 3-1: Product: syz [ 231.765864][ T24] usb 3-1: Manufacturer: syz [ 231.786867][ T24] usb 3-1: SerialNumber: syz [ 231.822117][ T24] usb 3-1: config 0 descriptor?? [ 231.877452][ T24] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 233.278212][ C1] usb 3-1: yurex_control_callback - control failed: -2 [ 233.450826][ T10] usb 3-1: USB disconnect, device number 16 [ 233.495032][ T10] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 233.758709][ T9754] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1315'. [ 233.818324][ T9754] bridge_slave_1: left allmulticast mode [ 233.847132][ T9754] bridge_slave_1: left promiscuous mode [ 235.531237][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 235.531260][ T30] audit: type=1800 audit(2000000011.120:618): pid=9758 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1316" name="bus" dev="overlay" ino=1310 res=0 errno=0 [ 235.573882][ T9754] bridge0: port 2(bridge_slave_1) entered disabled state [ 235.716580][ T9754] bridge_slave_0: left allmulticast mode [ 235.747594][ T9754] bridge_slave_0: left promiscuous mode [ 235.801656][ T9754] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.385682][ T9789] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 241.406617][ T9821] loop2: detected capacity change from 0 to 512 [ 242.706491][ T9829] netlink: 'syz.4.1336': attribute type 1 has an invalid length. [ 242.865172][ T9829] batman_adv: batadv0: Adding interface: macvtap2 [ 242.871748][ T9829] batman_adv: batadv0: The MTU of interface macvtap2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 242.897263][ T9829] batman_adv: batadv0: Interface activated: macvtap2 [ 244.049976][ T9844] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 244.063726][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 60 seconds [ 244.458564][ T9852] Bluetooth: hci0: invalid length 0, exp 2 for type 13 [ 245.170232][ T9865] overlay: ./bus is not a directory [ 246.258880][ T9878] fuse: Bad value for 'fd' [ 247.416855][ T9890] overlay: ./bus is not a directory [ 247.723105][ T5148] Bluetooth: hci4: command 0x0405 tx timeout [ 248.106347][ T9899] fuse: Bad value for 'fd' [ 248.178812][ T9905] Bluetooth: hci0: invalid length 0, exp 2 for type 13 [ 249.937030][ T9922] syzkaller0: entered promiscuous mode [ 250.013473][ T9922] syzkaller0: entered allmulticast mode [ 251.074201][ T9953] Bluetooth: hci0: invalid length 0, exp 2 for type 13 [ 255.811576][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.820905][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.250128][ T9987] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.285083][ T9987] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.393977][T10006] syzkaller0: entered promiscuous mode [ 259.417626][T10006] syzkaller0: entered allmulticast mode [ 261.323414][T10019] overlay: ./bus is not a directory [ 261.370386][T10020] syzkaller0: entered promiscuous mode [ 261.386476][T10020] syzkaller0: entered allmulticast mode [ 261.866587][T10028] loop3: detected capacity change from 0 to 2048 [ 262.010258][T10028] UDF-fs: error (device loop3): udf_process_sequence: Primary Volume Descriptor not found! [ 262.066440][T10028] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 263.307591][T10048] loop1: detected capacity change from 0 to 2048 [ 263.388763][T10048] UDF-fs: error (device loop1): udf_process_sequence: Primary Volume Descriptor not found! [ 263.762705][T10048] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 264.658421][T10073] overlay: ./bus is not a directory [ 265.344423][T10086] syzkaller0: entered promiscuous mode [ 265.371325][T10086] syzkaller0: entered allmulticast mode [ 266.498474][T10099] loop3: detected capacity change from 0 to 2048 [ 266.522224][T10099] UDF-fs: error (device loop3): udf_process_sequence: Primary Volume Descriptor not found! [ 266.543985][T10099] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 266.748960][T10106] netlink: 'syz.1.1420': attribute type 1 has an invalid length. [ 267.050228][T10112] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 267.708420][T10118] syzkaller0: entered promiscuous mode [ 267.733044][T10118] syzkaller0: entered allmulticast mode [ 268.466201][T10134] overlay: ./bus is not a directory [ 271.351241][T10155] overlayfs: failed to clone upperpath [ 272.652058][ T5198] udevd[5198]: worker [5961] /devices/virtual/block/nbd0 is taking a long time [ 273.825406][T10172] syzkaller0: entered promiscuous mode [ 273.850640][T10172] syzkaller0: entered allmulticast mode [ 274.354683][T10184] netlink: 'syz.2.1440': attribute type 1 has an invalid length. [ 274.363100][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 90 seconds [ 274.797771][T10188] batadv_slave_0: entered promiscuous mode [ 275.038313][T10188] batman_adv: batadv0: Adding interface: macvtap1 [ 275.057471][T10188] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 275.093728][T10188] batman_adv: batadv0: Interface activated: macvtap1 [ 275.411217][ T5830] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 275.580586][ T5830] usb 2-1: Using ep0 maxpacket: 32 [ 275.590345][ T5830] usb 2-1: config 0 has no interfaces? [ 275.602652][ T5830] usb 2-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 275.621520][ T5830] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.633282][ T5830] usb 2-1: Product: syz [ 275.641011][ T5830] usb 2-1: Manufacturer: syz [ 275.655229][ T5830] usb 2-1: SerialNumber: syz [ 275.668755][ T5830] usb 2-1: config 0 descriptor?? [ 275.887074][ T5830] usb 2-1: USB disconnect, device number 14 [ 276.433063][T10203] overlay: ./bus is not a directory [ 278.329635][T10216] netlink: 'syz.2.1448': attribute type 1 has an invalid length. [ 280.387049][T10213] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.434521][T10213] bridge0: port 2(bridge_slave_1) entered disabled state [ 280.762145][T10222] batman_adv: batadv0: Adding interface: macvtap2 [ 280.926522][T10222] batman_adv: batadv0: The MTU of interface macvtap2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.007691][T10222] batman_adv: batadv0: Interface activated: macvtap2 [ 281.550732][ T5888] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 282.410569][ T5888] usb 3-1: Using ep0 maxpacket: 32 [ 282.446307][ T5888] usb 3-1: config 0 has no interfaces? [ 282.475875][ T5888] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 282.517046][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.566802][ T5888] usb 3-1: Product: syz [ 282.590982][ T5888] usb 3-1: Manufacturer: syz [ 282.607744][ T5888] usb 3-1: SerialNumber: syz [ 282.631120][ T5888] usb 3-1: config 0 descriptor?? [ 282.896022][ T5888] usb 3-1: USB disconnect, device number 17 [ 285.781036][T10281] syzkaller0: entered promiscuous mode [ 285.800582][T10281] syzkaller0: entered allmulticast mode [ 286.776672][T10292] overlay: ./bus is not a directory [ 293.824659][T10350] netlink: 'syz.1.1487': attribute type 1 has an invalid length. [ 296.851159][T10357] batman_adv: batadv0: Adding interface: macvtap3 [ 296.865875][T10357] batman_adv: batadv0: The MTU of interface macvtap3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 296.920897][T10357] batman_adv: batadv0: Interface activated: macvtap3 [ 297.175693][T10371] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1491'. [ 297.414154][ T5845] block nbd1: Receive control failed (result -107) [ 301.240755][T10411] overlay: ./bus is not a directory [ 302.345545][T10425] overlayfs: missing 'lowerdir' [ 304.441945][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 120 seconds [ 304.542711][T10434] netlink: 'syz.0.1509': attribute type 1 has an invalid length. [ 305.282727][T10435] batman_adv: batadv0: Adding interface: macvtap2 [ 305.307828][T10435] batman_adv: batadv0: The MTU of interface macvtap2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 305.339346][T10440] netlink: 'syz.2.1511': attribute type 1 has an invalid length. [ 305.782657][T10435] batman_adv: batadv0: Interface activated: macvtap2 [ 305.939872][T10442] batman_adv: batadv0: Adding interface: macvtap3 [ 305.966666][T10442] batman_adv: batadv0: The MTU of interface macvtap3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 306.043101][T10442] batman_adv: batadv0: Interface activated: macvtap3 [ 306.383734][ T30] audit: type=1800 audit(2000000083.060:619): pid=10446 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1513" name="bus" dev="overlay" ino=1488 res=0 errno=0 [ 310.976565][T10481] overlayfs: failed to clone upperpath [ 312.665673][T10499] syzkaller0: entered promiscuous mode [ 312.679569][T10499] syzkaller0: entered allmulticast mode [ 315.420225][T10530] netlink: 'syz.3.1537': attribute type 1 has an invalid length. [ 315.723335][T10530] batadv_slave_0: entered promiscuous mode [ 315.732841][T10530] batman_adv: batadv0: Adding interface: macvtap1 [ 315.739320][T10530] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 315.766313][T10530] batman_adv: batadv0: Interface activated: macvtap1 [ 317.251141][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.257773][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.272480][T10554] syzkaller0: entered promiscuous mode [ 317.295703][T10554] syzkaller0: entered allmulticast mode [ 319.421317][T10573] netlink: 'syz.3.1550': attribute type 1 has an invalid length. [ 320.046543][T10576] netlink: 'syz.1.1552': attribute type 1 has an invalid length. [ 322.384234][T10596] syzkaller0: entered promiscuous mode [ 322.400593][T10596] syzkaller0: entered allmulticast mode [ 323.785730][T10618] overlayfs: failed to clone upperpath [ 328.390255][T10658] overlayfs: failed to clone upperpath [ 328.414406][T10653] syzkaller0: entered promiscuous mode [ 328.430470][T10653] syzkaller0: entered allmulticast mode [ 330.235186][T10677] netlink: 'syz.0.1581': attribute type 1 has an invalid length. [ 332.476561][T10681] batman_adv: batadv0: Adding interface: macvtap3 [ 332.494954][T10681] batman_adv: batadv0: The MTU of interface macvtap3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 332.525134][T10681] batman_adv: batadv0: Interface activated: macvtap3 [ 332.653784][T10693] netlink: 'syz.2.1583': attribute type 1 has an invalid length. [ 333.512044][T10694] batman_adv: batadv0: Adding interface: macvtap4 [ 333.523721][T10694] batman_adv: batadv0: The MTU of interface macvtap4 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 334.233537][T10694] batman_adv: batadv0: Interface activated: macvtap4 [ 334.425205][T10705] overlayfs: failed to clone upperpath [ 334.521116][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 150 seconds [ 334.866054][T10716] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 336.035069][ T30] audit: type=1800 audit(2000000112.720:620): pid=10723 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1594" name="bus" dev="overlay" ino=1573 res=0 errno=0 [ 336.162955][T10728] syzkaller0: entered promiscuous mode [ 336.168745][T10728] syzkaller0: entered allmulticast mode [ 336.445017][T10738] overlayfs: failed to clone upperpath [ 337.199832][T10752] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 337.816585][T10767] syzkaller0: entered promiscuous mode [ 337.822366][T10767] syzkaller0: entered allmulticast mode [ 339.405746][T10785] overlayfs: failed to clone upperpath [ 339.736054][T10792] fuse: Unknown parameter 'user_i00000000000000000000' [ 342.240725][T10808] syzkaller0: entered promiscuous mode [ 342.246394][T10808] syzkaller0: entered allmulticast mode [ 344.838753][T10820] netlink: 'syz.3.1629': attribute type 1 has an invalid length. [ 346.598299][T10822] batman_adv: batadv0: Adding interface: macvtap2 [ 346.611702][T10822] batman_adv: batadv0: The MTU of interface macvtap2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.713823][T10822] batman_adv: batadv0: Interface activated: macvtap2 [ 346.755175][T10829] fuse: Unknown parameter 'user_id00000000000000000000' [ 347.043398][T10835] syzkaller0: entered promiscuous mode [ 347.070562][T10835] syzkaller0: entered allmulticast mode [ 349.179472][T10851] overlayfs: failed to clone upperpath [ 350.696158][T10865] fuse: Unknown parameter 'user_id00000000000000000000' [ 352.540890][ T5902] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 352.732294][ T5902] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 352.802758][ T5902] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.222062][ T5902] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 353.260328][ T5902] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.304005][ T5902] usb 3-1: config 0 interface 0 has no altsetting 0 [ 353.345662][ T5902] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.385720][ T5902] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 353.415962][ T5902] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.460019][ T5902] usb 3-1: config 0 interface 0 has no altsetting 0 [ 353.476903][T10892] batman_adv: batadv0: Adding interface: macvtap3 [ 353.483407][T10892] batman_adv: batadv0: The MTU of interface macvtap3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 353.508849][T10892] batman_adv: batadv0: Interface activated: macvtap3 [ 353.538734][ T5902] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.565140][ T5902] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 353.597667][ T5902] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.622321][ T5902] usb 3-1: config 0 interface 0 has no altsetting 0 [ 353.642183][ T5902] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.660789][ T5902] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 353.690600][ T5902] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.723285][ T5902] usb 3-1: config 0 interface 0 has no altsetting 0 [ 353.732363][ T5902] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.750526][ T5902] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 353.761527][T10901] fuse: Unknown parameter 'user_id00000000000000000000' [ 353.780678][ T5902] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.805253][ T5902] usb 3-1: config 0 interface 0 has no altsetting 0 [ 353.821946][ T5902] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.841352][ T5902] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 353.855246][ T5902] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.889002][ T5902] usb 3-1: config 0 interface 0 has no altsetting 0 [ 353.911746][ T5902] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.922657][ T5902] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 353.943722][ T5902] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.972975][ T5902] usb 3-1: config 0 interface 0 has no altsetting 0 [ 353.991155][ T5902] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 354.010614][ T5902] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 354.029786][ T5902] usb 3-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 354.060523][ T5902] usb 3-1: config 0 interface 0 has no altsetting 0 [ 354.081473][ T5902] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 354.092236][ T5902] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 354.112884][ T5902] usb 3-1: Product: syz [ 354.123029][ T5902] usb 3-1: Manufacturer: syz [ 354.140319][ T5902] usb 3-1: SerialNumber: syz [ 354.171472][ T5902] usb 3-1: config 0 descriptor?? [ 354.194762][ T5902] yurex 3-1:0.0: Could not find endpoints [ 354.423237][ T24] usb 3-1: USB disconnect, device number 18 [ 357.866104][T10943] fuse: Bad value for 'fd' [ 358.856721][T10950] batman_adv: batadv0: Adding interface: macvtap5 [ 358.878809][T10950] batman_adv: batadv0: The MTU of interface macvtap5 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.951201][T10950] batman_adv: batadv0: Interface activated: macvtap5 [ 359.363730][T10953] netlink: 'syz.0.1674': attribute type 1 has an invalid length. [ 362.600316][T10961] syzkaller0: entered promiscuous mode [ 362.629338][T10961] syzkaller0: entered allmulticast mode [ 362.800938][T10985] fuse: Bad value for 'fd' [ 365.268064][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 180 seconds [ 365.811109][ T5198] udevd[5198]: worker [5961] /devices/virtual/block/nbd0 timeout; kill it [ 366.239605][ T5198] udevd[5198]: seq 13316 '/devices/virtual/block/nbd0' killed [ 369.092787][T11020] netlink: 'syz.0.1690': attribute type 1 has an invalid length. [ 369.297201][T11028] fuse: Bad value for 'fd' [ 375.187530][T11057] syzkaller0: entered promiscuous mode [ 375.204547][T11057] syzkaller0: entered allmulticast mode [ 375.219051][T11077] fuse: Unknown parameter '00000000000000000003' [ 378.867113][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.875642][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 385.866127][T11130] fuse: Unknown parameter '00000000000000000003' [ 392.817903][T11169] fuse: Unknown parameter '00000000000000000003' [ 392.933810][T11171] fuse: Unknown parameter 'grou00000000000000000000' [ 395.068595][T11173] syzkaller0: entered promiscuous mode [ 395.121900][T11173] syzkaller0: entered allmulticast mode [ 395.347301][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 210 seconds [ 396.255102][T11198] netlink: 'syz.3.1743': attribute type 1 has an invalid length. [ 400.482972][T11216] usb usb1: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 400.540110][T11218] fuse: Unknown parameter '00000000000000000003' [ 400.725956][T11221] fuse: Unknown parameter 'grou00000000000000000000' [ 401.568452][T11228] netlink: 'syz.2.1753': attribute type 1 has an invalid length. [ 402.863758][T11233] batman_adv: batadv0: Adding interface: macvtap6 [ 402.870546][T11233] batman_adv: batadv0: The MTU of interface macvtap6 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 402.901498][T11233] batman_adv: batadv0: Interface activated: macvtap6 [ 405.592797][T11246] syzkaller0: entered promiscuous mode [ 405.598751][T11246] syzkaller0: entered allmulticast mode [ 406.637024][T11256] fuse: Unknown parameter '00000000000000000003' [ 408.169475][ T30] audit: type=1800 audit(2000000184.140:621): pid=11265 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1762" name="bus" dev="overlay" ino=1715 res=0 errno=0 [ 412.832276][T11300] syzkaller0: entered promiscuous mode [ 413.062719][T11300] syzkaller0: entered allmulticast mode [ 416.574332][T11327] netlink: 'syz.4.1780': attribute type 1 has an invalid length. [ 417.448051][ T30] audit: type=1800 audit(2000000193.530:622): pid=11328 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1775" name="bus" dev="overlay" ino=1762 res=0 errno=0 [ 417.845740][T11330] batman_adv: batadv0: Adding interface: macvtap3 [ 417.861566][T11330] batman_adv: batadv0: The MTU of interface macvtap3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 418.680766][T11330] batman_adv: batadv0: Interface activated: macvtap3 [ 420.012997][T11336] syzkaller0: entered promiscuous mode [ 420.032560][T11336] syzkaller0: entered allmulticast mode [ 421.403837][T11366] overlay: ./bus is not a directory [ 425.400978][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 240 seconds [ 426.452701][ T30] audit: type=1800 audit(2000000202.420:623): pid=11395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1794" name="bus" dev="overlay" ino=1894 res=0 errno=0 [ 433.459632][T11450] overlay: ./bus is not a directory [ 435.459761][T11469] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1815'. [ 436.069242][T11469] bridge_slave_1: left allmulticast mode [ 436.075145][T11469] bridge_slave_1: left promiscuous mode [ 436.103676][T11469] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.158843][T11469] bridge_slave_0: left allmulticast mode [ 436.177288][T11469] bridge_slave_0: left promiscuous mode [ 436.194736][T11469] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.322371][T11484] netlink: 'syz.2.1817': attribute type 1 has an invalid length. [ 440.128569][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.139343][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 443.663777][T11544] netlink: 'syz.1.1829': attribute type 1 has an invalid length. [ 444.686070][T11551] overlay: ./bus is not a directory [ 445.138156][T11546] batman_adv: batadv0: Adding interface: macvtap5 [ 445.164369][T11546] batman_adv: batadv0: The MTU of interface macvtap5 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 445.203431][T11546] batman_adv: batadv0: Interface activated: macvtap5 [ 445.520256][T11559] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1832'. [ 446.906947][T11559] bridge_slave_1: left allmulticast mode [ 446.931873][T11559] bridge_slave_1: left promiscuous mode [ 446.946513][T11559] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.301668][T11574] overlay: ./bus is not a directory [ 447.620864][T11559] bridge_slave_0: left allmulticast mode [ 447.636775][T11559] bridge_slave_0: left promiscuous mode [ 447.661608][T11559] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.041747][T11601] fuse: Unknown parameter 'group_i00000000000000000000' [ 451.617194][T11621] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1850'. [ 451.950591][T11626] netlink: 'syz.1.1851': attribute type 1 has an invalid length. [ 453.435214][T11629] batman_adv: batadv0: Adding interface: macvtap6 [ 453.464935][T11629] batman_adv: batadv0: The MTU of interface macvtap6 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 453.516783][T11629] batman_adv: batadv0: Interface activated: macvtap6 [ 453.656943][T11639] fuse: Unknown parameter 'group_id00000000000000000000' [ 454.985416][T11662] netlink: 'syz.3.1861': attribute type 1 has an invalid length. [ 455.494212][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 270 seconds [ 456.560052][T11664] batman_adv: batadv0: Adding interface: macvtap5 [ 456.580599][T11664] batman_adv: batadv0: The MTU of interface macvtap5 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.645944][T11664] batman_adv: batadv0: Interface activated: macvtap5 [ 456.975835][T11683] fuse: Unknown parameter 'group_id00000000000000000000' [ 457.049494][T11686] netlink: 'syz.2.1867': attribute type 1 has an invalid length. [ 457.719480][T11690] batman_adv: batadv0: Adding interface: macvtap8 [ 457.735717][T11690] batman_adv: batadv0: The MTU of interface macvtap8 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 457.784726][T11690] batman_adv: batadv0: Interface activated: macvtap8 [ 458.908221][T11701] netlink: 'syz.3.1870': attribute type 1 has an invalid length. [ 459.807398][T11702] batman_adv: batadv0: Adding interface: macvtap6 [ 459.826168][T11702] batman_adv: batadv0: The MTU of interface macvtap6 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 460.044086][T11702] batman_adv: batadv0: Interface activated: macvtap6 [ 460.070564][ T803] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 460.129849][T11721] netlink: 'syz.0.1877': attribute type 1 has an invalid length. [ 460.583052][T11722] batman_adv: batadv0: Adding interface: macvtap6 [ 460.589699][T11722] batman_adv: batadv0: The MTU of interface macvtap6 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 460.616087][T11722] batman_adv: batadv0: Interface activated: macvtap6 [ 460.896106][ T803] usb 3-1: config index 0 descriptor too short (expected 65183, got 72) [ 460.967466][ T803] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 461.143452][ T803] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.160734][ T803] usb 3-1: Product: syz [ 461.165052][ T803] usb 3-1: Manufacturer: syz [ 461.169676][ T803] usb 3-1: SerialNumber: syz [ 461.186919][ T803] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 461.494101][T11728] overlay: ./bus is not a directory [ 463.190027][ T24] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 463.804624][ T5902] usb 3-1: USB disconnect, device number 19 [ 463.864184][T11736] netlink: 'syz.4.1880': attribute type 1 has an invalid length. [ 463.911843][T11736] batman_adv: batadv0: Adding interface: macvtap4 [ 463.918329][T11736] batman_adv: batadv0: The MTU of interface macvtap4 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 463.945086][T11736] batman_adv: batadv0: Interface activated: macvtap4 [ 464.600800][ T24] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 464.618739][ T24] ath9k_htc: Failed to initialize the device [ 465.027997][ T5902] usb 3-1: ath9k_htc: USB layer deinitialized [ 466.736006][ T24] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 466.756659][T11787] netlink: 'syz.4.1896': attribute type 1 has an invalid length. [ 467.455565][T11787] batman_adv: batadv0: Adding interface: macvtap5 [ 467.462100][T11787] batman_adv: batadv0: The MTU of interface macvtap5 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 467.487780][T11787] batman_adv: batadv0: Interface activated: macvtap5 [ 467.671359][ T24] usb 3-1: config index 0 descriptor too short (expected 65183, got 72) [ 467.715431][ T24] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 467.737535][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.757441][ T24] usb 3-1: Product: syz [ 467.766337][ T24] usb 3-1: Manufacturer: syz [ 467.771546][ T24] usb 3-1: SerialNumber: syz [ 467.790706][ T24] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 467.845084][ T5922] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 468.075453][T11778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.099405][T11778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.128870][T11778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.149165][T11778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.313071][T11778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.402245][T11778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.412552][ T5902] usb 3-1: USB disconnect, device number 20 [ 469.082747][ T5922] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 469.099480][ T5922] ath9k_htc: Failed to initialize the device [ 469.138256][ T5902] usb 3-1: ath9k_htc: USB layer deinitialized [ 470.531392][T11815] overlayfs: failed to resolve './file1': -2 [ 470.954217][T11826] netlink: 'syz.4.1909': attribute type 1 has an invalid length. [ 471.051735][T11826] batman_adv: batadv0: Adding interface: macvtap6 [ 471.058231][T11826] batman_adv: batadv0: The MTU of interface macvtap6 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 471.083726][T11826] batman_adv: batadv0: Interface activated: macvtap6 [ 477.914949][T11874] netlink: 'syz.1.1923': attribute type 1 has an invalid length. [ 479.457956][T11874] batman_adv: batadv0: Adding interface: macvtap7 [ 479.464480][T11874] batman_adv: batadv0: The MTU of interface macvtap7 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 479.491032][T11874] batman_adv: batadv0: Interface activated: macvtap7 [ 483.395082][T11917] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1933'. [ 484.759841][T11949] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1942'. [ 484.781670][T11948] netlink: 'syz.4.1943': attribute type 1 has an invalid length. [ 484.942639][T11954] batman_adv: batadv0: Adding interface: macvtap7 [ 484.958824][T11954] batman_adv: batadv0: The MTU of interface macvtap7 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 484.989288][T11954] batman_adv: batadv0: Interface activated: macvtap7 [ 485.655508][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 300 seconds [ 486.764185][T11973] netlink: 'syz.2.1950': attribute type 1 has an invalid length. [ 487.537663][T11977] batman_adv: batadv0: Adding interface: macvtap9 [ 487.649015][T11977] batman_adv: batadv0: The MTU of interface macvtap9 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 487.715624][T11977] batman_adv: batadv0: Interface activated: macvtap9 [ 488.059470][T11985] syzkaller0: entered promiscuous mode [ 488.068096][T11985] syzkaller0: entered allmulticast mode [ 494.991711][T12032] batman_adv: batadv0: Adding interface: macvtap7 [ 495.022726][T12032] batman_adv: batadv0: The MTU of interface macvtap7 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 495.081947][T12032] batman_adv: batadv0: Interface activated: macvtap7 [ 495.131447][T12047] netlink: 'syz.1.1971': attribute type 1 has an invalid length. [ 495.669595][T12048] batman_adv: batadv0: Adding interface: macvtap8 [ 495.707799][T12048] batman_adv: batadv0: The MTU of interface macvtap8 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 495.784580][T12048] batman_adv: batadv0: Interface activated: macvtap8 [ 495.792513][T12054] netlink: 'syz.4.1973': attribute type 1 has an invalid length. [ 496.763633][T12054] batman_adv: batadv0: Adding interface: macvtap8 [ 496.787292][T12054] batman_adv: batadv0: The MTU of interface macvtap8 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 496.833067][T12054] batman_adv: batadv0: Interface activated: macvtap8 [ 499.373585][T12092] netlink: 'syz.0.1986': attribute type 1 has an invalid length. [ 500.737918][T12079] syzkaller0: entered promiscuous mode [ 500.757669][T12079] syzkaller0: entered allmulticast mode [ 500.797713][T12085] batman_adv: batadv0: Adding interface: macvtap9 [ 500.804325][T12085] batman_adv: batadv0: The MTU of interface macvtap9 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 500.830687][T12085] batman_adv: batadv0: Interface activated: macvtap9 [ 501.618856][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.632768][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.152867][T12112] netlink: 'syz.2.1990': attribute type 1 has an invalid length. [ 504.386095][T12123] netlink: 'syz.1.1991': attribute type 1 has an invalid length. [ 505.306627][T12114] batman_adv: batadv0: Adding interface: macvtap10 [ 505.340386][T12114] batman_adv: batadv0: The MTU of interface macvtap10 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 505.497635][T12114] batman_adv: batadv0: Interface activated: macvtap10 [ 506.937484][T12135] batman_adv: batadv0: Adding interface: macvtap9 [ 506.947292][T12135] batman_adv: batadv0: The MTU of interface macvtap9 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 506.983409][T12135] batman_adv: batadv0: Interface activated: macvtap9 [ 511.355754][T12167] syzkaller0: entered promiscuous mode [ 511.419053][T12167] syzkaller0: entered allmulticast mode [ 515.626535][T12199] netlink: 'syz.4.2012': attribute type 1 has an invalid length. [ 516.285116][ T1718] block nbd0: Possible stuck request ffff888027c60000: control (read@0,4096B). Runtime 330 seconds [ 518.106373][T12200] batman_adv: batadv0: Adding interface: macvtap10 [ 518.113621][T12200] batman_adv: batadv0: The MTU of interface macvtap10 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 518.149741][T12200] batman_adv: batadv0: Interface activated: macvtap10 [ 518.406734][T12212] netlink: 'syz.3.2017': attribute type 1 has an invalid length. [ 518.700560][T12212] batman_adv: batadv0: Adding interface: macvtap8 [ 518.707886][T12212] batman_adv: batadv0: The MTU of interface macvtap8 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 519.272426][T12212] batman_adv: batadv0: Interface activated: macvtap8 [ 519.843280][T12223] overlayfs: missing 'lowerdir' [ 521.710384][T12232] overlayfs: missing 'lowerdir' [ 525.014185][T12245] syzkaller0: entered promiscuous mode [ 525.054683][T12245] syzkaller0: entered allmulticast mode [ 526.160962][T12263] netlink: 'syz.2.2031': attribute type 1 has an invalid length. [ 527.913065][ T31] INFO: task udevd:5961 blocked in I/O wait for more than 144 seconds. [ 527.970688][ T31] Not tainted syzkaller #0 [ 527.992248][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 528.028225][ T31] task:udevd state:D stack:22168 pid:5961 tgid:5961 ppid:5198 task_flags:0x400140 flags:0x00080802 [ 528.075593][ T31] Call Trace: [ 528.089325][ T31] [ 528.102670][ T31] __schedule+0x1665/0x5590 [ 528.110138][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 528.116839][ T31] ? __pfx___schedule+0x10/0x10 [ 528.122358][ T31] ? schedule+0x90/0x360 [ 528.130989][ T31] schedule+0x164/0x360 [ 528.135356][ T31] io_schedule+0x7f/0xd0 [ 528.154354][ T31] folio_wait_bit_common+0x6d8/0xbc0 [ 528.160561][ T31] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 528.167845][ T31] ? __pfx_wake_page_function+0x10/0x10 [ 528.174086][ T31] ? __filemap_get_folio_mpol+0x7a9/0xb00 [ 528.180434][ T31] do_read_cache_folio+0x1ad/0x590 [ 528.186512][ T31] ? __pfx_blkdev_read_folio+0x10/0x10 [ 528.192331][ T31] read_part_sector+0xb6/0x2b0 [ 528.198408][ T31] adfspart_check_POWERTEC+0x92/0xef0 [ 528.204148][ T31] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 528.211049][ T31] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 528.217319][ T31] bdev_disk_changed+0x7ba/0x1550 [ 528.222643][ T31] ? bdev_open+0xe0/0xd30 [ 528.227114][ T31] ? __pfx_bdev_disk_changed+0x10/0x10 [ 528.236141][ T31] blkdev_get_whole+0x380/0x510 [ 528.258383][ T31] bdev_open+0x31e/0xd30 [ 528.278273][ T31] blkdev_open+0x470/0x610 [ 528.284047][ T31] ? __pfx_blkdev_open+0x10/0x10 [ 528.289226][ T31] do_dentry_open+0x785/0x14e0 [ 528.295346][ T31] vfs_open+0x3b/0x340 [ 528.299608][ T31] ? path_openat+0x2df0/0x3860 [ 528.304702][ T31] path_openat+0x2e08/0x3860 [ 528.309458][ T31] ? __pfx_stack_trace_save+0x10/0x10 [ 528.315235][ T31] ? stack_depot_save_flags+0x33/0x810 [ 528.320873][ T31] ? __pfx_path_openat+0x10/0x10 [ 528.327003][ T31] ? __x64_sys_openat+0x138/0x170 [ 528.335323][ T31] ? do_syscall_64+0x14d/0xf80 [ 528.340650][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.346869][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 528.353658][ T31] do_file_open+0x23e/0x4a0 [ 528.358340][ T31] ? __pfx_do_file_open+0x10/0x10 [ 528.364994][ T31] ? _raw_spin_unlock+0x28/0x50 [ 528.372654][ T31] ? alloc_fd+0x64b/0x6c0 [ 528.378296][ T31] do_sys_openat2+0x113/0x200 [ 528.386496][ T31] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 528.414735][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 528.435866][ T31] ? rcu_is_watching+0x15/0xb0 [ 528.453064][ T31] __x64_sys_openat+0x138/0x170 [ 528.470878][ T31] do_syscall_64+0x14d/0xf80 [ 528.486026][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.510790][ T31] ? clear_bhb_loop+0x40/0x90 [ 528.527867][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.545158][ T31] RIP: 0033:0x7fa9996a7407 [ 528.557978][ T31] RSP: 002b:00007ffcd493b8b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 528.579913][ T31] RAX: ffffffffffffffda RBX: 00007fa999de3880 RCX: 00007fa9996a7407 [ 528.588413][ T31] RDX: 00000000000a0800 RSI: 000055915ccfe340 RDI: ffffffffffffff9c [ 528.596562][ T31] RBP: 000055915ccfd910 R08: 0000000000000000 R09: 0000000000000000 [ 528.607465][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 000055915cd66510 [ 528.615978][ T31] R13: 000055915cd0b190 R14: 0000000000000000 R15: 000055915cd66510 [ 528.624447][ T31] [ 528.638871][ T31] [ 528.638871][ T31] Showing all locks held in the system: [ 528.649835][ T31] 1 lock held by khungtaskd/31: [ 528.677918][ T31] #0: ffffffff8e7606e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 528.689374][ T31] 3 locks held by kworker/u8:2/35: [ 528.695883][ T31] #0: ffff88801b09c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x849/0x1720 [ 528.713032][ T31] #1: ffffc90000ab7c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x870/0x1720 [ 528.730590][ T31] #2: ffffffff8fbd1f08 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 528.742360][ T31] 3 locks held by kworker/u8:3/37: [ 528.749521][ T31] #0: ffff8880b863ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb6/0x150 [ 528.759622][ T31] #1: ffff8880b8624588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 528.770486][ T31] #2: ffff8880597b0788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x4a0 [ 528.780755][ T31] 3 locks held by kworker/u8:5/78: [ 528.790498][ T31] #0: ffff888033130148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x849/0x1720 [ 528.801874][ T31] #1: ffffc900025cfc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x870/0x1720 [ 528.815463][ T31] #2: ffffffff8fbd1f08 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11e/0x14c0 [ 528.831061][ T31] 2 locks held by getty/5582: [ 528.840437][ T31] #0: ffff888033bec0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 528.854829][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 528.865615][ T31] 1 lock held by udevd/5961: [ 528.875762][ T31] #0: ffff8880277d9358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 528.886394][ T31] 2 locks held by syz.1.2027/12244: [ 528.895012][ T31] #0: ffffffff8fbd1f08 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 528.904269][ T31] #1: ffffffff8e766978 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 528.916898][ T31] 1 lock held by syz.2.2031/12263: [ 528.923927][ T31] #0: ffffffff8fbd1f08 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x722/0xbe0 [ 528.937377][ T31] 2 locks held by syz.2.2031/12269: [ 528.947474][ T31] #0: ffffffff901230f8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 528.957777][ T31] #1: ffffffff8fbd1f08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 528.967818][ T31] 1 lock held by syz.0.2026/12272: [ 528.975465][ T31] #0: ffffffff8fbd1f08 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3bc/0x1e30 [ 528.999429][ T31] [ 529.013358][ T31] ============================================= [ 529.013358][ T31] [ 529.022735][ T31] NMI backtrace for cpu 1 [ 529.022766][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 529.022788][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 529.022801][ T31] Call Trace: [ 529.022808][ T31] [ 529.022817][ T31] dump_stack_lvl+0xe8/0x150 [ 529.022853][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 529.022878][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 529.022910][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 529.022939][ T31] sys_info+0x135/0x170 [ 529.022959][ T31] watchdog+0x1002/0x1060 [ 529.022991][ T31] ? watchdog+0x1da/0x1060 [ 529.023021][ T31] kthread+0x388/0x470 [ 529.023054][ T31] ? __pfx_watchdog+0x10/0x10 [ 529.023075][ T31] ? __pfx_kthread+0x10/0x10 [ 529.023101][ T31] ret_from_fork+0x51e/0xb90 [ 529.023132][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 529.023159][ T31] ? __switch_to+0xc7d/0x1450 [ 529.023188][ T31] ? __pfx_kthread+0x10/0x10 [ 529.023212][ T31] ret_from_fork_asm+0x1a/0x30 [ 529.023249][ T31] [ 529.023258][ T31] Sending NMI from CPU 1 to CPUs 0: [ 529.136293][ C0] NMI backtrace for cpu 0 [ 529.136319][ C0] CPU: 0 UID: 0 PID: 3496 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 529.136340][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 529.136352][ C0] Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet [ 529.136386][ C0] RIP: 0010:batadv_iv_ogm_schedule+0x731/0xf50 [ 529.136414][ C0] Code: 15 38 28 f6 48 c7 c7 e0 06 76 8e 48 8b b4 24 98 00 00 00 e8 81 1e 28 f6 e8 cc cd 31 f6 48 8b 84 24 90 00 00 00 42 0f b6 04 30 <84> c0 75 16 48 ff c3 41 8b 45 00 48 39 c3 73 21 e8 0a e5 4b f6 e9 [ 529.136430][ C0] RSP: 0018:ffffc9000e14f940 EFLAGS: 00000287 [ 529.136445][ C0] RAX: 0000000000000000 RBX: 0000000000000286 RCX: 0000000000000046 [ 529.136457][ C0] RDX: 0000000000000003 RSI: ffffffff8e17d3f6 RDI: ffff888034389e80 [ 529.136469][ C0] RBP: ffffc9000e14fa90 R08: ffffffff8b7a898a R09: ffffffff8e7606e0 [ 529.136484][ C0] R10: dffffc0000000000 R11: fffffbfff2023dff R12: ffff88805be6e880 [ 529.136497][ C0] R13: ffff88805be6e890 R14: dffffc0000000000 R15: ffff88805be95430 [ 529.136511][ C0] FS: 0000000000000000(0000) GS:ffff888125441000(0000) knlGS:0000000000000000 [ 529.136526][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 529.136538][ C0] CR2: 00002000003a3030 CR3: 0000000076492000 CR4: 00000000003526f0 [ 529.136554][ C0] Call Trace: [ 529.136561][ C0] [ 529.136571][ C0] ? pskb_expand_head+0xcc6/0x1320 [ 529.136598][ C0] ? batadv_iv_ogm_schedule+0x43a/0xf50 [ 529.136621][ C0] ? __pfx_batadv_iv_ogm_schedule+0x10/0x10 [ 529.136647][ C0] ? batadv_send_skb_packet+0x426/0x690 [ 529.136678][ C0] batadv_iv_send_outstanding_bat_ogm_packet+0x6c8/0x7e0 [ 529.136711][ C0] ? process_one_work+0x870/0x1720 [ 529.136736][ C0] process_one_work+0x963/0x1720 [ 529.136772][ C0] ? __pfx_process_one_work+0x10/0x10 [ 529.136795][ C0] ? do_raw_spin_lock+0x26c/0x2f0 [ 529.136825][ C0] worker_thread+0xb46/0x1140 [ 529.136864][ C0] kthread+0x388/0x470 [ 529.136883][ C0] ? __pfx_worker_thread+0x10/0x10 [ 529.136908][ C0] ? __pfx_kthread+0x10/0x10 [ 529.136928][ C0] ret_from_fork+0x51e/0xb90 [ 529.136954][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 529.136977][ C0] ? __switch_to+0xc7d/0x1450 [ 529.137000][ C0] ? __pfx_kthread+0x10/0x10 [ 529.137020][ C0] ret_from_fork_asm+0x1a/0x30 [ 529.137046][ C0] [ 529.380555][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 529.387553][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 529.396701][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 529.406975][ T31] Call Trace: [ 529.410297][ T31] [ 529.413272][ T31] vpanic+0x56c/0xa60 [ 529.417302][ T31] ? __pfx___schedule+0x10/0x10 [ 529.422198][ T31] ? __pfx_vpanic+0x10/0x10 [ 529.426735][ T31] ? nmi_trigger_cpumask_backtrace+0x1f4/0x300 [ 529.432953][ T31] panic+0xc5/0xd0 [ 529.436722][ T31] ? __pfx_panic+0x10/0x10 [ 529.441231][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 529.446650][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 529.452874][ T31] watchdog+0x105b/0x1060 [ 529.457247][ T31] ? watchdog+0x1da/0x1060 [ 529.461706][ T31] kthread+0x388/0x470 [ 529.465799][ T31] ? __pfx_watchdog+0x10/0x10 [ 529.470506][ T31] ? __pfx_kthread+0x10/0x10 [ 529.475167][ T31] ret_from_fork+0x51e/0xb90 [ 529.479844][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 529.484988][ T31] ? __switch_to+0xc7d/0x1450 [ 529.489691][ T31] ? __pfx_kthread+0x10/0x10 [ 529.494300][ T31] ret_from_fork_asm+0x1a/0x30 [ 529.499094][ T31] [ 529.502992][ T31] Kernel Offset: disabled [ 529.507334][ T31] Rebooting in 86400 seconds..