last executing test programs: 6m41.656924715s ago: executing program 3 (id=481): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x200, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000040)=0x18) socket$nl_xfrm(0x10, 0x3, 0x6) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x8, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='+\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_smc(0x2b, 0x1, 0x0) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[@ANYBLOB="6368616e6765686174203078303030303030303030303030303030345e00a7005e28112e2d2b295e3a2605e800e85b212e2f215b28232c00002b002300d0002000007153000000000000000024f65fbd491cf2a95dcce02aef018d15d26893c9b537c3ea5c4562f8e62cdfd4fa6584ccd52264f0442d989f817bfc24c4bc46f8c88dcbb8f21ee42755b3b8d3e6d78059c2eb0ab85fe8965959e3c7e6f23819a6a7fadb1c65c103864ab2666819ee23cc0fedfe61dc88cb256257d335da3dac1dae93fd275436940aa49c55c40c417e5bbf8b90fe04e755f36881146c37759596745c0fef3b03a443bc2856632161c1e339c6629035f8c9406801f5cb88df39af35c8613a7ae4cb61672636378134f67de13076366cd62c1ea0ccbffd6b6d083f8339"], 0x187) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x3, &(0x7f0000000300)=@raw=[@generic={0x29, 0xa, 0x9, 0xac, 0x40df}, @map_fd={0x18, 0x7}], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61106000000000006113740000000000bfa00000000000000700000008ffffffd503010017740040950000000000000069163a0000000000bf67000000000000350602000fff07201706000020191800160600000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) 6m41.594390391s ago: executing program 0 (id=482): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000140)=0x14) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x2, 0x6, 0xfffffffffffffffe, 0x8000000000000000, 0xf4a, 0x100000000, 0xbdb], 0xffff1001, 0x4000}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f, 0x2, 0x0, 0x0, 0x0, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6m41.028313088s ago: executing program 0 (id=483): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x2, 0x6, 0xfffffffffffffffe, 0x8000000000000000, 0xf4a, 0x100000000, 0xbdb], 0xffff1001, 0x4000}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f, 0x2, 0x0, 0x0, 0x0, 0x1}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) 6m40.941874762s ago: executing program 0 (id=484): add_key(&(0x7f00000001c0)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='9', 0x1, 0xffffffffffffffff) (async) r0 = add_key(&(0x7f00000001c0)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='9', 0x1, 0xffffffffffffffff) keyctl$chown(0x4, r0, 0xee00, 0xffffffffffffffff) mmap(&(0x7f0000feb000/0x4000)=nil, 0x4000, 0x1, 0x32, 0xffffffffffffffff, 0x8d03000) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000300)=@generic={&(0x7f00000002c0)='./file0\x00', 0x0, 0x18}, 0x14) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r3, 0xc0105500, &(0x7f0000000140)={0x80, 0x6, 0x302, 0xb8a, 0xe0, 0x1, 0x0}) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x4e21, 0xf11, @mcast2, 0xffffffff}}, {{0xa, 0x4e1e, 0x8, @private0}}}, 0x104) (async) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x4e21, 0xf11, @mcast2, 0xffffffff}}, {{0xa, 0x4e1e, 0x8, @private0}}}, 0x104) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x5, &(0x7f0000000340)=[0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf7, &(0x7f00000001c0)=[{}, {}], 0x10, 0x10, &(0x7f0000000200), &(0x7f0000000380), 0x8, 0x32, 0x8, 0x8, &(0x7f0000000280)}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r4, 0x4) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r4, 0x4) capget(&(0x7f0000feaff9)={0x19980330}, &(0x7f0000000000)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x78}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x78}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) syz_open_dev$video(&(0x7f0000000240), 0x6, 0x200000) 6m40.822424878s ago: executing program 3 (id=486): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0x64eb, &(0x7f0000000400)={0x0, 0x5b5f, 0x50000, 0x2, 0x51}, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000005c0)=@IORING_OP_SOCKET={0x2d, 0x8, 0x0, 0x405, 0xfffffffffffffff8, 0x0, 0x3, 0x0, 0x0, {0x0, 0x0, 0xff}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, &(0x7f0000000040)="f30f1ecd65f3ff9dd4a7260f01c9f3360f30670f01ca0f01fa8146051900baf80c66b8fa8ecd8c66efbafc0cb8f64aefdbe03e26660f38825f47", 0x3a}], 0x1, 0x5b, 0x0, 0x0) r5 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01ffffff7f00000000006700080008000300", @ANYRES32=r10, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x1ff, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x80000002, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0x45c5, 0xc595, 0x7, 0x102, 0x3, 0x2000000000000000, 0x80000004000000, 0xc], 0xeeee0000, 0x80}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 6m40.818745493s ago: executing program 0 (id=487): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x168) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r2 = io_uring_setup(0x3452, &(0x7f0000000080)={0x0, 0x2ed1, 0x8, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0), 0x0) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000100)='.\x00', &(0x7f0000002280)='ext4\x00', 0x8000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000700)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWFLOWTABLE={0x3c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HOOK={0x4}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x64}, 0x1, 0x0, 0x0, 0x4880}, 0x2000000) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) write(r3, &(0x7f0000000240)="c7", 0x1) r4 = syz_clone(0x40000, &(0x7f0000000280)="1f54931c36086fc3fb6a643f393739fc1500b82b916b8f44481992851a8377c6a085f3eee9ac5d592be3262efc3e7f173e4b0b3d785a82289c8a64097b196f421bae5575b4998f28e6abe0b8e77099314a9820104cde33978aa2b2e59abccf32c660f1796c2e4d53a167e7a2fc845962e9ed1340390af9611bed7929b9e4d3ded27a92970e7903d0ab2fdb9a5d8d61cf097efb22972ab2ed978bac7684c02d907ea70ec7eba9c4f7d23f8056a9caa4964836680b6bb3d8eb5376378db626519011756dd92cad9e540b08bf8b9982b7d7bd5c8e7ddf557d9d00b90373ac4d921b630b", 0xe2, &(0x7f0000000380), &(0x7f0000000400), &(0x7f0000000440)="de90b0a299befacef525d722b91401725f3e4a1040026e6f9607de14fb6f2a5c8977f891e02244cbe81e8b5b19e59fbb3e2086f7eaadc7a890edac9ef1a1469459777c7b673e6ba96198c7cba235b64b3f0736b29987be54466e3001dc6862e4cd74e157a8cf4a92e08ee8b2fd13607c8d034e4f85378429a695463832881c5f1c8140f6a8712c56ae714a8ab4739a9615dd91d1") sched_setattr(r4, &(0x7f0000000580)={0x38, 0x0, 0x4d, 0x0, 0x8, 0x7fff, 0x7, 0x6, 0xffffffff}, 0x0) 6m39.957202777s ago: executing program 3 (id=489): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000018ae2e0300040014001000010100f4e06400111764e6ff71c90e8497fc9e7a0c5805668c75775fbcce9f15e75e269d2cfd3587"], 0x36) 6m39.781812153s ago: executing program 0 (id=490): r0 = socket$packet(0x11, 0x3, 0x300) listns(&(0x7f0000000080)={0x20, 0x0, 0x39, 0x4000000, 0x0, 0x3}, 0x0, 0x0, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000005c0)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000240)="09000000e70014000000d97bfbf788a83baa88a8000081000000810000999900", 0x68, 0x40810, &(0x7f0000000080)={0x11, 0x3, r1, 0x1, 0xc, 0x6, @broadcast}, 0x14) 6m39.410011368s ago: executing program 3 (id=491): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0xf2) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, 0x0, 0x0, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0xc4}, 0x40094) eventfd(0x3) syz_io_uring_setup(0x34b9, &(0x7f0000000540)={0x0, 0x4205, 0x8, 0x0, 0x327}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="b70000000000000007000000000000009500000000000000a9171809f8dcf159569d5475991f7de1a0d0c119cfcf6b98741c23fb7f8d3002ec85db75af955427e91496087a51a0a78f269a9e216a0d0177c4fe3552396a180330807a5b6e8c79aa92038c78d1f16c1323f0e0c8d45c641a21757847cb22230e4321cc3581e40c62c4defee8cffe359cfeef7f58fffdb48647d28ae810f6d22d20271e9e88e94aa6982bf48356652b08e2fbd404e41e0058aae0478fbe542b648421d1b4486a542a7d478fbe6b5e000000293853f9c68e235184b7ad5b6c4fe70ec8320500db0db7fda3da6171a05509ffecef2cb9802d4f36c9a1ce46d3b355fec188ccfc2f0fc89e164561fb06ee9a0153981a47b5de9edd3536d5534f9a699f73b2c9341d2d05043748ce1f4577ed76cdf5b3c697089daa4abda69a8c0c992404610a6be9e103c972459065dec0488e85a6a0418fc87dd8019ef7bb4ef4fa6ee08d81797570578f2e8198e687012f25a69a90e7515e35f8abbddfa96c3f0485f01f0e9e144a2bd31c1b594c50de7c9efd826f1e19b7bd89ca4052b1985287bd13957a48467e0eeddf564d175bf4340885b63976df609806c3b2a3667539dfd66a7400000000003be6026e60205f761ce85cdf75cdb95ca5d32b5bf87eed4184d49f8f48181ef2419efe82ebb18ee55772d562b3b49551714e805a5211a3f4e8e703c03e23b2074bc573dbb66d59e269b722637c4a2efb5241cae2f14774609ad91d66724c438455dc4fcf0b4c8fc235f6c190b4c82bb2556d1fbcd4468369e98e900c743162ce2c7e60610acf0c8e4ba94a7e7127c7de0e6c35acecee1b8434fdca4579f9ebc6a515f7d910b466eb583fb0a7e65fbecb2b8ee0e9da33afb88aa5da8da3a5e0e58fcb48de6f165826b046a8951a47e040bd419d0efa0f54e8e3694085a7bde6f6494968d8200000000000"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0x97, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff37}, 0x48) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x1000000000000f, &(0x7f0000000080)=0x7fffffff, 0x4) setsockopt$sock_attach_bpf(r5, 0x1, 0x34, &(0x7f0000000040)=r4, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="b7000000ecffffff0c0000000000000095000000000000005e0c83dfb64a3eb1cdfa541cd3957aa8a96b9fa4591c1eb556e38defc504b011face5a06294c2115a9ad943bac350e8d7961537181f79ead9176dc7c3ed2d45004deb987fa0d"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff37}, 0x48) r7 = dup2(r6, r4) setsockopt$sock_attach_bpf(r5, 0x1, 0x34, &(0x7f00000000c0)=r7, 0x4) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) io_uring_enter(r7, 0x4000001, 0xccac, 0x17, 0x0, 0xfffffd85) 6m39.274638343s ago: executing program 0 (id=494): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x891e, &(0x7f0000000380)={'ip6gre0\x00', 0x0}) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000080)={0xf0f041}) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="18003c989eee114374bbe5aa0183c900", @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x44400}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x200, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0xc, 0xffde}, {0xfff3, 0xfff2}, {0x1, 0xf}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x200, 0xb, 0x1}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000001}, 0x20024000) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000004a0001002dbd7000fddbdf250a00800098"], 0x30}, 0x1, 0x0, 0x0, 0x94}, 0x84) sched_setattr(0xffffffffffffffff, &(0x7f0000000040)={0x38, 0x3, 0x0, 0x7, 0x4, 0x0, 0x2, 0x6, 0x100006, 0x5}, 0x0) r7 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) r10 = openat$fb1(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x3, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)=ANY=[@ANYRES32, @ANYRES32=r12, @ANYBLOB="2f00000034000000000000006c7201ec5798d786834f96b66a28ee8f341b0256f7", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) sendmsg$nl_xfrm(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[], 0xfc}}, 0x1) r13 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r13, &(0x7f00000027c0)={&(0x7f0000001740)={0xa, 0x4e24, 0xfffffffa, @mcast2}, 0x1c, 0x0}, 0x810) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x280, 0x78, 0x3f, 0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3}) epoll_pwait(r7, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r9, &(0x7f0000000100)={0x20000014}) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) 6m39.177976163s ago: executing program 32 (id=494): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x891e, &(0x7f0000000380)={'ip6gre0\x00', 0x0}) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000080)={0xf0f041}) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="18003c989eee114374bbe5aa0183c900", @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x44400}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x200, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0xc, 0xffde}, {0xfff3, 0xfff2}, {0x1, 0xf}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x200, 0xb, 0x1}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000001}, 0x20024000) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000004a0001002dbd7000fddbdf250a00800098"], 0x30}, 0x1, 0x0, 0x0, 0x94}, 0x84) sched_setattr(0xffffffffffffffff, &(0x7f0000000040)={0x38, 0x3, 0x0, 0x7, 0x4, 0x0, 0x2, 0x6, 0x100006, 0x5}, 0x0) r7 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) r10 = openat$fb1(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x3, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)=ANY=[@ANYRES32, @ANYRES32=r12, @ANYBLOB="2f00000034000000000000006c7201ec5798d786834f96b66a28ee8f341b0256f7", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) sendmsg$nl_xfrm(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[], 0xfc}}, 0x1) r13 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r13, &(0x7f00000027c0)={&(0x7f0000001740)={0xa, 0x4e24, 0xfffffffa, @mcast2}, 0x1c, 0x0}, 0x810) ioctl$FBIOPUT_VSCREENINFO(r10, 0x4601, &(0x7f0000000380)={0x280, 0x78, 0x3f, 0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3}) epoll_pwait(r7, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r9, &(0x7f0000000100)={0x20000014}) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) 6m39.087007945s ago: executing program 3 (id=497): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b18094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r0 = openat$fuse(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) read$FUSE(r0, &(0x7f0000000840)={0x2020, 0x0, 0x0}, 0x2020) r2 = syz_clone3(&(0x7f0000002b40)={0x68100680, &(0x7f0000002880), &(0x7f00000028c0), &(0x7f0000002900), {0x3a}, &(0x7f0000002940)=""/126, 0x7e, &(0x7f0000002a00)=""/249, &(0x7f0000002b00)=[0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff], 0x7}, 0x58) write$FUSE_LK(r0, &(0x7f0000002bc0)={0x28, 0x0, r1, {{0xff, 0x2, 0x0, r2}}}, 0x28) chdir(&(0x7f0000000140)='./file1\x00') r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) getpid() mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000080)='./file1\x00', &(0x7f00000004c0), 0x1000, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="1400000002060102000000000000960000000006"], 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x84) bpf$BPF_PROG_DETACH(0x26, &(0x7f0000000800)=ANY=[], 0x20) mkdirat(r3, &(0x7f0000000340)='./file1\x00', 0x84) mount$bind(&(0x7f0000000540)='./file1\x00', &(0x7f0000000500)='./file1\x00', 0x0, 0x5040, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000000000000000000000000000000000010000000000000000000000000000000000000003000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="09000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000ffffffffffffffff873572bd47a7cac21d0000000000000000000000000000000000000000000000000000cf270533861de339000000000000000000000000000200000200000000840105"], 0x23c}, 0x1, 0x0, 0x0, 0x40000}, 0x14) r4 = socket(0x10, 0x3, 0x0) unshare(0x400) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)) sendto$inet6(r4, &(0x7f0000000100)="c10e000018001f06b9409b0dffff110d0207be040205060506100a124300040018000000fac8388827a685a168d9a44604094565360c648dcaaf6c26c291214549932fde4a460c89b6ec0cff3959547f509058ba86c902fc3a10004a320c0400160005000a00000000000000000000080756ede4ccbe5880", 0xec1, 0x0, 0x0, 0x9e5e111c47e3504f) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@delneigh={0x2c, 0x1c, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r6, 0x1d5, 0x96, 0x4}, [@NDA_FLAGS_EXT={0x8}, @NDA_VLAN={0x6, 0x5, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x4) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r3, r6, 0x25, 0x2, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000002540)='./file0\x00', &(0x7f0000002580)='system.posix_acl_default\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="0200000004000200000000000400020000000000100001000000000020"], 0x24, 0x3) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) 6m38.530693308s ago: executing program 3 (id=503): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}]}]}, 0x5c}}, 0x0) quotactl_fd$Q_GETINFO(r0, 0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_emit_ethernet(0x32, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffff0180c2000002884700000000008a530bb0c02023d46300112e6e4be7803ff8164bd760f2323433a8e15bdaf0d301469b25f6f4f5a014f7381fb7f08a1a8c8dd095978cfe5b99f0742db57eea18a924fcd3"], 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$sock_int(r2, 0x1, 0xa, &(0x7f0000000080)=0x4, 0x4) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mknod$loop(&(0x7f000000db40)='./file0\x00', 0x1000, 0x0) openat2(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x122240, 0x10b, 0x7}, 0x18) 6m23.380377276s ago: executing program 33 (id=503): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}]}]}, 0x5c}}, 0x0) quotactl_fd$Q_GETINFO(r0, 0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_emit_ethernet(0x32, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffff0180c2000002884700000000008a530bb0c02023d46300112e6e4be7803ff8164bd760f2323433a8e15bdaf0d301469b25f6f4f5a014f7381fb7f08a1a8c8dd095978cfe5b99f0742db57eea18a924fcd3"], 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$sock_int(r2, 0x1, 0xa, &(0x7f0000000080)=0x4, 0x4) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mknod$loop(&(0x7f000000db40)='./file0\x00', 0x1000, 0x0) openat2(0xffffffffffffff9c, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)={0x122240, 0x10b, 0x7}, 0x18) 13.08802094s ago: executing program 2 (id=2468): ioctl$NBD_CLEAR_QUE(0xffffffffffffffff, 0xab05) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) read$FUSE(r1, &(0x7f0000006540)={0x2020}, 0xfffffce2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x0, @pix={0x434c, 0xfffffffa, 0x38414262, 0x6, 0xc, 0x7, 0x0, 0x40000005, 0x1, 0x4, 0x2, 0x1}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000280)={0xf0f022}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000003300), 0x40002, 0x0) write$rfkill(r4, &(0x7f00000000c0)={0x0, 0x2, 0x3, 0xfe, 0x1}, 0x8) 11.083004424s ago: executing program 4 (id=2471): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0x64eb, &(0x7f0000000400)={0x0, 0x5b5f, 0x50000, 0x2, 0x51}, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000005c0)=@IORING_OP_SOCKET={0x2d, 0x8, 0x0, 0x405, 0xfffffffffffffff8, 0x0, 0x3, 0x0, 0x0, {0x0, 0x0, 0xff}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, &(0x7f0000000040)="f30f1ecd65f3ff9dd4a7260f01c9f3360f30670f01ca0f01fa8146051900baf80c66b8fa8ecd8c66efbafc0cb8f64aefdbe03e26660f38825f47", 0x3a}], 0x1, 0x5b, 0x0, 0x0) r5 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYRES16=r8, @ANYBLOB="01ffffff7f00000000006700080008000300", @ANYRES32=r10, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x1ff, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x80000002, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0x45c5, 0xc595, 0x7, 0x102, 0x3, 0x2000000000000000, 0x80000004000000, 0xc], 0xeeee0000, 0x80}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 10.295522951s ago: executing program 2 (id=2472): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x9, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x2, 0x3, 0x0, 0x3, 0x10, 0x0, 0x0, 0x0, [@sadb_key={0x2, 0x9, 0x8, 0x0, "eb"}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xd}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x5, @empty, 0x80000000}}]}, 0x80}, 0x1, 0x7}, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$key(r0, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001640)={&(0x7f00000005c0)={0x2, 0x3, 0x80, 0x9, 0x1ff, 0x0, 0x70bd28, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x3, 0x2, 0x0, 0x6e6bb1, 0x8001, {0x6, 0x33, 0x7, 0x8e, 0x0, 0x2, 0x0, @in=@remote, @in=@multicast1}}, @sadb_key={0x1f1, 0x8, 0x7c00, 0x0, "4d119a2e9aa21c2c199a073b2ca9c7c3e875007975ddd2957af57aa15382f30b4c6135d75b54a885900dcc13f082a1b7dcd2a4e06f3fe7e25099099df2923b497e43085c3077d87f6822feae85893391f1a6431271be1d6753676975cd496c4e59e0803ee9614fe8d965cb6b301fd225f7af2eb6ca1ebfbe79c0cbf7df409a1e1e8266ecb1eb71d4be551ac4e335d8eff2df921fa557e182d6e5c0f367d6ee2babd58be6b5f6f3435b8ef61df28a344ed01c6c5527e1918df704e7643df30867f4848e26adfde1bc10bef8fbab947f49cce3442917a82c242891af20d7943c46f92cdb68c57e4120483927dcab25048eaf2f34c7258132536dcf35fe1c1013fd410da6e9e67a5418ec27eec637d782cd690b135aab2c5ec804b44f016e4f2215bcef7f0e64077be436c820f40f150e38a6907e4b634d9867e5e1cd0a926583bd089c8be681c1751921a8aa9b9255fee32ed5fe899a05c3b8e68f90fde88db4ce9f2aaec902af10dd275a3d7a64a4aa9c8a9bbabaff3f6ad8ef777431bf914ed0e8e9c745a742402e9557ac20e7f9b6af91a460e49160364e212a2d692f8c64b20ed8069ff5a8163a1ac23bcf464779437e9d9e45abc926276361fa8c16c13c610e430e8301078ecd9859723a629d67778182507a00caf3776a36978853ece9958835490557860d2b23a1801ff7fa9bde95d15ff577c96160c13fc8774698df8ff8be6fab465f234fc5a805bc35a9b9f93c6b48659c2117135ae23af0a5b7ec92e2b4c8c05a97c50cc908979b550f0b2386b68812c994fac8b1422e499c5599d6af4f9ab7853e4e7c00d475c5b71a6b4be959092a73e6d0fef05b4e7244b7934bf4c903992bb731dd53edcabda7af519c449fa324a6d4458ad3a1fb90fd58b0f6febf73160fa8c4fbe6bb8b65b360492aa38cca36858f2491c79ff59fb2234335f29900905c69e09e701fd8b3f3631e555852eb775d121069a183380818b296d224fedb87a7fbb2008c2ecd2aabe8e633113dfad8a1c0c6088e6451527afdbb85fae76e0265729eb1cc85fa7abe2cdbdb751b55ee5c3909e410e495e7f6e52646b421b815ec6a0cbcefb85cba027be7afac6413968dd7ec1b53ac0d43af3d10ad7dcb92f5627edd28d252dee6842500b97526dedf6887bcee9d79296e3091550450621e4d910ab54201d91fd96ea1e44906e417c039b891bb4c35d291d5cb18ad588f43efa5c8ffbd26de22854ac684fc570824afc68a803592a3ef390cc9c50d8cc3ae082b21b97b53f3950aa50c9157877d0bd763a710a9dcb3c61dca371d51c62f734bf8faa84639723b87f4b006720af1239b951f22c72d011dc141a731bd80061bee266ef037c3dffe9dadc24f206edfb8dbc611d3a17801608cbbf9b8cf1dd883a11be2ef5b603a84384b31ac4d2a5acc00639bc1c0dcfaee2a0722deeab47bba4a97727323a64bb4db2f6f29a4e3526663df1292701ee945727b3eddf6f3bae8149e1ba58574c6e770e017b59130ce4593bf56f5475f69db32d36dbb89efbf2b356676b2e0901d992169cb70ebd6b0579517f36b7781c95165724e31dc0776905d1f5c07566352f1073a8fc45519a1f5df10bcdb59a061cec83d375867b11fc87e478c96493e293e444917ed4bc315d6779d25e96abe813c32603fe240a621349115b124107d52797e38368207aacf5ae632c8f999a188e47f3e87fcfb3b0e8b4e52c6fd75b4f8bfc4719244755d242bc1c36cf9c3d9be6ffbf55eb94de0e2f5c7848b0cb95c036713ed05235c5ce80f08314073b7fa55d9375b8f679fe72bea286a443a31e0b4ade18d2577373c9ff3175da8db15a6de54cd8ec5424da2bfda0d5e91121f9fec13f05b6272ee33ed938ad5642433eac518626d9c9cb0799fd0ab065e07c2cc5ae3995eaf4931a444ae876f6f5ac2c526058f078f12240c8ec644ff24b05a2fde8353e15afddd411b0c1d350c785b037195a1454b3c4120ac96575deee5adac7e4853ed3ef0ce8d8fff3105047b34c368986ed59f1c3eade16368815367ea44dd5babd44489e824bee26d49a66c714650e34f4950e4db97edbfffae32862078c40e2f45c384530360be51d8d2fc8f18a332cc8e369fd0380b2c56e37ce84cb66fc9150786b540caebb9596f9535e96d2321324a0b56ea8bcf330703da86ad2936dccde7620172900ac67f488c0b6832fe76ee88bee3f83e578e1a864de09ff4a57b0290dde5b12c5b9ba11f32328a20ff79cfea13328fc7b68faf6dc4c0846d6efe64941ae9c70a469f3347c71fe4bdbb84ebbb3d99fdad5e8f45fae393000e790234ff3033f57673f1a5569194cf447551ff92be51f0982a2fab39da92ed21ebe175b8fbdd6d10663f56ad5335441788b01bc1a9c7df8db9c566a7b8e50c515c890139458bf2ef05777a5bedcae9b49543cef90521905eb51c02ca50fdd0c338581ede0da6fd7c8ccdd0bc8a8c2681478c4b669e2a3673ccdf06de6f1c3ab857e87be47c8163e50f83ca7ccde7a6cdf3a22954eac75c62ff7ccf0b94a6b33be6a15a68cc1201b9e5b666d0fc7328360eb51b55e45d3d801c5918464602bf61f2c2e781cc33401c691951867f11ba5d64a07160492ac69422231f2c2cec8f8e881266d50e708e77d7bfc0efe17bbbd946a55af3fbb9d0f2f56f097881f9ff986b9c11103374d59da076eceed5f83adf634690fa417ed6b55181503769b033bb5865ac6204ad84de2cb404105d0d7cb33a4d4f1155ab560ce01146b5b516029efb210fca0ada6b243b4134d6017aaa3257eb90904c6a9781b549769f0b48fac737e82528f7e362ac6bd2510f42ab014158d99d691b4fc6a913e42bbea13838a5c99a7a89576cb8c573fde50a59a3dfa250c5be1b00bb2f454878051de4b82b84299e766dddd2ec1b446cc5767705ec031f36eaab4ca8a9ee79e46498561ceced443dfbdfda38619d3f6e32eb42d51b6393be511d209d6c4c49c0fdcd6eccc8292679a8f8158af5b14e7b92b562165ab2afba5c722bf8fc5eabdec29a768fa4f1b6148dbdf46d4adbb874b89683ea2bfd0f5925d0f32cb22d2bbafc3ace75eddf5b65d66de0f3aa3250f2a1836af4d132352850c09494753b6ddb22c9d0e27aebb29ee169fa1cb59dab14580ed499d4bd22e6dd4c630788cab3813b1769028924348beac0c442e00b725ba00833db8c6f18377be379e87c8cdb170b2ca130ccec23cd92994788602ce969917ff4e54fc056e55c245137fa718ad9a49def65f53b2b52ff03a6f3aa35bcc3d3f2e7cd6cc1c8f7987c8e6e31a1374636157348c8245b3e14f8514a2436bc49a0ef247d9d337990a3990a10ab2d7d464ca1077d8e724b0fa2ce9f84837cd0133ccab5159abbcc50ce92bf72ecf42d1d86275b155241540a2329842cb2e11412aebe0e9fc5b2a6d26a711a32ee6734d1bbfe98434b1dc0f6daf20434481c477c417c4c88d25180ccc52098a688cd55701fcd6ff98259449cfd5e30230b4cfa2ecb03448cbcc1900d91dc23cb0fab0cb58dda07d4323f5a34f610c139a42840a06f1110a3e1ec6ac4862c3e9bf7328cc39309b96796e4d5c4997f91fec6a841e02769391ee4073972dee7449d95413e2f1f4795f7844ae265af66ffbc5b36b3bfb0a6189a984c26bbe34b6e3e74607f3362df3ae294a4aaed208f60f11a9d73885679c1758920fef9a7304817f3371ae70842275d2267cef41afb06c2d61f2a6251a645e620df37092ba289cecacbf4d5312083e099c35a42bdab65ac8d3160f393fe2d471872773fb570d12e1b2bc679ab05dbfa8c0af0a2b145aa7bd02dd566bdfdd3b4a6dfdc1213fb8f708092dc454ab04814b2f9ca28c4dbaa8d57d649e82581e4c9ac3214a10e28562c81b72abdc84192e97d72d61eca86496ea6c820c44b10c433d141987f04ea3c7467d0e33dda3e86fd823d5241326620e9cd48242d46fdfe8b9acc0c25842d13063a338463aaf84bb40996a51bdbd904fa3b4156963df4e06ab5a730bfb2136e87860eb7eed619a9a1beccd8117ca88d4f49e7bb1f3c96bac651addb25d19a77dc7ef6b47fb4f7aa8e61acee9192eeb8a844dda1ab67fc28771e784c2a186c32013461f9cfff410c3b224c31370dd1963304868fc8c718eef0a162bbf2bf4c1a974ec47897090746f56c74b08b3706baf664d8746768cf82782e069b943bbc5556a84d742208c47b6126f2ef7ee0b28012ed50a6190fffc5e2d07e4a98bb844d968285f3d00f8096370a003c37cb9255090e96c9d97bd7e0589c24454090e5b838d5da9adbc2e4530f5192377371091e8590af4c25b927c6594e02091761ca0ca8b623b944fbb6f781e5df680983b5501f5334614f67ee8407759aa437f8ffa514a547f6e37045c813a90fdb27d0734d13afc7af2700e7bc8b8e29915f3eba438581d5aa4f29f5fe51ab267175a463993e85c0d7dbe8ee158e959b1fcd79d78c4dea820cc1f3fcf3acc100defc9117288d37e720a97618dba487490814827c0f0a9383baf1a702fa82944b4fdb821f3e3534c24dce10ca7cd0166b6e58bb801dae2d7ebf7ca9902da4e0fdfab68f427e2c75d3afc5c84dab9b415efc1a2169814adee126d73a93e05fa52ac007442131dbc8e37987ce3dc8afa9813ff2a79dc17134d40f75de56d26d628cc6f7853a618865ab4157d99699faef2da44b6f01799f186df497d5013c7953182bcef30c58647e000bdec5df7fa3b3f9817632dae1d2d67df22a91fad8027a4bb86ebd426e4bdcc50b42f335789a54428ee0110ce8b4e393048a6586e43fc8e06ac3c55ea411cda602f14c2780981eb74cf6a2b769d372092481d433a21e253ab6fba67dd1c78e40184ab5d367a953f2c0900fff9faf9cefd6f7c21fb99971605a84bc0fcb58f24fa3f68862c94c2f70702176f9fcbc2ce84102c5bb59de7d05fc01477429628bcf2a2679d1074b1d2d281322c143b38d6ea3af06d588cee772950aebb79d85d16da9eef0288381c1611d80545eb97f9f407a828e15333524590d77f861932549a93c784461cf0073fe2002b3db9009d6dacd491c54f8c0eddeab84feef1367f0be8704969ae40cf79db0e75241a2dae972d01b5f5c168aa4f0304c0987e3f068a0576d0272527426bf8c4853767a442676a0ce274744c92c8cb600e93092796330b8beb12cdf3242d1f8cc8ed2065b3486eafda743a9657786c1cfabf3d7bc08d4588b70593a18b8c971affa4b92760f8523898f7ee610b82f1a90045c124e764b16d6de7faa48c202bf983f00944c2e9d9fcceb86b47473a1e515840f38817d03c42af0db49ee799cd275d8d3c213e498901d236d7dc94cfb29b92b4b4e7a9bae1819c7e17a1017ef871886fbc231098b5f51f0ebab17cd113c9f9f9394ed41ed0e8b4d0be649a192b1c9f81610c1a40926e5087206b0fe6eb4b044320705dd859f9697c8f0391fe9f8cdee803af2481696c19776f98937b8a5f509841c6bbd63f99f58280cc00ce4e2d7eacaf918c4771536c4d4dfb500edb71183b4ffe0ef68ce7a64c04234f6d1d8250163cfaae658c78dc0eda5334b6ea0ecd8e636855b4065b0dd27e75c5ef8fdf3aa8dc5ad3a"}, @sadb_lifetime={0x4, 0x4, 0x3, 0x43c2, 0x81, 0x2}]}, 0xff8}}, 0x20000000) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=@newsa={0xec, 0x10, 0x713, 0x2, 0xffffff80, {{@in=@remote, @in6=@dev}, {@in=@remote, 0x0, 0x32}, @in=@local, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xec}, 0x1, 0x0, 0x0, 0x20008088}, 0x0) socket$inet6(0xa, 0x80000, 0x40000) 10.09119878s ago: executing program 4 (id=2474): socket(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x27c8, &(0x7f0000000540)={0x0, 0x800069ea, 0x3000, 0x3, 0x14b}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x8, 0x8, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x400c010) socket$inet6(0xa, 0x5, 0x5) msgsnd(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000089f5bf4221b4eab8e298f075c26c0cee0bc1d744d03563e5105826c5b449a570e8505e081bd6e43d0fa36a526b55d54827544e2d3bf1d3aa057eab761386e4dc8e26df007aa9c6cdf0c6f2d37e0a12237de7bfbe6f6c42ec589a67618e0a27466cfd63a1b331cf52016dff5962f5b59352b2ead223b2436172b16a41dd41f20e6a6f099dbcb49ea1e4ec8568c964528b13b718a9ba38ce734ddaec68bc10f4e9d04b8c72699f9db48e778b41b19d2ce5e2133c3ec2a9812dac22e5c78992d87a3428f6565cfa7dc32dfad20fdd056f85869178e90c59a926bab2148185745f25da0e7d4593d886ec9c2b29bc522e95c2cc217622cc6728f30d7b8a99ba11a03f3ebe00d9d9f2c62bfdf1b97e2ac940fdf746c9a1564f81cfbfbdcfb23be65db7c8240c36f2ef7d4baa1b47b4debb2169d8c2918618bca2a9a2d1904055618ce9780c1819db09c9fa3323bb0cc9921f58d3c870021bd8c918ac41ae6ee3c2a66b808d581b19569babc985c6dee6f1b567d0696e9d4de4b0f178948bbefe058aec79dd8c8a515cc6eff215178c917b99e5974075297fcc8f673366d97bbfad559320a5a76ad03b4935a0c1ec91c2ae5151d49c6e9985f6d4c5aba86f82d3f041a6e396db191eca9cd2d086859cb62d35e476bd867022d0ade6c9961130f997d025b6d5a4b71e5942096ede936ce3fa1bfa250343cb3eecbac08c0c3575f7b32d95fdc214d8bfcb60ead6c0c0aae54aa486a82edb1ece5bd41a4b4a1df4e05df84f8ee6e5c3834ef1da2ef1e622a9fae7fd989a22f9833b04ef8dbe3820ddbbb47c60f65da6ec978da1c1f678c552c8bd0f510f9fa3ecddfb1e72af117b4feb470a11b6616077dd44d506b80385b3b4f8095090e57ee1ce9e401bb2d624e702c899a5df0cd9f0b93a863aa0e8d9ec39f75d967f5b370065e2aacb803bf78d0b2560b2880667fdfed7a28bb14d99392f19978078400ecb5e46707c0dbe503376e021a3d60a6df2e7eb8959fd5b5a55f7a385075547455bfc0c8fe03af58e3a73e2d4865baa0cd8ec350072dd4d29dab4d09e9803af9120db6a36f33f2a20df4c99b9afb37ace0cf08ae6a56f1f72b4ba5daec3aae4f9a0485e38640be9b70042442249d628ad2eac61449fd1db95deedb7a1764998f94408c250ff08ff63683dd26eea00c54bb6d56999b159dfae43a923dd6f6d72e740a7a92ee100b4799e2bbb833b4e01582216a63b1c6af6da1da53bc9d9d0733113b3c4a18ccedc10bba5a47655faac2d33bf89c0aaf47568aaffbe6a4348b09c19461bc600000000f34743c058caa28a83a53108c5878d048aad64f928228a223fc71683e4391f315cdf9b9a25d9945a65670910f642eba541e8deb08a12735852a3d9641ee4bc595fdfe31c6294df99a221ecfea4f8c7870ad4587914fb84"], 0x401, 0x0) msgctl$IPC_RMID(0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000100), 0xe68d, 0x40002) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r6, 0x1, 0x1c, &(0x7f00000012c0)=""/4096, &(0x7f00000022c0)=0x1000) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = getpid() syz_pidfd_open(r8, 0x0) capset(&(0x7f0000000040)={0x20071026, r8}, &(0x7f0000000140)={0x0, 0x9, 0x0, 0x81, 0xfffffff9, 0x100a}) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) 9.99864147s ago: executing program 2 (id=2476): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000044c0)={0x14, 0x4e, 0x1, 0x70bd2b, 0xfffffffe, {0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = socket$kcm(0x29, 0x2, 0x0) setsockopt$inet_int(r4, 0x0, 0x14, 0x0, 0x0) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000280)={0x8, 0x0, r1}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e24, 0xf29, @empty, 0x1}}, 0x1, 0x2, 0x6, 0x2, 0x1, 0x25, 0xa}, &(0x7f00000004c0)=0x9c) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r6, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000340)="b9ff03076804268c989e14f088a8", 0x0, 0x40500, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = openat$dir(0xffffff9c, &(0x7f0000000000)='./file0\x00', 0x2c4202, 0x16) futimesat(r7, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={{}, {0x77359400}}) r8 = dup(r3) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x41071, 0xffffffffffffffff, 0x1a907000) ioctl$KVM_SET_VAPIC_ADDR(r8, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$SNAPSHOT_SET_SWAP_AREA(r8, 0x400c330d, &(0x7f0000000240)={0x2, 0x6}) 9.08815411s ago: executing program 4 (id=2478): pidfd_send_signal(0xffffffffffffffff, 0x30, &(0x7f0000000140)={0x11, 0x4, 0x6}, 0x0) syz_open_dev$admmidi(&(0x7f0000000000), 0x80, 0x130c42) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x12, 0x8c, 0x1}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}], 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(0xffffffffffffffff, 0x40786e88, &(0x7f0000000b80)={{&(0x7f0000000640)=[{0x627a, 0x5, 0x7fffffff, {0xf99, 0x81}, 0x92a, 0x9, 0x9}, {0x8000000000000001, 0x9, 0x7, {0x10001, 0xba1}, 0xb, 0x3ff, 0x5}, {0x6, 0x6, 0x8, {0xa, 0x5}, 0x1, 0x87, 0x101}, {0x77f8, 0x3, 0x80000000, {0x94, 0x4}, 0x370, 0x8, 0x100}, {0x8c1f, 0xfffffffffffffffe, 0x3, {0x7}, 0x44, 0x8, 0x9}], 0x5, 0x40, 0xfb, 0x6}, {&(0x7f00000007c0)=[{0x1cab, 0x3}, {0xd2f0, 0x3afb}], 0x2, 0x10, 0xe, 0xffffffff}, {&(0x7f0000000880)=[0x800, 0xfffffffffffffff7, 0xff, 0x9, 0x7fffffff, 0xe, 0x5, 0xfffffffffffffff9], 0x8, 0x8, 0x4, 0x4}, {0x0, 0x0, 0x28, 0xf}, {0x0, 0x0, 0x8, 0x7, 0x5927}}) r3 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) ioctl(r3, 0x3, &(0x7f0000000040)="053b549ff8bddeee6c90c9df18ea9637ac3fbb14af8f16a7e1c24bc397828994efcb6826b94c4094") r4 = syz_open_dev$radio(&(0x7f0000000140), 0x0, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r4, 0xc0405665, &(0x7f00000000c0)={0x0, 0x1, 0xfffffffe, 0x1000, 0x5, 0x100059a}) listen(r3, 0x9) r5 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r5, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f00000001c0)={{0x3, 0x200, 0x85c2, 0x1, 0x0, 0x4}, 0x348, [0x1, 0x84, 0x1, 0x9, 0x3, 0x9, 0xff, 0x7, 0x7, 0x0, 0x7, 0x5, 0x9c, 0x3, 0x2006, 0xb9, 0x4, 0x6, 0x6, 0x7, 0x8, 0x8, 0x9, 0x1, 0x4c1b, 0x3, 0x7, 0x9, 0x4, 0x8295, 0x80000001, 0xb5, 0x8, 0x7, 0x8, 0x6, 0x7fffffff, 0x9, 0x1, 0x2, 0x4, 0x8, 0x2, 0x5, 0x81, 0xcc88, 0x2a6f, 0x10000, 0x6a, 0x0, 0x17, 0x800, 0xfc, 0x8, 0x2, 0x400, 0x0, 0xb22, 0x6, 0xc9a, 0xfff, 0x401, 0x8, 0x9c7d, 0x5, 0x2, 0x6, 0x7fff, 0x1000000, 0x3, 0xffff8382, 0x7fffffff, 0x1ff, 0x6, 0x9, 0x8, 0x1ff, 0xfffffffa, 0x8, 0x8c, 0x7, 0x400, 0x2, 0x2, 0x10, 0x6, 0x8000, 0xd3, 0x7f, 0x16cf, 0x2, 0x8, 0x2, 0xd7b, 0x9, 0x7fff, 0xffffff5c, 0x1, 0x666, 0x0, 0x8, 0x7, 0x3, 0x3, 0x3, 0x1, 0x4, 0x368, 0x8, 0x3, 0x580, 0x2, 0x6, 0x10, 0x70955bc4, 0x1, 0x2, 0xfffffffb, 0x2, 0x2, 0x3, 0xfffff38f, 0x2, 0xa000000, 0xeb, 0x5b2, 0x4, 0x960, 0x6, 0x79, 0x3, 0x30, 0x7, 0x7, 0x1, 0x7fff, 0xf2, 0x5, 0x7, 0xff, 0x4, 0x3, 0x12e4, 0x3, 0x3, 0x101, 0x200, 0x7, 0x40, 0x0, 0x1, 0x3, 0x2, 0xffffff00, 0x702, 0x7, 0x800, 0x81, 0xfffffff7, 0x7, 0x1, 0xd, 0x40, 0x10000, 0x3, 0xffffffff, 0x23db, 0x6, 0x0, 0x5, 0x7, 0xffffffff, 0x4, 0x7, 0x6, 0x2, 0x200040, 0xb7, 0x6, 0x638, 0x0, 0x800, 0x6, 0x6, 0x0, 0x8, 0x7, 0x2, 0x8, 0x2, 0xfffffffb, 0x2, 0x80, 0xffff7fff, 0x4, 0x200, 0x7f, 0x1, 0x5, 0x9, 0x1, 0xfffffffa, 0xc, 0x50c2, 0xc1ed, 0x401, 0x3, 0x7, 0x101, 0x800, 0x5, 0x5, 0x8, 0x2a1045a2, 0x1, 0xfffffff8, 0xe9, 0x1, 0x7f, 0x7ff, 0x0, 0x7, 0xac, 0x80000000, 0x81, 0x80000001, 0x2, 0x80, 0x3ff, 0xa639, 0x0, 0x53647e6f, 0x2, 0xd792, 0x14b, 0x4, 0x3, 0xb36, 0xa, 0x1, 0x4, 0x94, 0x5f, 0x1, 0x8, 0xd8, 0x7fff, 0xf, 0x400, 0x7f, 0x80000001, 0xd08, 0x2, 0x1, 0x6, 0x9, 0x7d9, 0x1, 0x3, 0x3, 0x8, 0x6, 0x400, 0x86, 0x2, 0x1000, 0xbdf6, 0x41bf, 0xc, 0x2487005d, 0x2, 0x1, 0xaa1, 0x6, 0x80000001, 0x9, 0xe, 0x2, 0x0, 0x4, 0x401, 0x5, 0x87a0, 0xffffffff, 0x5, 0x3, 0xf, 0x7fffffff, 0x0, 0x8d, 0xe, 0x3, 0xb6, 0x5, 0x9, 0x100, 0xfff, 0x10, 0x1, 0x6, 0xb7, 0x7, 0xfffffffa, 0x4, 0x5, 0x81, 0x6, 0x5, 0xdcdf, 0x7ff, 0x9, 0xffffffe3, 0x1ff, 0x3, 0xf1c, 0x8021, 0xffffffff, 0x70, 0x10000, 0x7, 0x4, 0x1, 0x0, 0x4, 0x7aed, 0x4, 0x8, 0xe, 0xffffffc0, 0x8b7, 0x5, 0x5, 0x200, 0x40, 0x3ff, 0x6, 0x0, 0xa, 0xc, 0x7, 0xe324, 0xf, 0x20007, 0x97a, 0x7fff, 0xffffffff, 0x8, 0x7, 0x40000000, 0x7, 0x6, 0x7, 0x6f007526, 0xa, 0x80000000, 0x0, 0x200, 0xaeb, 0x315c, 0x9, 0x1000, 0xd, 0x5, 0x0, 0xf0f, 0x6, 0x20, 0x2, 0x9, 0x2, 0x9, 0x4, 0x6, 0xb37, 0x8, 0x5, 0x8, 0xa6b7, 0x10001, 0x5, 0x1, 0xf, 0x8, 0x8, 0x3ff, 0x1, 0x4, 0xbe, 0x1, 0x10001, 0x7fa, 0xe7ad, 0x4, 0x2, 0x6, 0x81, 0x10000, 0x3, 0xbd7, 0x71e5119d, 0x62, 0xffd, 0x5, 0x6, 0x4, 0xc, 0x3, 0x7, 0x3ff, 0x4, 0x400277e, 0xe1, 0x3, 0x4, 0x3, 0x4, 0x6, 0xbf, 0x7, 0x10000006, 0x8, 0x5, 0x3ff, 0x9ad9, 0x8, 0x1, 0x0, 0x3, 0x400, 0x2, 0x9, 0x6, 0x40, 0x1000, 0x82, 0x4, 0x1000, 0x8, 0x3d, 0x2, 0xe, 0x20004, 0x3, 0x1, 0x4, 0x8, 0x10, 0x6, 0x9, 0xffffffff, 0x10, 0x0, 0x1, 0x9225, 0x3be, 0xd, 0x401, 0x81, 0x13, 0x5, 0x3b1, 0x1, 0x9f18, 0x2, 0x8f86, 0x417db73f, 0x7, 0x1, 0x7, 0x5, 0x3, 0x6, 0x7, 0x2, 0xd, 0x0, 0x7, 0x7, 0x2, 0x8, 0x5, 0x0, 0xab, 0x5, 0x94, 0xb3ab, 0x5ae, 0x2, 0x40, 0x5, 0x0, 0x8001, 0x8, 0x800, 0xb, 0xa4, 0x50, 0x8, 0x99, 0x10, 0x5, 0x100, 0xfffff800, 0x5, 0xca, 0x3, 0x4, 0x6, 0x7ff, 0x6e15d2ec, 0x7, 0x5, 0x8, 0x7ba, 0x21c0, 0xe64, 0xc, 0x7, 0x6d4, 0x5, 0x3, 0x7fff, 0x121, 0x9, 0xe6d8, 0x1000, 0x1ff, 0x42db5dac, 0xffff, 0x6, 0xfffffff8, 0x3ff, 0xfcf, 0x1000, 0x7, 0x2, 0x2, 0x9, 0x7, 0x2, 0x7, 0x80000001, 0x7, 0x8, 0x7, 0xfffff000, 0xfffffffe, 0x5, 0x5, 0x7, 0x80000001, 0x4, 0x2, 0x53f, 0x8, 0x6, 0x0, 0xffff7ff8, 0x6, 0x8, 0x9, 0x8, 0x6d, 0x48, 0x8001, 0x1, 0x1, 0x2e7a, 0x8, 0x4, 0x10000, 0x5, 0x1ff, 0x4fe, 0x8, 0xfffffffd, 0xc217, 0x6, 0x59a, 0x2, 0x3, 0xba7a, 0x6d9c7f55, 0x4, 0x9, 0x1000, 0x3, 0x10001, 0x2, 0x2, 0x7, 0x6, 0x2, 0x1, 0x27a, 0x9, 0x2, 0xde26, 0x99, 0xfffffffe, 0x5, 0x1, 0xdba4b27, 0x6, 0x100, 0x0, 0x9, 0x7, 0x1, 0x7ff, 0x0, 0x2, 0xffff9369, 0x4, 0xff, 0x6, 0xed1, 0x6, 0x0, 0x3, 0x80000001, 0xe, 0x9, 0x1, 0xffff, 0x6, 0x9, 0x4, 0xef3, 0x1, 0xfffffffb, 0x7, 0x40, 0x6, 0x4, 0x9, 0x7f, 0x5, 0x1, 0x3, 0x2, 0xc15e, 0x6, 0x0, 0x6, 0x8, 0xffffffff, 0x8, 0x401, 0x0, 0x10, 0x3, 0x2, 0x4, 0x50d, 0xd5, 0x4b, 0x7, 0x0, 0x2, 0x75, 0x80, 0x1, 0xdb, 0x401, 0x5, 0x1, 0x3, 0x6, 0xbf0d, 0x18, 0x1, 0x5, 0x95, 0x7fff, 0xe7, 0xa, 0x4, 0x0, 0xffffff16, 0x10, 0xae25, 0x908, 0x78e, 0x6, 0x1, 0xb2b7, 0xc, 0x7, 0x0, 0x5, 0x9, 0x8, 0x73, 0x9, 0xfffffffe, 0x5df, 0x1, 0x7, 0x81, 0xffffffaa, 0x3, 0x6, 0xd, 0xffffc4e6, 0xffff0001, 0x0, 0x5, 0x10001, 0x2, 0x3, 0x0, 0x6, 0x4, 0x3, 0x8, 0x3, 0x8, 0x5, 0x3, 0xc3f, 0x0, 0x2, 0x6, 0x6, 0xaed, 0x4, 0xed4, 0x7, 0x7, 0x8, 0xff, 0x8001, 0x5, 0x9, 0x4, 0xc2, 0x80000000, 0x80000000, 0x4, 0x8, 0xab84, 0xb4, 0xfffffc00, 0x908b, 0x8, 0xc9, 0xfffffffe, 0x1, 0x3, 0x8, 0xfffffffb, 0x0, 0xf8, 0xfffffff0, 0x637, 0x6, 0x4, 0xa, 0x80, 0xfffffff9, 0xfffffb6f, 0x0, 0x120e, 0x7, 0x0, 0x6, 0x2, 0x1000, 0xa, 0x6, 0x2, 0xd, 0x3ff, 0x5e18, 0xf, 0x9ebe, 0x7, 0x2, 0x1, 0x7, 0x7, 0x9e, 0x8, 0xedd3, 0x9, 0xffffffff, 0xffffffff, 0x5, 0x1ff, 0x8, 0x1, 0x5, 0x2, 0x40, 0xe, 0x4, 0xc, 0xc65, 0x40, 0x7, 0xbb7d, 0x10, 0x2, 0x1ff, 0x8, 0x6, 0x80, 0x2, 0xf, 0x7, 0x80000000, 0x6e0, 0x1, 0x5, 0xd1, 0x9, 0x8, 0xfffffe00, 0x0, 0xfffffffe, 0x4, 0xe449, 0x4, 0x40, 0x4, 0x1000, 0x0, 0xca, 0xffff, 0x10001, 0xfffff891, 0x2, 0xfe, 0x200, 0xffffff81, 0xfffffff8, 0x4, 0x101, 0x68f0, 0xbfb, 0xdfe2, 0x0, 0x4, 0x9e74, 0xa, 0x7, 0x3ff, 0x80, 0xde7, 0x5, 0x51, 0x0, 0xb, 0x3, 0xad, 0x8, 0x2, 0x1, 0x8000, 0x4, 0x7, 0x8, 0x4, 0x10, 0x80000000, 0x6, 0x1400000, 0xf7, 0x8, 0x81, 0x4, 0x6790, 0x9, 0xfa6, 0x400, 0x7f, 0x3ff, 0x4, 0x2, 0x9, 0x6, 0x9107, 0x1, 0xcac, 0x40, 0x7, 0xc, 0x1, 0x5, 0x7, 0xb923, 0x2, 0xffff3818, 0x3, 0x1, 0x5, 0xe39, 0x4, 0x6, 0x7ff, 0xfff, 0x5, 0x5, 0x1, 0x101, 0xfffffff9, 0x3, 0x1, 0x400, 0xe59, 0x6, 0x8, 0x3ff, 0x6, 0x3ff, 0x9, 0x2, 0x6, 0x12dd, 0x0, 0x10, 0x6, 0x40, 0x0, 0xffffff80, 0x3, 0x0, 0x1, 0x7, 0x997, 0x7, 0x7fffffff, 0x81, 0x1, 0xe, 0x7e, 0x9, 0x3, 0x5, 0x7c, 0x4, 0x9, 0x3, 0x0, 0x1ff, 0x4, 0x926a, 0x9, 0x6, 0xea, 0x9, 0x9, 0xc0000, 0xf4d, 0x80000001, 0x1, 0x2, 0x1, 0x3, 0x7fff, 0x3, 0x1, 0x5851, 0x9fc, 0x0, 0x6, 0xcf4, 0x6, 0x1, 0xffb8, 0x0, 0x10001, 0x7, 0x8, 0x7b, 0x6, 0x89, 0xfffc0000, 0x9, 0x1, 0x4, 0xb, 0x9, 0x3, 0x5, 0xc2, 0x5, 0x2, 0x9, 0x3, 0x2c33, 0x5, 0x4, 0x0, 0x5, 0x9, 0x1, 0xa, 0x819, 0x5, 0x4, 0x7, 0xb, 0x5, 0x8000, 0xffff, 0x8, 0x7fff, 0xe, 0x3, 0x6, 0xffffffff, 0x7, 0xba, 0x1, 0x2, 0xc7c, 0x8, 0xdc, 0x3, 0x5, 0x9, 0x1]}) r6 = openat$vicodec0(0xffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0185648, &(0x7f0000000080)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f909, 0x8002, '\x00', @p_u16=&(0x7f00000010c0)=0xa5b}}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000"], 0x66) 5.703281687s ago: executing program 2 (id=2482): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0x64eb, &(0x7f0000000400)={0x0, 0x5b5f, 0x50000, 0x2, 0x51}, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000005c0)=@IORING_OP_SOCKET={0x2d, 0x8, 0x0, 0x405, 0xfffffffffffffff8, 0x0, 0x3, 0x0, 0x0, {0x0, 0x0, 0xff}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, &(0x7f0000000040)="f30f1ecd65f3ff9dd4a7260f01c9f3360f30670f01ca0f01fa8146051900baf80c66b8fa8ecd8c66efbafc0cb8f64aefdbe03e26660f38825f47", 0x3a}], 0x1, 0x5b, 0x0, 0x0) r5 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYRES16=r8, @ANYBLOB="01ffffff7f00000000006700080008000300", @ANYRES32=r10, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x1ff, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x80000002, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0x45c5, 0xc595, 0x7, 0x102, 0x3, 0x2000000000000000, 0x80000004000000, 0xc], 0xeeee0000, 0x80}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 5.338323871s ago: executing program 5 (id=2486): socket(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x27c8, &(0x7f0000000540)={0x0, 0x800069ea, 0x3000, 0x3, 0x14b}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x8, 0x8, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x400c010) socket$inet6(0xa, 0x5, 0x5) msgsnd(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000089f5bf4221b4eab8e298f075c26c0cee0bc1d744d03563e5105826c5b449a570e8505e081bd6e43d0fa36a526b55d54827544e2d3bf1d3aa057eab761386e4dc8e26df007aa9c6cdf0c6f2d37e0a12237de7bfbe6f6c42ec589a67618e0a27466cfd63a1b331cf52016dff5962f5b59352b2ead223b2436172b16a41dd41f20e6a6f099dbcb49ea1e4ec8568c964528b13b718a9ba38ce734ddaec68bc10f4e9d04b8c72699f9db48e778b41b19d2ce5e2133c3ec2a9812dac22e5c78992d87a3428f6565cfa7dc32dfad20fdd056f85869178e90c59a926bab2148185745f25da0e7d4593d886ec9c2b29bc522e95c2cc217622cc6728f30d7b8a99ba11a03f3ebe00d9d9f2c62bfdf1b97e2ac940fdf746c9a1564f81cfbfbdcfb23be65db7c8240c36f2ef7d4baa1b47b4debb2169d8c2918618bca2a9a2d1904055618ce9780c1819db09c9fa3323bb0cc9921f58d3c870021bd8c918ac41ae6ee3c2a66b808d581b19569babc985c6dee6f1b567d0696e9d4de4b0f178948bbefe058aec79dd8c8a515cc6eff215178c917b99e5974075297fcc8f673366d97bbfad559320a5a76ad03b4935a0c1ec91c2ae5151d49c6e9985f6d4c5aba86f82d3f041a6e396db191eca9cd2d086859cb62d35e476bd867022d0ade6c9961130f997d025b6d5a4b71e5942096ede936ce3fa1bfa250343cb3eecbac08c0c3575f7b32d95fdc214d8bfcb60ead6c0c0aae54aa486a82edb1ece5bd41a4b4a1df4e05df84f8ee6e5c3834ef1da2ef1e622a9fae7fd989a22f9833b04ef8dbe3820ddbbb47c60f65da6ec978da1c1f678c552c8bd0f510f9fa3ecddfb1e72af117b4feb470a11b6616077dd44d506b80385b3b4f8095090e57ee1ce9e401bb2d624e702c899a5df0cd9f0b93a863aa0e8d9ec39f75d967f5b370065e2aacb803bf78d0b2560b2880667fdfed7a28bb14d99392f19978078400ecb5e46707c0dbe503376e021a3d60a6df2e7eb8959fd5b5a55f7a385075547455bfc0c8fe03af58e3a73e2d4865baa0cd8ec350072dd4d29dab4d09e9803af9120db6a36f33f2a20df4c99b9afb37ace0cf08ae6a56f1f72b4ba5daec3aae4f9a0485e38640be9b70042442249d628ad2eac61449fd1db95deedb7a1764998f94408c250ff08ff63683dd26eea00c54bb6d56999b159dfae43a923dd6f6d72e740a7a92ee100b4799e2bbb833b4e01582216a63b1c6af6da1da53bc9d9d0733113b3c4a18ccedc10bba5a47655faac2d33bf89c0aaf47568aaffbe6a4348b09c19461bc600000000f34743c058caa28a83a53108c5878d048aad64f928228a223fc71683e4391f315cdf9b9a25d9945a65670910f642eba541e8deb08a12735852a3d9641ee4bc595fdfe31c6294df99a221ecfea4f8c7870ad4587914fb84"], 0x401, 0x0) msgctl$IPC_RMID(0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000100), 0xe68d, 0x40002) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r6, 0x1, 0x1c, &(0x7f00000012c0)=""/4096, &(0x7f00000022c0)=0x1000) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = getpid() syz_pidfd_open(r8, 0x0) capset(&(0x7f0000000040)={0x20071026, r8}, &(0x7f0000000140)={0x0, 0x9, 0x0, 0x81, 0xfffffff9, 0x100a}) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) 5.110455239s ago: executing program 2 (id=2487): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000340)={0x200000, 0x1200000, 0x0, 0x0, 0x5989}) setpriority(0x1, 0x0, 0x3) r1 = syz_io_uring_setup(0x60ef, &(0x7f0000000180)={0x0, 0xcc19, 0x130c8, 0x6, 0x39d}, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) write$cgroup_devices(0xffffffffffffffff, 0x0, 0xa) socket$vsock_stream(0x28, 0x1, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x311080, 0x1e7) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000240)=0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@dellink={0x28, 0x11, 0x1, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1092, 0x40000}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r4 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f00000007c0)={0x0, @bt={0xa8c, 0x870, 0x1, 0xdf9e32a0640bc3f8, 0xd59f82, 0x19f5, 0xacc, 0xb, 0x0, 0x8, 0x27fd, 0x7fff, 0x440, 0x3, 0xd, 0x22, {0x45, 0x80}, 0xcd, 0x3}}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f8, 0x0, 0x940c, 0x3002, 0x230, 0x2c0, 0x230, 0x3d8, 0x3d8, 0x230, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0xec, 0x114, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x4b6f99de057c03ca}}, @inet=@rpfilter={{0x24}, {0x8}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x12d, 0x7ff, 0x2}}}, {{@ipv6={@empty, @private0={0xfc, 0x0, '\x00', 0x1}, [0xffffff00, 0xff000000, 0xffffff00, 0xff], [0xff000000, 0xffffff00, 0xffffffff, 0xff], 'vxcan1\x00', 'gretap0\x00', {}, {0xff}, 0x87, 0x75, 0x5, 0x60}, 0x0, 0xfc, 0x11c, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_virt_wifi\x00', {0x40, 0x9, 0x9, 0x0, 0xff, 0x0, 0x4, 0x20}}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0xf098ede22a3e575b) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpriority(0x2, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) ioctl$VIDIOC_PREPARE_BUF(r4, 0xc04c565d, 0x0) sendto$inet6(r7, 0x0, 0x0, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000180)={0x0, 0x1, 0x12, 0x6, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309002500000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc60efd680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca512b5f379c4eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7f804bb4713019a83353dc519d11c3cc1c22a3b86cf3c645413fcea0ce9ded703699d2bb6a4a663b99b6069da5aaf64785a58847440f064b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200216032811fadcf1e0f49a514df529061e09ce45e3f303a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a250200000000000000d23d324205000000000000000a617f22133b6cb5087f4c6057942ad995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a3cff46591ccaff3075b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8841416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedcbefc5990d7fed29a002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d559b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756d732533c2722e03002293e37966611602f297de6ff5408777d7a93c45cee3ee5c56e8a3e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f6579ef62866a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c909cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc562507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f80000000000001700000000000000000000000000000000000200"}) ioctl$F2FS_IOC_START_ATOMIC_WRITE(0xffffffffffffffff, 0xf501, 0x0) 4.280592639s ago: executing program 5 (id=2488): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x9) ioctl$TIOCNXCL(r2, 0x540d) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x7, 0x0, 0x1], 0x8080000}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x5, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4001}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newtfilter={0x60, 0x2c, 0xd2b, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x2c, 0x2, [@TCA_U32_ACT={0x4}, @TCA_U32_SEL={0x24, 0x5, {0x8, 0x7, 0x1, 0x3d3f, 0x0, 0x3, 0x3, 0x58f, [{0x2, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x60}, 0x1, 0x0, 0x0, 0x1}, 0x24040084) sendmsg$nl_route(r2, &(0x7f0000000540)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="480000004800040027bd7000ffdbdf250a008000", @ANYRES32=r4, @ANYBLOB="020000000800020027000000080002000000000014000100fe880000000500000000000000559f5c1b16000000000108087888bff190512f872f"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x80) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'syz_tun\x00'}) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r6, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) timer_create(0x3, &(0x7f0000000080)={0x0, 0x40, 0x4, @thr={0x0, 0x0}}, 0x0) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000002a80)={0x1, 0x0, [{0x0, 0x106, &(0x7f0000002700)=""/262}]}) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r6, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000000500)=""/4092}) ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, &(0x7f0000000000)=0x1) 4.096615478s ago: executing program 2 (id=2490): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000044c0)={0x14, 0x4e, 0x1, 0x70bd2b, 0xfffffffe, {0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = socket$kcm(0x29, 0x2, 0x0) setsockopt$inet_int(r4, 0x0, 0x14, 0x0, 0x0) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000280)={0x8, 0x0, r1}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e24, 0xf29, @empty, 0x1}}, 0x1, 0x2, 0x6, 0x2, 0x1, 0x25, 0xa}, &(0x7f00000004c0)=0x9c) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r6, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000340)="b9ff03076804268c989e14f088a8", 0x0, 0x40500, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = openat$dir(0xffffff9c, &(0x7f0000000000)='./file0\x00', 0x2c4202, 0x16) futimesat(r7, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={{}, {0x77359400}}) r8 = dup(r3) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x41071, 0xffffffffffffffff, 0x1a907000) ioctl$KVM_SET_VAPIC_ADDR(r8, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$SNAPSHOT_SET_SWAP_AREA(r8, 0x400c330d, &(0x7f0000000240)={0x2, 0x6}) 2.979567009s ago: executing program 1 (id=2491): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = inotify_init() r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x270}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1}) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x145}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ff9000/0x4000)=nil) close_range(r0, 0xffffffffffffffff, 0x0) personality(0xfe47fef9f5ff7379) syz_emit_ethernet(0x46, &(0x7f0000000240)={@link_local={0x3, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x64, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0xea452954ff7d0934, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @empty, @empty}, "001863718e9bf703"}}}}}, 0x0) 2.810448334s ago: executing program 5 (id=2492): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@FRA_GENERIC_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="2e00000011008188040f46ecdb4cb9cca7480ef410000000e3bd6efb440009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x40840) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_ublk_setup_io_uring(0x3650, &(0x7f0000000200)={0x0, 0x7853, 0x8, 0x2, 0x276}, &(0x7f0000000280), &(0x7f0000000340), &(0x7f00000003c0)) r5 = syz_ublk_setup_io_uring(0x1fca, &(0x7f0000000040)={0x0, 0x9b2f, 0x80, 0xfffffffd, 0x116, 0x0, r4}, &(0x7f0000000140)=0x0, &(0x7f0000000380)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xfffffffffffffffb, &(0x7f00000000c0), 0x1, 0x40}) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000800)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x98c8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x4, 0x412, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1e0}}}, 0x0) syz_io_uring_complete(r6, r7) syz_ublk_add_dev(r5, r6, r7, r8, 0x0, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r9, 0xc008ae88, &(0x7f00000005c0)={0x2, 0x0, [{0x40000010, 0x0, 0x6}, {0x179, 0x0, 0x2}]}) 2.645839729s ago: executing program 1 (id=2493): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000003300), 0x40002, 0x0) write$rfkill(r0, &(0x7f00000000c0)={0x0, 0x2, 0x3, 0xfe, 0x1}, 0x8) 2.564761626s ago: executing program 1 (id=2495): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0x64eb, &(0x7f0000000400)={0x0, 0x5b5f, 0x50000, 0x2, 0x51}, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000005c0)=@IORING_OP_SOCKET={0x2d, 0x8, 0x0, 0x405, 0xfffffffffffffff8, 0x0, 0x3, 0x0, 0x0, {0x0, 0x0, 0xff}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, &(0x7f0000000040)="f30f1ecd65f3ff9dd4a7260f01c9f3360f30670f01ca0f01fa8146051900baf80c66b8fa8ecd8c66efbafc0cb8f64aefdbe03e26660f38825f47", 0x3a}], 0x1, 0x5b, 0x0, 0x0) r5 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES16=r8, @ANYBLOB="01ffffff7f00000000006700080008000300", @ANYRES32=r10, @ANYBLOB="0800c300741300000800c40001"], 0x30}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x1ff, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x80000002, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0x45c5, 0xc595, 0x7, 0x102, 0x3, 0x2000000000000000, 0x80000004000000, 0xc], 0xeeee0000, 0x80}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2.389533394s ago: executing program 4 (id=2496): socket(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x27c8, &(0x7f0000000540)={0x0, 0x800069ea, 0x3000, 0x3, 0x14b}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x8, 0x8, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x400c010) socket$inet6(0xa, 0x5, 0x5) msgsnd(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000089f5bf4221b4eab8e298f075c26c0cee0bc1d744d03563e5105826c5b449a570e8505e081bd6e43d0fa36a526b55d54827544e2d3bf1d3aa057eab761386e4dc8e26df007aa9c6cdf0c6f2d37e0a12237de7bfbe6f6c42ec589a67618e0a27466cfd63a1b331cf52016dff5962f5b59352b2ead223b2436172b16a41dd41f20e6a6f099dbcb49ea1e4ec8568c964528b13b718a9ba38ce734ddaec68bc10f4e9d04b8c72699f9db48e778b41b19d2ce5e2133c3ec2a9812dac22e5c78992d87a3428f6565cfa7dc32dfad20fdd056f85869178e90c59a926bab2148185745f25da0e7d4593d886ec9c2b29bc522e95c2cc217622cc6728f30d7b8a99ba11a03f3ebe00d9d9f2c62bfdf1b97e2ac940fdf746c9a1564f81cfbfbdcfb23be65db7c8240c36f2ef7d4baa1b47b4debb2169d8c2918618bca2a9a2d1904055618ce9780c1819db09c9fa3323bb0cc9921f58d3c870021bd8c918ac41ae6ee3c2a66b808d581b19569babc985c6dee6f1b567d0696e9d4de4b0f178948bbefe058aec79dd8c8a515cc6eff215178c917b99e5974075297fcc8f673366d97bbfad559320a5a76ad03b4935a0c1ec91c2ae5151d49c6e9985f6d4c5aba86f82d3f041a6e396db191eca9cd2d086859cb62d35e476bd867022d0ade6c9961130f997d025b6d5a4b71e5942096ede936ce3fa1bfa250343cb3eecbac08c0c3575f7b32d95fdc214d8bfcb60ead6c0c0aae54aa486a82edb1ece5bd41a4b4a1df4e05df84f8ee6e5c3834ef1da2ef1e622a9fae7fd989a22f9833b04ef8dbe3820ddbbb47c60f65da6ec978da1c1f678c552c8bd0f510f9fa3ecddfb1e72af117b4feb470a11b6616077dd44d506b80385b3b4f8095090e57ee1ce9e401bb2d624e702c899a5df0cd9f0b93a863aa0e8d9ec39f75d967f5b370065e2aacb803bf78d0b2560b2880667fdfed7a28bb14d99392f19978078400ecb5e46707c0dbe503376e021a3d60a6df2e7eb8959fd5b5a55f7a385075547455bfc0c8fe03af58e3a73e2d4865baa0cd8ec350072dd4d29dab4d09e9803af9120db6a36f33f2a20df4c99b9afb37ace0cf08ae6a56f1f72b4ba5daec3aae4f9a0485e38640be9b70042442249d628ad2eac61449fd1db95deedb7a1764998f94408c250ff08ff63683dd26eea00c54bb6d56999b159dfae43a923dd6f6d72e740a7a92ee100b4799e2bbb833b4e01582216a63b1c6af6da1da53bc9d9d0733113b3c4a18ccedc10bba5a47655faac2d33bf89c0aaf47568aaffbe6a4348b09c19461bc600000000f34743c058caa28a83a53108c5878d048aad64f928228a223fc71683e4391f315cdf9b9a25d9945a65670910f642eba541e8deb08a12735852a3d9641ee4bc595fdfe31c6294df99a221ecfea4f8c7870ad4587914fb84"], 0x401, 0x0) msgctl$IPC_RMID(0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000100), 0xe68d, 0x40002) ioctl$SCSI_IOCTL_DOORLOCK(r5, 0x5380) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r6, 0x1, 0x1c, &(0x7f00000012c0)=""/4096, &(0x7f00000022c0)=0x1000) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = getpid() syz_pidfd_open(r8, 0x0) capset(&(0x7f0000000040)={0x20071026, r8}, &(0x7f0000000140)={0x0, 0x9, 0x0, 0x81, 0xfffffff9, 0x100a}) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) 2.126383256s ago: executing program 1 (id=2497): r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) write$binfmt_register(r0, &(0x7f0000000140)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x3, 0x3a, 'lowe\xf2dir', 0x3a, 'workdir', 0x3a, './file0'}, 0x36) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x8, &(0x7f0000000040)=0xffffffffffffffff, 0x57) semget$private(0x0, 0x207, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000200000000000000000020008500000097000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001000080850000007300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2}, 0x94) r2 = fsopen(&(0x7f0000000240)='tracefs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000280)='gid', &(0x7f0000000040)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xeaEb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D\xde\x1e-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\x98\xf2\x1e\xe4\'U\xb3\xf8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\r\x00\x00\x00\x86N\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xff\x01\x00\x00\x00\x00\x00\x00\x96t\\\x0f\x12C\xf0\xe5C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\x8e\xa8\x10\x94JmDv\xcc^\xf1\xc4g\xd6,\x1e\xa0\xcc\xbf\xfd\x97\v\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1\tf>>\xb5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x97\xc0\xf6\x0e\x00\x00\x00\x00\x00\x00\x00\xf9\xdcaA\x95\x9fUjHo\x93\xa0jh:\xe3\xa9\xd0:&\f\xb2VK=c&!92\xb8@A\x9eb\xab\xbd\xf8#,\x8e\x86T_\xc4\x88\x9b\x11vC\x14\x99j\x01R \xeb\xaaa\xaab\xe4B\x88jST\xfbt \x85\x13\xc73', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x100000000000000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) io_setup(0x6, &(0x7f0000001380)=0x0) io_submit(r4, 0x1, &(0x7f0000000340)=[&(0x7f0000000300)={0x1000000, 0x0, 0x0, 0x5, 0x8081, r3, 0x0}]) r5 = accept4$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14, 0x800) accept4$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14, 0x800) r6 = fspick(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r7, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000380)=""/86, 0x0, 0x4}) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x65) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r7, 0x4008af03, &(0x7f0000003980)) ioctl$VHOST_VSOCK_SET_RUNNING(r7, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r7, 0x4008af04, &(0x7f0000000040)) 1.702832038s ago: executing program 1 (id=2498): syz_emit_ethernet(0x2a, &(0x7f0000000100)={@broadcast, @local, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @broadcast, @multicast1, @random="8528d5915819", @private=0x2}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x25104000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="611570007400000061136c0000000000bfa000000000000007000000ee0016055e03010000000000160500000007000069163e0000000000bf0700000000000026050700fcffffff6706000020000000140600000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ace0600006e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc0da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000815266b2c9e1bfadc7498e9dda5d000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23480b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2334ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7149ea979cab2ee65cf7ffa29152b7a8fed89575e6e6fd77d4d9463d21775abac886ee6a1f2d7d8523840438a73d6307a87e2f525867fc3af7ab74520a773ae26bae74cdd405a211e8833e1ba523cde51d04a7ca6732"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) 1.702435303s ago: executing program 5 (id=2499): socket(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x27c8, &(0x7f0000000540)={0x0, 0x800069ea, 0x3000, 0x3, 0x14b}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x8, 0x8, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x400c010) socket$inet6(0xa, 0x5, 0x5) r5 = msgget$private(0x0, 0x40) msgsnd(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000089f5bf4221b4eab8e298f075c26c0cee0bc1d744d03563e5105826c5b449a570e8505e081bd6e43d0fa36a526b55d54827544e2d3bf1d3aa057eab761386e4dc8e26df007aa9c6cdf0c6f2d37e0a12237de7bfbe6f6c42ec589a67618e0a27466cfd63a1b331cf52016dff5962f5b59352b2ead223b2436172b16a41dd41f20e6a6f099dbcb49ea1e4ec8568c964528b13b718a9ba38ce734ddaec68bc10f4e9d04b8c72699f9db48e778b41b19d2ce5e2133c3ec2a9812dac22e5c78992d87a3428f6565cfa7dc32dfad20fdd056f85869178e90c59a926bab2148185745f25da0e7d4593d886ec9c2b29bc522e95c2cc217622cc6728f30d7b8a99ba11a03f3ebe00d9d9f2c62bfdf1b97e2ac940fdf746c9a1564f81cfbfbdcfb23be65db7c8240c36f2ef7d4baa1b47b4debb2169d8c2918618bca2a9a2d1904055618ce9780c1819db09c9fa3323bb0cc9921f58d3c870021bd8c918ac41ae6ee3c2a66b808d581b19569babc985c6dee6f1b567d0696e9d4de4b0f178948bbefe058aec79dd8c8a515cc6eff215178c917b99e5974075297fcc8f673366d97bbfad559320a5a76ad03b4935a0c1ec91c2ae5151d49c6e9985f6d4c5aba86f82d3f041a6e396db191eca9cd2d086859cb62d35e476bd867022d0ade6c9961130f997d025b6d5a4b71e5942096ede936ce3fa1bfa250343cb3eecbac08c0c3575f7b32d95fdc214d8bfcb60ead6c0c0aae54aa486a82edb1ece5bd41a4b4a1df4e05df84f8ee6e5c3834ef1da2ef1e622a9fae7fd989a22f9833b04ef8dbe3820ddbbb47c60f65da6ec978da1c1f678c552c8bd0f510f9fa3ecddfb1e72af117b4feb470a11b6616077dd44d506b80385b3b4f8095090e57ee1ce9e401bb2d624e702c899a5df0cd9f0b93a863aa0e8d9ec39f75d967f5b370065e2aacb803bf78d0b2560b2880667fdfed7a28bb14d99392f19978078400ecb5e46707c0dbe503376e021a3d60a6df2e7eb8959fd5b5a55f7a385075547455bfc0c8fe03af58e3a73e2d4865baa0cd8ec350072dd4d29dab4d09e9803af9120db6a36f33f2a20df4c99b9afb37ace0cf08ae6a56f1f72b4ba5daec3aae4f9a0485e38640be9b70042442249d628ad2eac61449fd1db95deedb7a1764998f94408c250ff08ff63683dd26eea00c54bb6d56999b159dfae43a923dd6f6d72e740a7a92ee100b4799e2bbb833b4e01582216a63b1c6af6da1da53bc9d9d0733113b3c4a18ccedc10bba5a47655faac2d33bf89c0aaf47568aaffbe6a4348b09c19461bc600000000f34743c058caa28a83a53108c5878d048aad64f928228a223fc71683e4391f315cdf9b9a25d9945a65670910f642eba541e8deb08a12735852a3d9641ee4bc595fdfe31c6294df99a221ecfea4f8c7870ad4587914fb84"], 0x401, 0x0) msgctl$IPC_RMID(r5, 0x0) 1.480261287s ago: executing program 4 (id=2500): r0 = syz_open_dev$loop(&(0x7f00000005c0), 0x35e, 0x28801) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000580)=0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r5, 0x84, 0xc, &(0x7f00000000c0), 0x4) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r5, 0x84, 0xf, &(0x7f00000043c0)={0x0, @in={{0x2, 0x4e24, @private=0xa010101}}, 0x9, 0x8, 0x4, 0xfffff43e, 0x97}, &(0x7f0000004480)=0x98) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r4, 0x2000) write$binfmt_aout(r4, 0x0, 0xffffffdb) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000840)={r4, 0x20, &(0x7f0000000800)={&(0x7f0000000680)=""/189, 0xbd, 0x0, &(0x7f0000000740)=""/146, 0x92}}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x4, &(0x7f0000000300)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, r2, 0x0, 0x0, 0x0, 0x0}, 0xfffffffffffffc85) r8 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000040)=r7, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x1f4, 0xe, 0x0, &(0x7f0000000240)="ff410800b083dcc1010b3efc8864", 0x0, 0x300, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x4}, 0x50) syz_80211_inject_frame(0x0, 0x0, 0x47) syz_emit_vhci(&(0x7f0000000a00)=ANY=[@ANYRES64=r4], 0x22) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="0405e2"], 0x7) syz_genetlink_get_family_id$wireguard(&(0x7f00000001c0), r1) memfd_create(&(0x7f0000000340)='%\x00#D)\xdeA\x02\n,\x06\x89\x96\x8f\xd3F\x9fe\xf7\x9f\x9f\x0f\xeb\v\xc3\x86c\xe7\xc6\x88\xce%0\x05\x9d4M\tH\x89m\x14>4\xe4\xb4m\fF\xaf\x9d&\x05\xcf\xc1HZ\x9a\xa3X\xaa;t\x12\'\xf5\x18PvY\xbe\xd1J6\xd9\xa6\xec\xde\xd4\xb9I5\x1a\xc6S\x14\x18]K\xe0\xef\x97Vv\xbe\x8a\xffG\xc79\x9d\x19\x10\x8c\xb2\xe0` >D\x11*V\xb9\xcfi\x03FnU\t|b\xbe\x10\xc4\xd4\x01\xb2=\x11%\xd0`-\xe2\x1d\x8e\x7f\xd1\x15\x03\xa5(\x1e\x05H\xe8\'[0\xc2\vO\xdc\xf8?QT[8:f\xe9f\x9b\xd3\xe2:\xa2b\xa3\x89\n\x9d\n\xe2\xb7\xf6\xa6\xbe\x82]YF\x90\x8e\xde\xbd\xb1w\xf7\x15\xed\xd8\xea\xa8\xef\xfbM\x82oX\x80~\xe3\x1fH\xf4\x99\xa4\xd2E\'@\xab\x13\x94\xc2\xef\x81R\xbd\xaah\xd2D\xce\x1f\'\x8b9\xa5\x88\xf1C\x1a\a!\x95\x165RS1\x9e[\xf4\xa9v\xfah\xb7\xd8\x9c&\x85\xcbs\xad\x14\xf5\xd5\xd7M\x06\x15\x9d\xa2\xfb\xfc\x9c\x94`x\xdfma\xa6\x04\x06\xcb\xeb\vC{b\xceW3l\x8a\x9cO\"\xb5\xeb#\x03k\xe4\x99\xeb\xe3\x9d\xba\xd0\xb5\x0fh\xf2\xdc\x01\x81\xb48\xea\xaf\xd0*\x9c\x1d\xba,;\x17\xfb\x94M1\xea\x1f\xbf', 0x3) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x0, 0x0}) syz_open_dev$mouse(0x0, 0x0, 0x2042) openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) setuid(0xee01) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="090000000000000000000000009a000000000002", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000aad7d521c449984c334c6a1cd37df511d84a3d9932846debecd703e866da3e4d2a63617b1555de0c4ac9737c465b9603d0485b9efe46f7fd773aaa2413166bd9fe76f4a1fca095d5203c26987a7d0c6f3039f3bc73e2211a0953f1662656cd4081cb7e7bc57b18ec13b62d114c1a0c9443525db1b62b2135faf99c49ed0ab5b1f7435a3938141fad8356979ffdb03646eef27b6fe5c032891ffa9a1d9c0adbf269ad129b9060e9ec0c8f91e18fef890e69729ba7d9794dea7606c8eb99f5a2d61c32aa3e2ca47f8c3ffa441d2627d4bb8250e5d00d5c68fd9540e81f3513b4dc0a374ed9945aed41c609ddaf2b6a76f03e824a05b919a96fe1c6ed651e6d362fdb3180f3d3df3b64ddf48a5dfc9d483d14b02fbb264ba7d49c9d580c769eda6dc5bc423dce4731880000000000", @ANYRES32=r8, @ANYRES32, @ANYRES64=0x0], 0x50) r9 = socket$inet(0x2, 0x5, 0x0) setsockopt$inet_opts(r9, 0x0, 0x4, &(0x7f0000000080)="441f08b67dd3f707c94e026591ee54be34042074fa27c1c60477cef3e2", 0x1d) 594.576225ms ago: executing program 5 (id=2501): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$6lowpan_enable(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}]}}]}, 0x3c}}, 0x20004055) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) 391.179246ms ago: executing program 5 (id=2502): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000003300), 0x40002, 0x0) write$rfkill(r0, &(0x7f00000000c0)={0x0, 0x2, 0x3, 0xfe, 0x1}, 0x8) 390.515107ms ago: executing program 1 (id=2503): pidfd_send_signal(0xffffffffffffffff, 0x30, &(0x7f0000000140)={0x11, 0x4, 0x6}, 0x0) syz_open_dev$admmidi(&(0x7f0000000000), 0x80, 0x130c42) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x12, 0x8c, 0x1}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}], 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(0xffffffffffffffff, 0x40786e88, &(0x7f0000000b80)={{&(0x7f0000000640)=[{0x627a, 0x5, 0x7fffffff, {0xf99, 0x81}, 0x92a, 0x9, 0x9}, {0x8000000000000001, 0x9, 0x7, {0x10001, 0xba1}, 0xb, 0x3ff, 0x5}, {0x6, 0x6, 0x8, {0xa, 0x5}, 0x1, 0x87, 0x101}, {0x77f8, 0x3, 0x80000000, {0x94, 0x4}, 0x370, 0x8, 0x100}, {0x8c1f, 0xfffffffffffffffe, 0x3, {0x7}, 0x44, 0x8, 0x9}], 0x5, 0x40, 0xfb, 0x6}, {&(0x7f00000007c0)=[{0x1cab, 0x3}, {0xd2f0, 0x3afb}], 0x2, 0x10, 0xe, 0xffffffff}, {&(0x7f0000000880)=[0x800, 0xfffffffffffffff7, 0xff, 0x9, 0x7fffffff, 0xe, 0x5, 0xfffffffffffffff9], 0x8, 0x8, 0x4, 0x4}, {0x0, 0x0, 0x28, 0xf}, {0x0, 0x0, 0x8, 0x7, 0x5927}}) r3 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) ioctl(r3, 0x3, &(0x7f0000000040)="053b549ff8bddeee6c90c9df18ea9637ac3fbb14af8f16a7e1c24bc397828994efcb6826b94c4094") r4 = syz_open_dev$radio(&(0x7f0000000140), 0x0, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r4, 0xc0405665, &(0x7f00000000c0)={0x0, 0x1, 0xfffffffe, 0x1000, 0x5, 0x100059a}) listen(r3, 0x9) r5 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r5, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f00000001c0)={{0x3, 0x200, 0x85c2, 0x1, 0x0, 0x4}, 0x348, [0x1, 0x84, 0x1, 0x9, 0x3, 0x9, 0xff, 0x7, 0x7, 0x0, 0x7, 0x5, 0x9c, 0x3, 0x2006, 0xb9, 0x4, 0x6, 0x6, 0x7, 0x8, 0x8, 0x9, 0x1, 0x4c1b, 0x3, 0x7, 0x9, 0x4, 0x8295, 0x80000001, 0xb5, 0x8, 0x7, 0x8, 0x6, 0x7fffffff, 0x9, 0x1, 0x2, 0x4, 0x8, 0x2, 0x5, 0x81, 0xcc88, 0x2a6f, 0x10000, 0x6a, 0x0, 0x17, 0x800, 0xfc, 0x8, 0x2, 0x400, 0x0, 0xb22, 0x6, 0xc9a, 0xfff, 0x401, 0x8, 0x9c7d, 0x5, 0x2, 0x6, 0x7fff, 0x1000000, 0x3, 0xffff8382, 0x7fffffff, 0x1ff, 0x6, 0x9, 0x8, 0x1ff, 0xfffffffa, 0x8, 0x8c, 0x7, 0x400, 0x2, 0x2, 0x10, 0x6, 0x8000, 0xd3, 0x7f, 0x16cf, 0x2, 0x8, 0x2, 0xd7b, 0x9, 0x7fff, 0xffffff5c, 0x1, 0x666, 0x0, 0x8, 0x7, 0x3, 0x3, 0x3, 0x1, 0x4, 0x368, 0x8, 0x3, 0x580, 0x2, 0x6, 0x10, 0x70955bc4, 0x1, 0x2, 0xfffffffb, 0x2, 0x2, 0x3, 0xfffff38f, 0x2, 0xa000000, 0xeb, 0x5b2, 0x4, 0x960, 0x6, 0x79, 0x3, 0x30, 0x7, 0x7, 0x1, 0x7fff, 0xf2, 0x5, 0x7, 0xff, 0x4, 0x3, 0x12e4, 0x3, 0x3, 0x101, 0x200, 0x7, 0x40, 0x0, 0x1, 0x3, 0x2, 0xffffff00, 0x702, 0x7, 0x800, 0x81, 0xfffffff7, 0x7, 0x1, 0xd, 0x40, 0x10000, 0x3, 0xffffffff, 0x23db, 0x6, 0x0, 0x5, 0x7, 0xffffffff, 0x4, 0x7, 0x6, 0x2, 0x200040, 0xb7, 0x6, 0x638, 0x0, 0x800, 0x6, 0x6, 0x0, 0x8, 0x7, 0x2, 0x8, 0x2, 0xfffffffb, 0x2, 0x80, 0xffff7fff, 0x4, 0x200, 0x7f, 0x1, 0x5, 0x9, 0x1, 0xfffffffa, 0xc, 0x50c2, 0xc1ed, 0x401, 0x3, 0x7, 0x101, 0x800, 0x5, 0x5, 0x8, 0x2a1045a2, 0x1, 0xfffffff8, 0xe9, 0x1, 0x7f, 0x7ff, 0x0, 0x7, 0xac, 0x80000000, 0x81, 0x80000001, 0x2, 0x80, 0x3ff, 0xa639, 0x0, 0x53647e6f, 0x2, 0xd792, 0x14b, 0x4, 0x3, 0xb36, 0xa, 0x1, 0x4, 0x94, 0x5f, 0x1, 0x8, 0xd8, 0x7fff, 0xf, 0x400, 0x7f, 0x80000001, 0xd08, 0x2, 0x1, 0x6, 0x9, 0x7d9, 0x1, 0x3, 0x3, 0x8, 0x6, 0x400, 0x86, 0x2, 0x1000, 0xbdf6, 0x41bf, 0xc, 0x2487005d, 0x2, 0x1, 0xaa1, 0x6, 0x80000001, 0x9, 0xe, 0x2, 0x0, 0x4, 0x401, 0x5, 0x87a0, 0xffffffff, 0x5, 0x3, 0xf, 0x7fffffff, 0x0, 0x8d, 0xe, 0x3, 0xb6, 0x5, 0x9, 0x100, 0xfff, 0x10, 0x1, 0x6, 0xb7, 0x7, 0xfffffffa, 0x4, 0x5, 0x81, 0x6, 0x5, 0xdcdf, 0x7ff, 0x9, 0xffffffe3, 0x1ff, 0x3, 0xf1c, 0x8021, 0xffffffff, 0x70, 0x10000, 0x7, 0x4, 0x1, 0x0, 0x4, 0x7aed, 0x4, 0x8, 0xe, 0xffffffc0, 0x8b7, 0x5, 0x5, 0x200, 0x40, 0x3ff, 0x6, 0x0, 0xa, 0xc, 0x7, 0xe324, 0xf, 0x20007, 0x97a, 0x7fff, 0xffffffff, 0x8, 0x7, 0x40000000, 0x7, 0x6, 0x7, 0x6f007526, 0xa, 0x80000000, 0x0, 0x200, 0xaeb, 0x315c, 0x9, 0x1000, 0xd, 0x5, 0x0, 0xf0f, 0x6, 0x20, 0x2, 0x9, 0x2, 0x9, 0x4, 0x6, 0xb37, 0x8, 0x5, 0x8, 0xa6b7, 0x10001, 0x5, 0x1, 0xf, 0x8, 0x8, 0x3ff, 0x1, 0x4, 0xbe, 0x1, 0x10001, 0x7fa, 0xe7ad, 0x4, 0x2, 0x6, 0x81, 0x10000, 0x3, 0xbd7, 0x71e5119d, 0x62, 0xffd, 0x5, 0x6, 0x4, 0xc, 0x3, 0x7, 0x3ff, 0x4, 0x400277e, 0xe1, 0x3, 0x4, 0x3, 0x4, 0x6, 0xbf, 0x7, 0x10000006, 0x8, 0x5, 0x3ff, 0x9ad9, 0x8, 0x1, 0x0, 0x3, 0x400, 0x2, 0x9, 0x6, 0x40, 0x1000, 0x82, 0x4, 0x1000, 0x8, 0x3d, 0x2, 0xe, 0x20004, 0x3, 0x1, 0x4, 0x8, 0x10, 0x6, 0x9, 0xffffffff, 0x10, 0x0, 0x1, 0x9225, 0x3be, 0xd, 0x401, 0x81, 0x13, 0x5, 0x3b1, 0x1, 0x9f18, 0x2, 0x8f86, 0x417db73f, 0x7, 0x1, 0x7, 0x5, 0x3, 0x6, 0x7, 0x2, 0xd, 0x0, 0x7, 0x7, 0x2, 0x8, 0x5, 0x0, 0xab, 0x5, 0x94, 0xb3ab, 0x5ae, 0x2, 0x40, 0x5, 0x0, 0x8001, 0x8, 0x800, 0xb, 0xa4, 0x50, 0x8, 0x99, 0x10, 0x5, 0x100, 0xfffff800, 0x5, 0xca, 0x3, 0x4, 0x6, 0x7ff, 0x6e15d2ec, 0x7, 0x5, 0x8, 0x7ba, 0x21c0, 0xe64, 0xc, 0x7, 0x6d4, 0x5, 0x3, 0x7fff, 0x121, 0x9, 0xe6d8, 0x1000, 0x1ff, 0x42db5dac, 0xffff, 0x6, 0xfffffff8, 0x3ff, 0xfcf, 0x1000, 0x7, 0x2, 0x2, 0x9, 0x7, 0x2, 0x7, 0x80000001, 0x7, 0x8, 0x7, 0xfffff000, 0xfffffffe, 0x5, 0x5, 0x7, 0x80000001, 0x4, 0x2, 0x53f, 0x8, 0x6, 0x0, 0xffff7ff8, 0x6, 0x8, 0x9, 0x8, 0x6d, 0x48, 0x8001, 0x1, 0x1, 0x2e7a, 0x8, 0x4, 0x10000, 0x5, 0x1ff, 0x4fe, 0x8, 0xfffffffd, 0xc217, 0x6, 0x59a, 0x2, 0x3, 0xba7a, 0x6d9c7f55, 0x4, 0x9, 0x1000, 0x3, 0x10001, 0x2, 0x2, 0x7, 0x6, 0x2, 0x1, 0x27a, 0x9, 0x2, 0xde26, 0x99, 0xfffffffe, 0x5, 0x1, 0xdba4b27, 0x6, 0x100, 0x0, 0x9, 0x7, 0x1, 0x7ff, 0x0, 0x2, 0xffff9369, 0x4, 0xff, 0x6, 0xed1, 0x6, 0x0, 0x3, 0x80000001, 0xe, 0x9, 0x1, 0xffff, 0x6, 0x9, 0x4, 0xef3, 0x1, 0xfffffffb, 0x7, 0x40, 0x6, 0x4, 0x9, 0x7f, 0x5, 0x1, 0x3, 0x2, 0xc15e, 0x6, 0x0, 0x6, 0x8, 0xffffffff, 0x8, 0x401, 0x0, 0x10, 0x3, 0x2, 0x4, 0x50d, 0xd5, 0x4b, 0x7, 0x0, 0x2, 0x75, 0x80, 0x1, 0xdb, 0x401, 0x5, 0x1, 0x3, 0x6, 0xbf0d, 0x18, 0x1, 0x5, 0x95, 0x7fff, 0xe7, 0xa, 0x4, 0x0, 0xffffff16, 0x10, 0xae25, 0x908, 0x78e, 0x6, 0x1, 0xb2b7, 0xc, 0x7, 0x0, 0x5, 0x9, 0x8, 0x73, 0x9, 0xfffffffe, 0x5df, 0x1, 0x7, 0x81, 0xffffffaa, 0x3, 0x6, 0xd, 0xffffc4e6, 0xffff0001, 0x0, 0x5, 0x10001, 0x2, 0x3, 0x0, 0x6, 0x4, 0x3, 0x8, 0x3, 0x8, 0x5, 0x3, 0xc3f, 0x0, 0x2, 0x6, 0x6, 0xaed, 0x4, 0xed4, 0x7, 0x7, 0x8, 0xff, 0x8001, 0x5, 0x9, 0x4, 0xc2, 0x80000000, 0x80000000, 0x4, 0x8, 0xab84, 0xb4, 0xfffffc00, 0x908b, 0x8, 0xc9, 0xfffffffe, 0x1, 0x3, 0x8, 0xfffffffb, 0x0, 0xf8, 0xfffffff0, 0x637, 0x6, 0x4, 0xa, 0x80, 0xfffffff9, 0xfffffb6f, 0x0, 0x120e, 0x7, 0x0, 0x6, 0x2, 0x1000, 0xa, 0x6, 0x2, 0xd, 0x3ff, 0x5e18, 0xf, 0x9ebe, 0x7, 0x2, 0x1, 0x7, 0x7, 0x9e, 0x8, 0xedd3, 0x9, 0xffffffff, 0xffffffff, 0x5, 0x1ff, 0x8, 0x1, 0x5, 0x2, 0x40, 0xe, 0x4, 0xc, 0xc65, 0x40, 0x7, 0xbb7d, 0x10, 0x2, 0x1ff, 0x8, 0x6, 0x80, 0x2, 0xf, 0x7, 0x80000000, 0x6e0, 0x1, 0x5, 0xd1, 0x9, 0x8, 0xfffffe00, 0x0, 0xfffffffe, 0x4, 0xe449, 0x4, 0x40, 0x4, 0x1000, 0x0, 0xca, 0xffff, 0x10001, 0xfffff891, 0x2, 0xfe, 0x200, 0xffffff81, 0xfffffff8, 0x4, 0x101, 0x68f0, 0xbfb, 0xdfe2, 0x0, 0x4, 0x9e74, 0xa, 0x7, 0x3ff, 0x80, 0xde7, 0x5, 0x51, 0x0, 0xb, 0x3, 0xad, 0x8, 0x2, 0x1, 0x8000, 0x4, 0x7, 0x8, 0x4, 0x10, 0x80000000, 0x6, 0x1400000, 0xf7, 0x8, 0x81, 0x4, 0x6790, 0x9, 0xfa6, 0x400, 0x7f, 0x3ff, 0x4, 0x2, 0x9, 0x6, 0x9107, 0x1, 0xcac, 0x40, 0x7, 0xc, 0x1, 0x5, 0x7, 0xb923, 0x2, 0xffff3818, 0x3, 0x1, 0x5, 0xe39, 0x4, 0x6, 0x7ff, 0xfff, 0x5, 0x5, 0x1, 0x101, 0xfffffff9, 0x3, 0x1, 0x400, 0xe59, 0x6, 0x8, 0x3ff, 0x6, 0x3ff, 0x9, 0x2, 0x6, 0x12dd, 0x0, 0x10, 0x6, 0x40, 0x0, 0xffffff80, 0x3, 0x0, 0x1, 0x7, 0x997, 0x7, 0x7fffffff, 0x81, 0x1, 0xe, 0x7e, 0x9, 0x3, 0x5, 0x7c, 0x4, 0x9, 0x3, 0x0, 0x1ff, 0x4, 0x926a, 0x9, 0x6, 0xea, 0x9, 0x9, 0xc0000, 0xf4d, 0x80000001, 0x1, 0x2, 0x1, 0x3, 0x7fff, 0x3, 0x1, 0x5851, 0x9fc, 0x0, 0x6, 0xcf4, 0x6, 0x1, 0xffb8, 0x0, 0x10001, 0x7, 0x8, 0x7b, 0x6, 0x89, 0xfffc0000, 0x9, 0x1, 0x4, 0xb, 0x9, 0x3, 0x5, 0xc2, 0x5, 0x2, 0x9, 0x3, 0x2c33, 0x5, 0x4, 0x0, 0x5, 0x9, 0x1, 0xa, 0x819, 0x5, 0x4, 0x7, 0xb, 0x5, 0x8000, 0xffff, 0x8, 0x7fff, 0xe, 0x3, 0x6, 0xffffffff, 0x7, 0xba, 0x1, 0x2, 0xc7c, 0x8, 0xdc, 0x3, 0x5, 0x9, 0x1]}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185648, &(0x7f0000000080)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f909, 0x8002, '\x00', @p_u16=&(0x7f00000010c0)=0xa5b}}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000"], 0x66) 0s ago: executing program 4 (id=2504): r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r0], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000004c0)={r1, 0xffffffffffffffff}, 0x4) socket$netlink(0x10, 0x3, 0x0) mount$9p_virtio(0x0, 0x0, 0x0, 0x3200006, 0x0) getpid() syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') r3 = socket$inet(0x2, 0xb, 0x8) setsockopt$sock_int(r3, 0x1, 0x5, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x5ff74c80b77e6716, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') lseek(r5, 0x2000, 0x0) socket(0x8000000010, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x48000) r7 = socket(0x840000000002, 0x3, 0x100) connect$inet(r7, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r7, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x3, 0x11, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xde, 0x0, 0x0, 0x0, 0x100}, [@call={0x85, 0x0, 0x0, 0x2e}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0xb6}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r8, 0x0, 0x10, 0x10, &(0x7f00000006c0)="0000000005000000", &(0x7f0000000700)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@noextend}, {@cache_loose}, {@cache_loose}, {@ignoreqv}], [{@hash}]}}) kernel console output (not intermixed with test programs): face 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 413.110195][ T846] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 413.114380][ T846] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 413.117265][ T846] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.124849][ T846] usb 6-1: config 0 descriptor?? [ 413.153974][ T24] usb 7-1: device descriptor read/64, error -71 [ 413.429217][ T24] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 413.543773][ T846] shield 0003:0955:7214.0021: unknown main item tag 0x0 [ 413.548303][ T846] shield 0003:0955:7214.0021: unknown main item tag 0x0 [ 413.551640][ T846] shield 0003:0955:7214.0021: unknown main item tag 0x0 [ 413.557133][ T846] shield 0003:0955:7214.0021: unknown main item tag 0x0 [ 413.560157][ T846] shield 0003:0955:7214.0021: unknown main item tag 0x0 [ 413.568215][ T846] input: HID 0955:7214 Haptics as /devices/virtual/input/input49 [ 413.569566][ T24] usb 7-1: device descriptor read/64, error -71 [ 413.609915][ T846] shield 0003:0955:7214.0021: Registered Thunderstrike controller [ 413.615831][ T846] shield 0003:0955:7214.0021: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 413.691142][ T24] usb usb7-port1: attempt power cycle [ 413.745606][T12645] netlink: 512 bytes leftover after parsing attributes in process `syz.1.1944'. [ 413.753039][ T29] shield 0003:0955:7214.0021: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 413.753298][ T10] usb 6-1: USB disconnect, device number 58 [ 413.759091][ T29] shield 0003:0955:7214.0021: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 413.768175][ T29] shield 0003:0955:7214.0021: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 413.772194][ T29] shield 0003:0955:7214.0021: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 414.039092][ T24] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 414.061290][ T24] usb 7-1: device descriptor read/8, error -71 [ 414.144288][ T42] audit: type=1804 audit(1784580112.599:2135): pid=12670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.1952" name="/newroot/307/bus/bus" dev="overlay" ino=1752 res=1 errno=0 [ 414.299124][ T24] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 414.339939][ T24] usb 7-1: device descriptor read/8, error -71 [ 414.385905][T12679] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1955'. [ 414.389162][T12676] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1954'. [ 414.450097][ T24] usb usb7-port1: unable to enumerate USB device [ 415.868010][T12695] syzkaller0: entered promiscuous mode [ 415.870241][T12695] syzkaller0: entered allmulticast mode [ 415.927481][T12695] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1959'. [ 415.927503][T12696] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1959'. [ 415.937454][T12695] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 415.957591][T12695] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 416.580806][T12702] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.1960'. [ 417.321822][T12708] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 417.324308][T12708] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 417.327597][T12708] vhci_hcd vhci_hcd.0: Device attached [ 417.349782][ T29] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 417.529125][ T29] usb 6-1: Using ep0 maxpacket: 16 [ 417.535232][ T29] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 417.541802][ T29] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 417.545449][ T29] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 417.551424][ T29] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 417.554841][ T29] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.560533][ T29] usb 6-1: config 0 descriptor?? [ 417.609232][ T5830] usb 9-1: new high-speed USB device number 58 using dummy_hcd [ 417.609250][ T1043] usb 42-1: SetAddress Request (10) to port 0 [ 417.609291][ T1043] usb 42-1: new SuperSpeed USB device number 10 using vhci_hcd [ 417.760902][ T5830] usb 9-1: config 0 interface 0 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 61 [ 417.765218][ T5830] usb 9-1: config 0 interface 0 has no altsetting 0 [ 417.770150][ T5830] usb 9-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 417.774135][ T5830] usb 9-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 417.777703][ T5830] usb 9-1: Product: syz [ 417.779783][ T5830] usb 9-1: Manufacturer: syz [ 417.781802][ T5830] usb 9-1: SerialNumber: syz [ 417.787757][ T5830] usb 9-1: config 0 descriptor?? [ 417.796486][T12713] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 417.809258][ T5830] usb 9-1: selecting invalid altsetting 0 [ 417.981145][ T29] shield 0003:0955:7214.0022: unknown main item tag 0x0 [ 417.999123][ T29] shield 0003:0955:7214.0022: unknown main item tag 0x0 [ 418.003788][ T29] shield 0003:0955:7214.0022: unknown main item tag 0x0 [ 418.006582][ T29] shield 0003:0955:7214.0022: unknown main item tag 0x0 [ 418.019310][ T29] shield 0003:0955:7214.0022: unknown main item tag 0x0 [ 418.031300][ T29] input: HID 0955:7214 Haptics as /devices/virtual/input/input50 [ 418.033184][T12713] usb 9-1: BOGUS urb xfer, pipe 0 != type 3 [ 418.083610][ T29] shield 0003:0955:7214.0022: Registered Thunderstrike controller [ 418.086404][ T29] shield 0003:0955:7214.0022: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 418.146523][ T1490] usb 9-1: USB disconnect, device number 58 [ 418.191272][T12707] netlink: 512 bytes leftover after parsing attributes in process `syz.1.1964'. [ 418.207213][ T5829] shield 0003:0955:7214.0022: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 418.220294][ T5829] shield 0003:0955:7214.0022: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 418.234377][ T29] usb 6-1: USB disconnect, device number 59 [ 418.236643][ T5829] shield 0003:0955:7214.0022: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 418.247098][ T5829] shield 0003:0955:7214.0022: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 418.255382][T12709] vhci_hcd: connection reset by peer [ 418.261537][ T13] vhci_hcd vhci_hcd.2: stop threads [ 418.263562][ T13] vhci_hcd vhci_hcd.2: release socket [ 418.271390][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 418.716978][T12733] bridge0: port 4(erspan0) entered blocking state [ 418.720525][T12733] bridge0: port 4(erspan0) entered disabled state [ 418.724201][T12733] erspan0: entered allmulticast mode [ 418.731501][T12733] erspan0: entered promiscuous mode [ 418.735684][T12733] bridge0: port 4(erspan0) entered blocking state [ 418.739899][T12733] bridge0: port 4(erspan0) entered forwarding state [ 418.752513][T12733] erspan0: left allmulticast mode [ 418.754382][T12733] erspan0: left promiscuous mode [ 418.758783][T12733] bridge0: port 4(erspan0) entered disabled state [ 418.913865][T12738] binder: 12734:12738 ioctl c00c620f 800003c0 returned -22 [ 419.673430][ T42] audit: type=1804 audit(1784580118.129:2136): pid=12746 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1973" name="/newroot/410/bus/bus" dev="overlay" ino=2344 res=1 errno=0 [ 419.838907][T12755] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1976'. [ 419.917190][T12755] netlink: 'syz.1.1976': attribute type 21 has an invalid length. [ 419.921257][T12755] IPv6: NLM_F_CREATE should be specified when creating new route [ 419.926951][T12755] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 419.932728][T12755] IPv6: NLM_F_CREATE should be set when creating new route [ 419.935497][T12755] IPv6: NLM_F_CREATE should be set when creating new route [ 419.937908][T12755] IPv6: NLM_F_CREATE should be set when creating new route [ 419.945128][T12755] netlink: 'syz.1.1976': attribute type 21 has an invalid length. [ 419.948442][T12755] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 419.962045][T12755] netlink: 'syz.1.1976': attribute type 15 has an invalid length. [ 419.965199][T12755] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1976'. [ 420.083929][T12760] 8021q: adding VLAN 0 to HW filter on device bond0 [ 420.088306][T12760] bond0: (slave bond_slave_1): Error -28 calling ndo_bpf [ 420.099763][T12760] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 420.104762][ T10] lo speed is unknown, defaulting to 1000 [ 420.113379][ T10] sz1: Port: 1 Link ACTIVE [ 420.117296][ T10] lo speed is unknown, defaulting to 1000 [ 420.259210][ T5830] usb 7-1: new high-speed USB device number 73 using dummy_hcd [ 420.362097][T12772] NILFS (loop1): device size too small [ 420.439340][ T5830] usb 7-1: Using ep0 maxpacket: 16 [ 420.454344][ T5830] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 420.461163][ T5830] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 420.469503][ T5830] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 420.481080][ T5830] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 420.487194][ T5830] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 420.564319][ T5830] usb 7-1: config 0 descriptor?? [ 421.030467][ T5830] shield 0003:0955:7214.0023: unknown main item tag 0x0 [ 421.038555][ T5830] shield 0003:0955:7214.0023: unknown main item tag 0x0 [ 421.046571][ T5830] shield 0003:0955:7214.0023: unknown main item tag 0x0 [ 421.058832][ T5830] shield 0003:0955:7214.0023: unknown main item tag 0x0 [ 421.063246][ T5830] shield 0003:0955:7214.0023: unknown main item tag 0x0 [ 421.102035][ T5830] input: HID 0955:7214 Haptics as /devices/virtual/input/input51 [ 421.199088][ T29] usb 9-1: new low-speed USB device number 59 using dummy_hcd [ 421.227866][T12762] netlink: 512 bytes leftover after parsing attributes in process `syz.2.1979'. [ 421.345433][T12778] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 421.348943][T12778] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 421.369674][ T29] usb 9-1: Invalid ep0 maxpacket: 16 [ 421.372623][ T5830] shield 0003:0955:7214.0023: Registered Thunderstrike controller [ 421.376448][ T5830] shield 0003:0955:7214.0023: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 421.452649][ T5830] usb 7-1: USB disconnect, device number 73 [ 421.455076][ T5837] shield 0003:0955:7214.0023: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 421.459240][ T5837] shield 0003:0955:7214.0023: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 421.462944][ T5837] shield 0003:0955:7214.0023: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 421.472533][ T5837] shield 0003:0955:7214.0023: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 421.485776][T12783] netlink: 'syz.5.1984': attribute type 1 has an invalid length. [ 421.488268][T12783] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1984'. [ 421.519728][ T29] usb 9-1: new low-speed USB device number 60 using dummy_hcd [ 421.689075][ T29] usb 9-1: Invalid ep0 maxpacket: 16 [ 421.692405][ T29] usb usb9-port1: attempt power cycle [ 421.974595][ T42] audit: type=1804 audit(1784580120.429:2137): pid=12790 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1986" name="/newroot/478/bus/bus" dev="overlay" ino=2639 res=1 errno=0 [ 422.049152][ T29] usb 9-1: new low-speed USB device number 61 using dummy_hcd [ 422.069749][ T29] usb 9-1: Invalid ep0 maxpacket: 16 [ 422.199121][ T29] usb 9-1: new low-speed USB device number 62 using dummy_hcd [ 422.222661][ T29] usb 9-1: Invalid ep0 maxpacket: 16 [ 422.225429][ T29] usb usb9-port1: unable to enumerate USB device [ 422.699139][ T1043] usb 42-1: device descriptor read/8, error -110 [ 422.753681][T12800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1989'. [ 422.840930][T12803] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 422.853834][ T24] hid-generic 0000:0000:0000.0024: hidraw1: HID v0.05 Device [syz1] on syz1 [ 422.931900][T12807] fido_id[12807]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 423.109583][ T1043] usb usb42-port1: attempt power cycle [ 423.997894][ T1043] usb usb42-port1: unable to enumerate USB device [ 424.700827][T12828] pimreg: left allmulticast mode [ 425.785061][T12850] batadv_slave_0: mtu less than device minimum [ 425.788944][T12850] sd 0:0:0:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x24 ascq=0x0 [ 425.793609][T12850] netlink: 100 bytes leftover after parsing attributes in process `syz.5.2000'. [ 425.797176][T12850] netlink: 100 bytes leftover after parsing attributes in process `syz.5.2000'. [ 427.309553][T12873] IPVS: set_ctl: invalid protocol: 94 10.1.1.1:20000 [ 427.423870][T12869] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(10) [ 427.426705][T12869] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 427.467401][T12869] vhci_hcd vhci_hcd.0: Device attached [ 427.572077][ T42] audit: type=1804 audit(1784580125.959:2138): pid=12874 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2007" name="/newroot/323/bus/bus" dev="overlay" ino=1844 res=1 errno=0 [ 427.749143][ T5830] usb 42-1: SetAddress Request (14) to port 0 [ 427.752979][ T5830] usb 42-1: new SuperSpeed USB device number 14 using vhci_hcd [ 428.200179][T12887] dummy0: entered promiscuous mode [ 428.392660][T12878] dummy0: left promiscuous mode [ 428.506541][T12875] vhci_hcd: connection reset by peer [ 428.511454][ T13] vhci_hcd vhci_hcd.2: stop threads [ 428.513764][ T13] vhci_hcd vhci_hcd.2: release socket [ 428.523159][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 428.744760][T12898] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2014'. [ 429.166329][ T42] audit: type=1804 audit(1784580127.609:2139): pid=12904 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.2016" name="/newroot/422/bus/bus" dev="overlay" ino=2416 res=1 errno=0 [ 429.211590][T12909] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2019'. [ 429.446051][T12910] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2018'. [ 429.462907][ T42] audit: type=1804 audit(1784580127.919:2140): pid=12916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2017" name="/newroot/325/bus/bus" dev="overlay" ino=1865 res=1 errno=0 [ 429.639252][ T5837] usb 7-1: new low-speed USB device number 74 using dummy_hcd [ 429.799160][ T5837] usb 7-1: Invalid ep0 maxpacket: 16 [ 429.820293][ T42] audit: type=1804 audit(1784580128.279:2141): pid=12925 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2021" name="/newroot/534/bus/bus" dev="overlay" ino=2995 res=1 errno=0 [ 429.929224][ T5837] usb 7-1: new low-speed USB device number 75 using dummy_hcd [ 430.089224][ T5837] usb 7-1: Invalid ep0 maxpacket: 16 [ 430.093423][ T5837] usb usb7-port1: attempt power cycle [ 430.349109][ T60] usb 9-1: new high-speed USB device number 63 using dummy_hcd [ 430.424402][T12937] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2026'. [ 430.447840][T12937] af_packet: tpacket_rcv: packet too big, clamped from 64521 to 3956. macoff=92 [ 430.469121][ T5837] usb 7-1: new low-speed USB device number 76 using dummy_hcd [ 430.490297][ T5837] usb 7-1: Invalid ep0 maxpacket: 16 [ 430.509081][ T60] usb 9-1: Using ep0 maxpacket: 16 [ 430.515241][ T60] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 430.520529][ T60] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 430.528471][ T60] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 430.536318][ T60] usb 9-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 430.540864][ T60] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.548361][ T60] usb 9-1: config 0 descriptor?? [ 430.639121][ T5837] usb 7-1: new low-speed USB device number 77 using dummy_hcd [ 430.660109][ T5837] usb 7-1: Invalid ep0 maxpacket: 16 [ 430.666233][ T5837] usb usb7-port1: unable to enumerate USB device [ 430.759641][ T24] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 430.910663][T12947] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2028'. [ 430.986290][ T60] hid_parser_main: 78 callbacks suppressed [ 430.986313][ T60] shield 0003:0955:7214.0025: unknown main item tag 0x0 [ 430.995230][ T60] shield 0003:0955:7214.0025: unknown main item tag 0x0 [ 430.998222][ T60] shield 0003:0955:7214.0025: unknown main item tag 0x0 [ 431.001544][ T60] shield 0003:0955:7214.0025: unknown main item tag 0x0 [ 431.004476][ T60] shield 0003:0955:7214.0025: unknown main item tag 0x0 [ 431.011086][ T60] input: HID 0955:7214 Haptics as /devices/virtual/input/input52 [ 431.047630][ T60] shield 0003:0955:7214.0025: Registered Thunderstrike controller [ 431.055759][ T60] shield 0003:0955:7214.0025: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.4-1/input0 [ 431.178193][T12931] netlink: 512 bytes leftover after parsing attributes in process `syz.4.2023'. [ 431.181878][ T42] audit: type=1804 audit(1784580129.639:2142): pid=12964 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2030" name="/newroot/537/bus/bus" dev="overlay" ino=3019 res=1 errno=0 [ 431.191553][ T34] shield 0003:0955:7214.0025: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 431.199536][ T34] shield 0003:0955:7214.0025: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 431.206072][ T5837] usb 9-1: USB disconnect, device number 63 [ 431.208538][ T34] shield 0003:0955:7214.0025: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 431.218406][ T34] shield 0003:0955:7214.0025: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 432.849370][ T5830] usb 42-1: device descriptor read/8, error -110 [ 433.251354][ T5830] usb usb42-port1: attempt power cycle [ 433.819990][ T5830] usb usb42-port1: unable to enumerate USB device [ 438.135169][T12999] 9p: Bad value for 'rfdno' [ 438.438059][T13012] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2040'. [ 438.799242][ T1043] usb 10-1: new high-speed USB device number 65 using dummy_hcd [ 438.979904][ T1043] usb 10-1: Using ep0 maxpacket: 16 [ 439.004064][ T1043] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 439.019544][ T1043] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 439.028293][ T1043] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 439.037342][ T1043] usb 10-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 439.049189][ T1043] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.094812][ T1043] usb 10-1: config 0 descriptor?? [ 439.109968][ T29] usb 9-1: new low-speed USB device number 64 using dummy_hcd [ 439.290204][ T5830] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 439.299169][ T29] usb 9-1: Invalid ep0 maxpacket: 16 [ 439.330921][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.439113][ T5830] usb 6-1: Using ep0 maxpacket: 16 [ 439.444556][ T5830] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 439.450218][ T5830] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 439.454300][ T5830] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 439.459435][ T5830] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 439.463065][ T5830] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.468495][ T5830] usb 6-1: config 0 descriptor?? [ 439.469883][ T29] usb 9-1: new low-speed USB device number 65 using dummy_hcd [ 439.641139][ T1043] shield 0003:0955:7214.0026: unknown main item tag 0x0 [ 439.644407][ T1043] shield 0003:0955:7214.0026: unknown main item tag 0x0 [ 439.647532][ T1043] shield 0003:0955:7214.0026: unknown main item tag 0x0 [ 439.650591][ T29] usb 9-1: Invalid ep0 maxpacket: 16 [ 439.653019][ T1043] shield 0003:0955:7214.0026: unknown main item tag 0x0 [ 439.657271][ T29] usb usb9-port1: attempt power cycle [ 439.659870][ T1043] shield 0003:0955:7214.0026: unknown main item tag 0x0 [ 439.699069][ T1043] input: HID 0955:7214 Haptics as /devices/virtual/input/input53 [ 439.772721][ T1043] shield 0003:0955:7214.0026: Registered Thunderstrike controller [ 439.784671][ T1043] shield 0003:0955:7214.0026: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.5-1/input0 [ 439.811699][T13015] netlink: 512 bytes leftover after parsing attributes in process `syz.5.2041'. [ 439.852292][T13035] shield 0003:0955:7214.0026: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 439.861160][T13035] shield 0003:0955:7214.0026: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 439.866002][ T1043] usb 10-1: USB disconnect, device number 65 [ 439.871702][T13035] shield 0003:0955:7214.0026: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 439.878127][T13035] shield 0003:0955:7214.0026: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 439.911391][ T5830] usbhid 6-1:0.0: can't add hid device: -71 [ 439.922319][ T5830] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 439.939985][ T5830] usb 6-1: USB disconnect, device number 60 [ 440.024934][ T29] usb 9-1: new low-speed USB device number 66 using dummy_hcd [ 440.059707][ T29] usb 9-1: Invalid ep0 maxpacket: 16 [ 440.189082][ T29] usb 9-1: new low-speed USB device number 67 using dummy_hcd [ 440.220312][ T29] usb 9-1: Invalid ep0 maxpacket: 16 [ 440.224016][ T29] usb usb9-port1: unable to enumerate USB device [ 440.739218][ T5830] usb 10-1: new high-speed USB device number 66 using dummy_hcd [ 440.889249][ T5830] usb 10-1: Using ep0 maxpacket: 16 [ 440.894028][ T5830] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 440.897863][ T5830] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 440.901347][ T5830] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 440.905898][ T5830] usb 10-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 440.908824][ T5830] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.914300][ T5830] usb 10-1: config 0 descriptor?? [ 441.213776][T13064] (syz.1.2053,13064,3):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 441.216832][T13064] (syz.1.2053,13064,3):ocfs2_fill_super:1177 ERROR: status = -22 [ 441.370402][ T5830] usbhid 10-1:0.0: can't add hid device: -71 [ 441.372423][ T5830] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 441.383161][ T5830] usb 10-1: USB disconnect, device number 66 [ 441.390730][T13067] netlink: 'syz.1.2054': attribute type 1 has an invalid length. [ 441.396072][T13067] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2054'. [ 441.651775][T13070] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(10) [ 441.654272][T13070] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 441.657068][T13070] vhci_hcd vhci_hcd.0: Device attached [ 441.913890][T13077] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2057'. [ 441.930213][ T5830] usb 42-1: SetAddress Request (18) to port 0 [ 441.937370][ T5830] usb 42-1: new SuperSpeed USB device number 18 using vhci_hcd [ 442.079405][ T10] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 442.094147][T13080] IPVS: Scheduler module ip_vs_ not found [ 442.171439][T13071] vhci_hcd: connection reset by peer [ 442.173486][ T13] vhci_hcd vhci_hcd.2: stop threads [ 442.175184][ T13] vhci_hcd vhci_hcd.2: release socket [ 442.177987][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 442.239399][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 442.245814][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 442.250560][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 442.254715][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 442.260111][ T9] usb 10-1: new high-speed USB device number 67 using dummy_hcd [ 442.264948][ T10] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 442.270630][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.291291][ T10] usb 6-1: config 0 descriptor?? [ 442.409646][ T9] usb 10-1: Using ep0 maxpacket: 16 [ 442.414874][ T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 442.421737][ T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 442.429128][ T9] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 442.439237][ T9] usb 10-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 442.446136][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.460385][ T9] usb 10-1: config 0 descriptor?? [ 442.990144][T13076] netlink: 512 bytes leftover after parsing attributes in process `syz.1.2056'. [ 443.407659][ T9] usbhid 10-1:0.0: can't add hid device: -71 [ 443.500281][ T10] shield 0003:0955:7214.0027: unknown main item tag 0x0 [ 443.503700][ T10] shield 0003:0955:7214.0027: unknown main item tag 0x0 [ 443.507054][ T10] shield 0003:0955:7214.0027: unknown main item tag 0x0 [ 443.510439][ T9] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 443.516329][ T9] usb 10-1: USB disconnect, device number 67 [ 443.526707][ T10] shield 0003:0955:7214.0027: unknown main item tag 0x0 [ 443.529454][ T10] shield 0003:0955:7214.0027: unknown main item tag 0x0 [ 443.534423][T13093] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2061'. [ 443.540607][ T10] input: HID 0955:7214 Haptics as /devices/virtual/input/input54 [ 443.546206][T13093] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2172873273 (2172873273 ns) > initial count (417850100 ns). Using initial count to start timer. [ 443.551915][ T10] shield 0003:0955:7214.0027: Registered Thunderstrike controller [ 443.552058][ T10] shield 0003:0955:7214.0027: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 443.557252][T13093] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 443.621846][ T10] usb 6-1: USB disconnect, device number 61 [ 443.624588][ T5894] shield 0003:0955:7214.0027: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 443.625925][T13096] overlay: ./file0 is not a directory [ 443.632183][ T5894] shield 0003:0955:7214.0027: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 443.636627][ T5894] shield 0003:0955:7214.0027: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 443.641691][ T5894] shield 0003:0955:7214.0027: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 443.741862][T13101] FAULT_INJECTION: forcing a failure. [ 443.741862][T13101] name failslab, interval 1, probability 0, space 0, times 0 [ 443.753067][T13101] CPU: 0 UID: 0 PID: 13101 Comm: syz.2.2064 Tainted: G L syzkaller #0 PREEMPT(full) [ 443.753100][T13101] Tainted: [L]=SOFTLOCKUP [ 443.753107][T13101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 443.753118][T13101] Call Trace: [ 443.753126][T13101] [ 443.753135][T13101] dump_stack_lvl+0x100/0x190 [ 443.753165][T13101] should_fail_ex.cold+0x5/0xa [ 443.753188][T13101] should_failslab+0xc2/0x120 [ 443.753215][T13101] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 443.753240][T13101] ? __alloc_skb+0x140/0x710 [ 443.753303][T13101] __alloc_skb+0x140/0x710 [ 443.753323][T13101] ? __alloc_skb+0x5b7/0x710 [ 443.753343][T13101] ? __pfx___alloc_skb+0x10/0x10 [ 443.753363][T13101] ? __sock_queue_rcv_skb+0x54f/0xd30 [ 443.753388][T13101] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 443.753430][T13101] send_monitor_note+0xe8/0x530 [ 443.753485][T13101] ? __pfx_send_monitor_note+0x10/0x10 [ 443.753510][T13101] ? apparmor_capable+0x1d7/0x4d0 [ 443.753533][T13101] ? bpf_lsm_capable+0x9/0x10 [ 443.753559][T13101] hci_sock_bind+0xd4b/0x1890 [ 443.753582][T13101] ? __pfx_hci_sock_bind+0x10/0x10 [ 443.753605][T13101] ? apparmor_socket_bind+0x105/0x1e0 [ 443.753640][T13101] __sys_bind+0x1a9/0x260 [ 443.753661][T13101] ? __pfx___sys_bind+0x10/0x10 [ 443.753678][T13101] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 443.753712][T13101] ? ksys_write+0x1ac/0x250 [ 443.753740][T13101] ? __pfx_ksys_write+0x10/0x10 [ 443.753777][T13101] __ia32_sys_bind+0x71/0xb0 [ 443.753796][T13101] ? lockdep_hardirqs_on+0x78/0x100 [ 443.753816][T13101] __do_fast_syscall_32+0xe7/0x970 [ 443.753837][T13101] ? lockdep_hardirqs_on+0x78/0x100 [ 443.753859][T13101] do_fast_syscall_32+0x32/0x70 [ 443.753881][T13101] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 443.753905][T13101] RIP: 0023:0xf7f28fec [ 443.753931][T13101] Code: Unable to access opcode bytes at 0xf7f28fc2. [ 443.753940][T13101] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000169 [ 443.753959][T13101] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000140 [ 443.753972][T13101] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000000 [ 443.753983][T13101] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 443.753994][T13101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 443.754004][T13101] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 443.754030][T13101] [ 444.019324][ T5837] usb 9-1: new low-speed USB device number 68 using dummy_hcd [ 444.365170][T13121] 9p: p9: multiple sources not supported [ 444.630811][ T5837] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 444.839126][ T5837] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 444.846540][ T5837] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 444.852220][ T5837] usb 9-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 444.854991][ T5837] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.864149][T13103] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 444.870325][ T5837] hub 9-1:1.0: bad descriptor, ignoring hub [ 444.872362][ T5837] hub 9-1:1.0: probe with driver hub failed with error -5 [ 444.875058][ T5837] cdc_wdm 9-1:1.0: skipping garbage [ 444.876746][ T5837] cdc_wdm 9-1:1.0: skipping garbage [ 444.879434][ T5837] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 444.881483][ T5837] cdc_wdm 9-1:1.0: Unknown control protocol [ 444.972922][ T42] audit: type=1804 audit(1784580143.429:2143): pid=13128 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2072" name="/newroot/547/bus/bus" dev="overlay" ino=3080 res=1 errno=0 [ 445.691467][T13103] usb 9-1: reset low-speed USB device number 68 using dummy_hcd [ 445.809144][ T5756] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 446.023478][T13103] usb 9-1: device firmware changed [ 446.028748][ T24] usb 9-1: USB disconnect, device number 68 [ 446.035209][T13103] cdc_wdm 9-1:1.0: Error autopm - -16 [ 446.051707][T13141] overlay: Bad value for 'xino' [ 446.159087][ T5837] usb 10-1: new high-speed USB device number 68 using dummy_hcd [ 446.179097][ T24] usb 9-1: new low-speed USB device number 69 using dummy_hcd [ 446.279324][ T10] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 446.319111][ T5837] usb 10-1: Using ep0 maxpacket: 16 [ 446.323144][ T5837] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 446.327521][ T5837] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 446.331532][ T5837] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 446.336900][ T5837] usb 10-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 446.340617][ T5837] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.346112][ T5837] usb 10-1: config 0 descriptor?? [ 446.361032][ T24] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 446.365149][ T24] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 446.368376][ T24] usb 9-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 446.375608][ T24] usb 9-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 446.379417][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.385623][T13131] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 446.391013][ T24] hub 9-1:1.0: bad descriptor, ignoring hub [ 446.393579][ T24] hub 9-1:1.0: probe with driver hub failed with error -5 [ 446.396885][ T24] cdc_wdm 9-1:1.0: skipping garbage [ 446.399170][ T24] cdc_wdm 9-1:1.0: skipping garbage [ 446.401337][ T24] cdc_wdm 9-1:1.0: probe with driver cdc_wdm failed with error -22 [ 446.429123][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 446.432471][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 446.435977][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 446.439356][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 446.443488][ T10] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 446.446416][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.450579][ T10] usb 6-1: config 0 descriptor?? [ 446.709260][ T24] usb 9-1: USB disconnect, device number 69 [ 446.764935][ T5837] usbhid 10-1:0.0: can't add hid device: -71 [ 446.772200][ T5837] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 446.782777][ T5837] usb 10-1: USB disconnect, device number 68 [ 446.864981][ T10] shield 0003:0955:7214.0028: unknown main item tag 0x0 [ 446.869785][ T10] shield 0003:0955:7214.0028: unknown main item tag 0x0 [ 446.872099][ T10] shield 0003:0955:7214.0028: unknown main item tag 0x0 [ 446.874360][ T10] shield 0003:0955:7214.0028: unknown main item tag 0x0 [ 446.876583][ T10] shield 0003:0955:7214.0028: unknown main item tag 0x0 [ 446.881323][ T10] input: HID 0955:7214 Haptics as /devices/virtual/input/input55 [ 446.904949][ T10] shield 0003:0955:7214.0028: Registered Thunderstrike controller [ 446.907784][ T10] shield 0003:0955:7214.0028: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 446.973941][T13153] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2078'. [ 447.019236][ T5830] usb 42-1: device descriptor read/8, error -110 [ 447.063519][ T5894] shield 0003:0955:7214.0028: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 447.070771][ T9] usb 6-1: USB disconnect, device number 62 [ 447.072964][ T5894] shield 0003:0955:7214.0028: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 447.081599][ T5894] shield 0003:0955:7214.0028: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 447.086722][ T5894] shield 0003:0955:7214.0028: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 447.440131][ T5830] usb usb42-port1: attempt power cycle [ 447.677290][T13168] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2082'. [ 447.852548][T13178] Unsupported ieee802154 address type: 0 [ 447.912417][T13174] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 447.914498][T13174] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 447.917367][T13174] vhci_hcd vhci_hcd.0: Device attached [ 447.975790][T13188] program syz.5.2087 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 448.012322][ T5830] usb usb42-port1: unable to enumerate USB device [ 448.042134][T13190] comedi comedi0: comedi_parport: I/O base address not correctly aligned [ 448.197589][ T24] usb 40-1: SetAddress Request (22) to port 0 [ 448.200055][ T24] usb 40-1: new SuperSpeed USB device number 22 using vhci_hcd [ 448.379393][ T1490] usb 10-1: new high-speed USB device number 69 using dummy_hcd [ 448.529331][ T1490] usb 10-1: Using ep0 maxpacket: 16 [ 448.532277][ T1490] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 448.535833][ T1490] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 448.539175][ T1490] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 448.543538][ T1490] usb 10-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 448.546411][ T1490] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.551636][ T1490] usb 10-1: config 0 descriptor?? [ 448.802019][T13185] vhci_hcd: connection reset by peer [ 448.804171][T11472] vhci_hcd vhci_hcd.1: stop threads [ 448.808229][T11472] vhci_hcd vhci_hcd.1: release socket [ 448.813932][T11472] vhci_hcd vhci_hcd.1: disconnect device [ 448.939108][ T56] usb 7-1: new high-speed USB device number 78 using dummy_hcd [ 448.968716][ T1490] usbhid 10-1:0.0: can't add hid device: -71 [ 448.970688][ T1490] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 448.981020][ T1490] usb 10-1: USB disconnect, device number 69 [ 449.109563][ T56] usb 7-1: Using ep0 maxpacket: 16 [ 449.119151][ T56] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 449.127480][ T56] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 449.133792][ T56] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 449.149083][ T56] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 449.152075][ T56] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.155942][ T56] usb 7-1: config 0 descriptor?? [ 449.390082][T13202] program syz.1.2092 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 449.437461][T13202] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2092'. [ 449.581482][ T56] shield 0003:0955:7214.0029: unknown main item tag 0x0 [ 449.585548][ T56] shield 0003:0955:7214.0029: unknown main item tag 0x0 [ 449.589088][ T56] shield 0003:0955:7214.0029: unknown main item tag 0x0 [ 449.592062][ T56] shield 0003:0955:7214.0029: unknown main item tag 0x0 [ 449.594888][ T56] shield 0003:0955:7214.0029: unknown main item tag 0x0 [ 449.604426][ T56] input: HID 0955:7214 Haptics as /devices/virtual/input/input56 [ 449.654458][T13215] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 449.654794][ T56] shield 0003:0955:7214.0029: Registered Thunderstrike controller [ 449.669771][ T56] shield 0003:0955:7214.0029: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 449.935837][T13198] shield 0003:0955:7214.0029: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 449.949128][T13198] shield 0003:0955:7214.0029: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 449.952962][ T1490] usb 7-1: USB disconnect, device number 78 [ 449.965360][T13198] shield 0003:0955:7214.0029: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 449.984949][T13198] shield 0003:0955:7214.0029: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 450.659311][ T1490] usb 10-1: new high-speed USB device number 70 using dummy_hcd [ 450.695958][T13244] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(10) [ 450.698602][T13244] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 450.705811][T13244] vhci_hcd vhci_hcd.0: Device attached [ 450.713131][T13245] vhci_hcd: connection closed [ 450.713399][T11472] vhci_hcd vhci_hcd.1: stop threads [ 450.719099][T11472] vhci_hcd vhci_hcd.1: release socket [ 450.721355][T11472] vhci_hcd vhci_hcd.1: disconnect device [ 450.819230][ T1490] usb 10-1: Using ep0 maxpacket: 16 [ 450.823542][ T1490] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.828265][ T1490] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 450.832586][ T1490] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 450.838038][ T1490] usb 10-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 450.841939][ T1490] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.848717][ T1490] usb 10-1: config 0 descriptor?? [ 451.279593][ T1490] usbhid 10-1:0.0: can't add hid device: -71 [ 451.282341][ T1490] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 451.296111][ T1490] usb 10-1: USB disconnect, device number 70 [ 451.620638][T13258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2109'. [ 451.815578][T13265] overlayfs: failed to resolve 'index=on': -2 [ 451.823956][T13265] random: crng reseeded on system resumption [ 451.863686][T13267] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 452.219176][ T1490] usb 10-1: new high-speed USB device number 71 using dummy_hcd [ 452.370571][ T1490] usb 10-1: Using ep0 maxpacket: 16 [ 452.392222][ T1490] usb 10-1: unable to get BOS descriptor or descriptor too short [ 452.395416][ T1490] usb 10-1: no configurations [ 452.398315][ T1490] usb 10-1: can't read configurations, error -22 [ 453.188925][T13284] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(10) [ 453.191738][T13284] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 453.196189][T13284] vhci_hcd vhci_hcd.0: Device attached [ 453.462761][T13289] ip6_tunnel: non-ECT from 2001:0000:0000:0000:0000:0000:0000:0001 with DS=0x7 [ 453.494086][ T1043] usb 48-1: SetAddress Request (14) to port 0 [ 453.497865][ T1043] usb 48-1: new SuperSpeed USB device number 14 using vhci_hcd [ 453.499331][ T24] usb 40-1: device descriptor read/8, error -110 [ 453.619862][T13291] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2117'. [ 453.886962][T13285] vhci_hcd: connection reset by peer [ 453.893197][T11469] vhci_hcd vhci_hcd.5: stop threads [ 453.895612][T11469] vhci_hcd vhci_hcd.5: release socket [ 453.898063][T11469] vhci_hcd vhci_hcd.5: disconnect device [ 453.940269][ T24] usb usb40-port1: attempt power cycle [ 454.355136][T13297] loop5: detected capacity change from 0 to 6 [ 454.364972][T13297] Dev loop5: unable to read RDB block 6 [ 454.367035][T13297] loop5: unable to read partition table [ 454.369648][T13297] loop5: partition table beyond EOD, truncated [ 454.374034][T13297] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 454.414280][ T5154] Dev loop5: unable to read RDB block 6 [ 454.418203][ T5154] loop5: unable to read partition table [ 454.421566][ T5154] loop5: partition table beyond EOD, truncated [ 454.512726][ T24] usb usb40-port1: unable to enumerate USB device [ 454.617667][T13304] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2122'. [ 454.760538][ T42] audit: type=1804 audit(1784580153.219:2144): pid=13309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2120" name="/newroot/358/bus/bus" dev="overlay" ino=2052 res=1 errno=0 [ 454.899130][ T29] usb 9-1: new high-speed USB device number 70 using dummy_hcd [ 455.060213][ T29] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 455.064452][ T29] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 455.068907][ T29] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 455.075478][ T29] usb 9-1: config 0 interface 0 has no altsetting 0 [ 455.087994][ T29] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 455.091570][ T29] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 455.097772][ T29] usb 9-1: config 0 interface 0 has no altsetting 0 [ 455.105165][ T29] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 455.109280][ T29] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 455.116650][ T29] usb 9-1: config 0 interface 0 has no altsetting 0 [ 455.117201][T13318] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 455.132170][ T29] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 455.136875][ T29] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 455.145712][ T29] usb 9-1: config 0 interface 0 has no altsetting 0 [ 455.155090][ T29] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 455.162021][ T29] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 455.169120][ T29] usb 9-1: config 0 interface 0 has no altsetting 0 [ 455.177176][ T29] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 455.183890][ T29] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 455.190254][ T29] usb 9-1: config 0 interface 0 has no altsetting 0 [ 455.195986][ T29] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 455.199754][ T29] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 455.205466][ T29] usb 9-1: config 0 interface 0 has no altsetting 0 [ 455.210210][ T29] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 455.214231][ T29] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 455.219661][ T29] usb 9-1: config 0 interface 0 has no altsetting 0 [ 455.229870][ T29] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 455.235069][ T29] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 455.240717][ T29] usb 9-1: Product: syz [ 455.242549][ T29] usb 9-1: Manufacturer: syz [ 455.244580][ T29] usb 9-1: SerialNumber: syz [ 455.249913][ T29] usb 9-1: config 0 descriptor?? [ 455.265385][ T29] yurex 9-1:0.0: USB YUREX device now attached to Yurex #0 [ 455.865947][T13331] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(10) [ 455.868965][T13331] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 455.873697][T13331] vhci_hcd vhci_hcd.0: Device attached [ 455.963937][T13332] vhci_hcd: connection closed [ 455.964859][T11469] vhci_hcd vhci_hcd.5: stop threads [ 455.968358][T11469] vhci_hcd vhci_hcd.5: release socket [ 455.970582][T11469] vhci_hcd vhci_hcd.5: disconnect device [ 456.838892][ T24] libceph: connect (1)[c::]:6789 error -101 [ 456.841414][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 457.099476][ T24] libceph: connect (1)[c::]:6789 error -101 [ 457.102270][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 457.488324][T13349] ceph: No mds server is up or the cluster is laggy [ 457.599717][ T42] audit: type=1804 audit(1784580156.059:2145): pid=13356 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2134" name="/newroot/362/bus/bus" dev="overlay" ino=2081 res=1 errno=0 [ 457.632739][ T9] usb 9-1: USB disconnect, device number 70 [ 457.646494][ T9] yurex 9-1:0.0: USB YUREX #0 now disconnected [ 457.785780][T13363] fuse: Bad value for 'group_id' [ 457.787864][T13363] fuse: Bad value for 'group_id' [ 458.058692][T13371] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(10) [ 458.061493][T13371] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 458.066017][T13371] vhci_hcd vhci_hcd.0: Device attached [ 458.072949][T13372] vhci_hcd: connection closed [ 458.073303][ T13] vhci_hcd vhci_hcd.4: stop threads [ 458.080884][ T13] vhci_hcd vhci_hcd.4: release socket [ 458.109796][ T13] vhci_hcd vhci_hcd.4: disconnect device [ 458.485603][T13381] FAULT_INJECTION: forcing a failure. [ 458.485603][T13381] name failslab, interval 1, probability 0, space 0, times 0 [ 458.491242][T13381] CPU: 0 UID: 0 PID: 13381 Comm: syz.5.2141 Tainted: G L syzkaller #0 PREEMPT(full) [ 458.491275][T13381] Tainted: [L]=SOFTLOCKUP [ 458.491282][T13381] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 458.491292][T13381] Call Trace: [ 458.491302][T13381] [ 458.491311][T13381] dump_stack_lvl+0x100/0x190 [ 458.491341][T13381] should_fail_ex.cold+0x5/0xa [ 458.491366][T13381] should_failslab+0xc2/0x120 [ 458.491391][T13381] __kmalloc_noprof+0xfc/0x820 [ 458.491412][T13381] ? __kernel_text_address+0xd/0x30 [ 458.491439][T13381] ? unwind_get_return_address+0x59/0xa0 [ 458.491466][T13381] ? genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 458.491540][T13381] genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 458.491569][T13381] genl_family_rcv_msg_doit+0xc7/0x300 [ 458.491592][T13381] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 458.491614][T13381] ? genl_get_cmd+0x3e7/0x760 [ 458.491641][T13381] ? bpf_lsm_capable+0x9/0x10 [ 458.491660][T13381] ? security_capable+0x80/0x260 [ 458.491693][T13381] ? ns_capable+0xd2/0xf0 [ 458.491713][T13381] genl_rcv_msg+0x560/0x800 [ 458.491739][T13381] ? __pfx_genl_rcv_msg+0x10/0x10 [ 458.491760][T13381] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 458.491809][T13381] ? __pfx_nl80211_set_station+0x10/0x10 [ 458.491833][T13381] ? __pfx_nl80211_post_doit+0x10/0x10 [ 458.491859][T13381] ? __lock_acquire+0x49f/0x1a40 [ 458.491890][T13381] netlink_rcv_skb+0x159/0x420 [ 458.491909][T13381] ? __pfx_genl_rcv_msg+0x10/0x10 [ 458.491932][T13381] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 458.491960][T13381] ? netlink_deliver_tap+0x1ae/0xcc0 [ 458.491994][T13381] genl_rcv+0x28/0x40 [ 458.492013][T13381] netlink_unicast+0x585/0x850 [ 458.492045][T13381] ? __pfx_netlink_unicast+0x10/0x10 [ 458.492081][T13381] netlink_sendmsg+0x8b0/0xda0 [ 458.492117][T13381] ? __pfx_netlink_sendmsg+0x10/0x10 [ 458.492150][T13381] ? apparmor_socket_sendmsg+0x15b/0x270 [ 458.492186][T13381] ____sys_sendmsg+0xa4d/0xbe0 [ 458.492212][T13381] ? __pfx_netlink_sendmsg+0x10/0x10 [ 458.492244][T13381] ? __pfx_____sys_sendmsg+0x10/0x10 [ 458.492285][T13381] ___sys_sendmsg+0x190/0x1e0 [ 458.492317][T13381] ? __pfx____sys_sendmsg+0x10/0x10 [ 458.492383][T13381] ? find_held_lock+0x2b/0x80 [ 458.492422][T13381] __sys_sendmsg+0x160/0x210 [ 458.492447][T13381] ? __pfx___sys_sendmsg+0x10/0x10 [ 458.492478][T13381] ? __pfx_ksys_write+0x10/0x10 [ 458.492512][T13381] __do_fast_syscall_32+0xe7/0x970 [ 458.492539][T13381] ? lockdep_hardirqs_on+0x78/0x100 [ 458.492561][T13381] do_fast_syscall_32+0x32/0x70 [ 458.492585][T13381] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 458.492608][T13381] RIP: 0023:0xf7f48fec [ 458.492633][T13381] Code: Unable to access opcode bytes at 0xf7f48fc2. [ 458.492643][T13381] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 458.492663][T13381] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 458.492676][T13381] RDX: 0000000020048054 RSI: 0000000000000000 RDI: 0000000000000000 [ 458.492687][T13381] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 458.492697][T13381] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 458.492709][T13381] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 458.492735][T13381] [ 458.549578][ T1043] usb 48-1: device descriptor read/8, error -110 [ 458.756253][T13395] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2145'. [ 459.341235][ T1043] usb usb48-port1: attempt power cycle [ 459.480152][T13404] Invalid source name [ 459.584501][T13410] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2149'. [ 459.809517][ C2] ip6_tunnel: K xmit: Local address not yet configured! [ 459.885477][T13422] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 459.889182][T13422] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 459.899355][T13423] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(10) [ 459.902140][T13423] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 459.905448][T13423] vhci_hcd vhci_hcd.0: Device attached [ 459.914308][T13424] vhci_hcd: connection closed [ 459.920859][ T13] vhci_hcd vhci_hcd.4: stop threads [ 459.928459][ T13] vhci_hcd vhci_hcd.4: release socket [ 459.930037][ T1043] usb usb48-port1: unable to enumerate USB device [ 459.935853][ T13] vhci_hcd vhci_hcd.4: disconnect device [ 460.394642][T13428] fuse: Bad value for 'fd' [ 461.530734][T13457] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2159'. [ 461.738433][T13467] sd 0:0:0:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x24 ascq=0x0 [ 461.838247][T13459] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 461.975858][T13474] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(10) [ 461.978535][T13474] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 461.981315][T13474] vhci_hcd vhci_hcd.0: Device attached [ 462.401427][ T24] usb 42-1: SetAddress Request (22) to port 0 [ 462.404087][ T24] usb 42-1: new SuperSpeed USB device number 22 using vhci_hcd [ 462.724143][T13475] vhci_hcd: connection reset by peer [ 462.746487][ T13] vhci_hcd vhci_hcd.2: stop threads [ 462.750408][ T13] vhci_hcd vhci_hcd.2: release socket [ 462.768086][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 465.087076][T13559] bridge_slave_0: left allmulticast mode [ 465.090083][T13559] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.103308][T13559] bridge_slave_1: left allmulticast mode [ 465.107959][T13559] bridge_slave_1: left promiscuous mode [ 465.110441][T13559] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.122926][T13559] vlan2: left promiscuous mode [ 465.125997][T13559] geneve0: left promiscuous mode [ 465.137248][T13559] geneve0: entered promiscuous mode [ 465.164990][T13559] bond0: (slave bond_slave_0): Releasing backup interface [ 465.176535][T13559] bond_slave_0: left promiscuous mode [ 465.180709][T13559] bond0: (slave bond_slave_1): Releasing backup interface [ 465.184823][T13559] bond_slave_1: left promiscuous mode [ 465.206103][ T42] audit: type=1800 audit(1784580163.705:2146): pid=13564 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2181" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 465.207058][T13559] team0: Port device team_slave_0 removed [ 465.252893][T13559] team0: Port device team_slave_1 removed [ 465.260340][T13559] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.267688][T13559] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 465.272744][T13559] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.281097][T13559] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 465.288155][T13559] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 465.608399][T13580] batadv0: entered promiscuous mode [ 465.664055][T13576] lo speed is unknown, defaulting to 1000 [ 465.686921][T13576] lo speed is unknown, defaulting to 1000 [ 465.707682][T13590] input: syz0 as /devices/virtual/input/input57 [ 466.276068][ T5830] usb 7-1: new high-speed USB device number 79 using dummy_hcd [ 466.436755][ T5830] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 466.445766][ T5830] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 466.451963][ T5830] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 466.463274][ T5830] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 466.468014][ T5830] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.489660][ T5830] usb 7-1: config 0 descriptor?? [ 466.533822][T13576] lo speed is unknown, defaulting to 1000 [ 466.963843][ T5830] plantronics 0003:047F:FFFF.002A: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 467.437897][ T24] usb 42-1: device descriptor read/8, error -110 [ 467.499857][T13198] usb 9-1: new low-speed USB device number 71 using dummy_hcd [ 467.611528][T13629] netlink: 'syz.1.2202': attribute type 21 has an invalid length. [ 467.646270][T13198] usb 9-1: Invalid ep0 maxpacket: 16 [ 467.775458][T13198] usb 9-1: new low-speed USB device number 72 using dummy_hcd [ 467.825878][ T24] usb usb42-port1: attempt power cycle [ 467.924424][T13198] usb 9-1: Invalid ep0 maxpacket: 16 [ 467.928169][T13198] usb usb9-port1: attempt power cycle [ 468.267024][T13198] usb 9-1: new low-speed USB device number 73 using dummy_hcd [ 468.430108][ T24] usb usb42-port1: unable to enumerate USB device [ 468.436574][T13198] usb 9-1: Invalid ep0 maxpacket: 16 [ 468.580818][T13198] usb 9-1: new low-speed USB device number 74 using dummy_hcd [ 468.615974][T13198] usb 9-1: Invalid ep0 maxpacket: 16 [ 468.649903][T13198] usb usb9-port1: unable to enumerate USB device [ 469.033532][T13647] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(10) [ 469.036443][T13647] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 469.040921][T13647] vhci_hcd vhci_hcd.0: Device attached [ 469.377693][ T42] audit: type=1804 audit(1784580167.894:2147): pid=13655 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.2206" name="/newroot/525/bus/bus" dev="overlay" ino=2907 res=1 errno=0 [ 469.464067][ T10] usb 48-1: SetAddress Request (18) to port 0 [ 469.467001][ T10] usb 48-1: new SuperSpeed USB device number 18 using vhci_hcd [ 469.667823][ T5894] usb 7-1: USB disconnect, device number 79 [ 469.945284][T13648] vhci_hcd: connection reset by peer [ 469.959429][T11469] vhci_hcd vhci_hcd.5: stop threads [ 469.962248][T11469] vhci_hcd vhci_hcd.5: release socket [ 469.970414][T11469] vhci_hcd vhci_hcd.5: disconnect device [ 471.955963][T13705] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2218'. [ 472.235285][T13198] usb 9-1: new high-speed USB device number 75 using dummy_hcd [ 472.286712][T13718] sd 0:0:0:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x24 ascq=0x0 [ 472.314679][ T24] usb 7-1: new high-speed USB device number 80 using dummy_hcd [ 472.394077][ T29] usb 10-1: new low-speed USB device number 73 using dummy_hcd [ 472.394299][T13198] usb 9-1: Using ep0 maxpacket: 16 [ 472.400849][T13198] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 472.414849][T13198] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 472.419015][T13198] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 472.424551][T13198] usb 9-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 472.428512][T13198] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.435145][T13198] usb 9-1: config 0 descriptor?? [ 472.493524][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 472.498685][ T24] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 472.502439][ T24] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 472.506636][ T24] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 472.510723][ T24] usb 7-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 472.515337][ T24] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 472.520837][ T24] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 472.524729][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.540360][ T24] usbtmc 7-1:16.0: bulk endpoints not found [ 472.562969][ T29] usb 10-1: Invalid ep0 maxpacket: 16 [ 472.693946][ T29] usb 10-1: new low-speed USB device number 74 using dummy_hcd [ 472.841329][ T29] usb 10-1: Invalid ep0 maxpacket: 16 [ 472.844826][ T29] usb usb10-port1: attempt power cycle [ 472.884964][T13198] usbhid 9-1:0.0: can't add hid device: -71 [ 472.892699][T13198] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 472.905119][T13198] usb 9-1: USB disconnect, device number 75 [ 473.180261][ T29] usb 10-1: new low-speed USB device number 75 using dummy_hcd [ 473.199608][ T29] usb 10-1: Invalid ep0 maxpacket: 16 [ 473.328675][ T29] usb 10-1: new low-speed USB device number 76 using dummy_hcd [ 473.348823][ T29] usb 10-1: Invalid ep0 maxpacket: 16 [ 473.351153][ T29] usb usb10-port1: unable to enumerate USB device [ 473.479094][T13729] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2226'. [ 473.684206][T13736] trusted_key: encrypted_key: insufficient parameters specified [ 473.825444][T13743] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 474.513347][ T10] usb 48-1: device descriptor read/8, error -110 [ 474.734697][T13753] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2231'. [ 474.908679][ T10] usb usb48-port1: attempt power cycle [ 475.100779][T13755] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 475.355451][T13198] usb 7-1: USB disconnect, device number 80 [ 475.475948][ T10] usb usb48-port1: unable to enumerate USB device [ 475.492403][T13764] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(10) [ 475.495140][T13764] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 475.498477][T13764] vhci_hcd vhci_hcd.0: Device attached [ 475.798127][ T29] usb 9-1: new high-speed USB device number 76 using dummy_hcd [ 475.913106][T13767] vhci_hcd: connection closed [ 475.913367][T11469] vhci_hcd vhci_hcd.2: stop threads [ 475.916687][T11469] vhci_hcd vhci_hcd.2: release socket [ 475.918897][T11469] vhci_hcd vhci_hcd.2: disconnect device [ 475.925168][ T42] audit: type=1804 audit(1784580174.487:2148): pid=13771 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2235" name="/newroot/384/bus/bus" dev="overlay" ino=2206 res=1 errno=0 [ 475.971506][ T29] usb 9-1: Using ep0 maxpacket: 16 [ 475.978100][ T29] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 475.983996][ T29] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 475.991293][ T29] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 475.997306][ T29] usb 9-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 476.004191][ T29] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.011547][ T29] usb 9-1: config 0 descriptor?? [ 476.205023][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 476.211560][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 476.216860][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 476.221053][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 476.224870][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 476.255728][ T5756] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 476.263308][ T5756] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 476.269046][ T5756] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 476.276910][ T5756] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 476.283771][ T5756] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 476.432331][ T29] usbhid 9-1:0.0: can't add hid device: -71 [ 476.434659][ T29] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 476.441255][ T29] usb 9-1: USB disconnect, device number 76 [ 476.686202][T13779] lo speed is unknown, defaulting to 1000 [ 476.753893][T13779] lo speed is unknown, defaulting to 1000 [ 476.869990][T11469] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 476.874607][T11469] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 476.952139][T13779] lo speed is unknown, defaulting to 1000 [ 476.974901][T13799] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 477.031829][T11469] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 477.034904][T13198] usb 7-1: new low-speed USB device number 81 using dummy_hcd [ 477.035313][T11469] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.149390][T11469] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 477.156326][T11469] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.184070][T13198] usb 7-1: Invalid ep0 maxpacket: 16 [ 477.253685][ T24] usb 9-1: new high-speed USB device number 77 using dummy_hcd [ 477.286179][T11469] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 477.289878][T11469] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.313245][T13198] usb 7-1: new low-speed USB device number 82 using dummy_hcd [ 477.403054][ T24] usb 9-1: Using ep0 maxpacket: 8 [ 477.407747][ T24] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 477.411379][ T24] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 477.415754][ T24] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 477.424592][ T24] usb 9-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 477.431844][ T24] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 477.437624][ T24] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 477.441257][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 477.451569][ T24] usbtmc 9-1:16.0: bulk endpoints not found [ 477.462470][T13198] usb 7-1: Invalid ep0 maxpacket: 16 [ 477.465272][T13198] usb usb7-port1: attempt power cycle [ 477.530316][T13779] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.533625][T13779] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.536762][T13779] bridge_slave_0: entered allmulticast mode [ 477.540616][T13779] bridge_slave_0: entered promiscuous mode [ 477.546355][T13779] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.549513][T13779] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.552715][T13779] bridge_slave_1: entered allmulticast mode [ 477.556602][T13779] bridge_slave_1: entered promiscuous mode [ 477.616934][T13779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 477.633992][T11469] lo: left allmulticast mode [ 477.775538][T11469] bond0 (unregistering): (slave ip6gretap1): Releasing active interface [ 477.817090][T13198] usb 7-1: new low-speed USB device number 83 using dummy_hcd [ 477.842135][T13198] usb 7-1: Invalid ep0 maxpacket: 16 [ 477.956587][T11469] bond1 (unregistering): Released all slaves [ 477.969321][T13198] usb 7-1: new low-speed USB device number 84 using dummy_hcd [ 477.976533][T11469] bond0 (unregistering): Released all slaves [ 477.990602][T13779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 477.999864][T13198] usb 7-1: Invalid ep0 maxpacket: 16 [ 478.002632][T13198] usb usb7-port1: unable to enumerate USB device [ 478.017599][T13779] team0: Port device team_slave_0 added [ 478.022826][T13779] team0: Port device team_slave_1 added [ 478.043496][T13779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 478.046461][T13779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 478.057018][T13779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 478.062301][T13779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 478.065177][T13779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 478.075658][T13779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 478.137571][T13779] hsr_slave_0: entered promiscuous mode [ 478.141347][T13779] hsr_slave_1: entered promiscuous mode [ 478.144532][T13779] debugfs: 'hsr0' already exists in 'hsr' [ 478.146901][T13779] Cannot create hsr debugfs directory [ 478.160318][T11469] tipc: Disabling bearer [ 478.163296][T11469] tipc: Left network mode [ 478.313834][ T5456] 8021q: adding VLAN 0 to HW filter on device eth10 [ 478.327565][ T64] Bluetooth: hci0: command tx timeout [ 478.952811][T11469] hsr_slave_0: left promiscuous mode [ 478.958499][T11469] hsr_slave_1: left promiscuous mode [ 478.962952][T11469] veth1_macvtap: left promiscuous mode [ 478.968101][T11469] veth0_macvtap: left promiscuous mode [ 478.970463][T11469] veth1_vlan: left promiscuous mode [ 478.972376][T11469] veth0_vlan: left promiscuous mode [ 479.220334][ T163] smc: removing ib device syz1 [ 479.273872][T13779] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 479.288329][ T226] smbdirect: ib_dev[syz2] removed [ 479.299126][ T163] smbdirect: ib_dev[syz1] removed [ 479.299916][T13779] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 479.330808][T13779] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 479.358013][T13779] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 479.363982][T13779] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 479.413251][T13779] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 479.428028][T13779] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 479.434865][T13779] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 479.545229][T13779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 479.568768][T13779] 8021q: adding VLAN 0 to HW filter on device team0 [ 479.604832][ T226] bridge0: port 1(bridge_slave_0) entered blocking state [ 479.607322][ T226] bridge0: port 1(bridge_slave_0) entered forwarding state [ 479.619076][ T226] bridge0: port 2(bridge_slave_1) entered blocking state [ 479.621550][ T226] bridge0: port 2(bridge_slave_1) entered forwarding state [ 479.975252][T13779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 480.007307][ T29] usb 9-1: USB disconnect, device number 77 [ 480.048511][T13779] veth0_vlan: entered promiscuous mode [ 480.055905][T13779] veth1_vlan: entered promiscuous mode [ 480.096154][T13779] veth0_macvtap: entered promiscuous mode [ 480.109931][T13779] veth1_macvtap: entered promiscuous mode [ 480.136001][T13779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 480.144741][T13779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 480.153094][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.159624][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.193484][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.219977][T13863] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2248'. [ 480.238876][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.291646][T13863] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 480.296387][T13863] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 480.301706][T13863] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 480.389207][T13863] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 480.404984][ T64] Bluetooth: hci0: command tx timeout [ 480.444261][ T163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 480.457576][ T163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 480.809935][T11469] IPVS: stop unused estimator thread 0... [ 481.441376][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 481.444887][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 481.626869][T13882] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 481.777270][ T1490] usb 10-1: new high-speed USB device number 77 using dummy_hcd [ 481.817234][ T9] usb 7-1: new high-speed USB device number 85 using dummy_hcd [ 481.846948][ T5837] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 481.946607][ T1490] usb 10-1: Using ep0 maxpacket: 16 [ 481.950772][ T1490] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 481.955318][ T1490] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 481.959508][ T1490] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 481.964582][ T1490] usb 10-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 481.966445][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 481.967614][ T1490] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.971403][ T9] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 481.974447][ T1490] usb 10-1: config 0 descriptor?? [ 481.976814][ T9] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 481.982785][ T9] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 481.987186][ T9] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 481.992627][ T9] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 481.996167][ T5837] usb 6-1: Using ep0 maxpacket: 16 [ 481.997060][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.999806][ T5837] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 482.005381][ T5837] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 482.008910][ T5837] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 482.013886][ T5837] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 482.017244][ T5837] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.021675][ T5837] usb 6-1: config 0 descriptor?? [ 482.335326][ T9] usb 7-1: usb_control_msg returned -71 [ 482.337886][ T9] usbtmc 7-1:16.0: can't read capabilities [ 482.345573][ T9] usb 7-1: USB disconnect, device number 85 [ 482.393336][ T1490] usbhid 10-1:0.0: can't add hid device: -71 [ 482.396437][ T1490] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 482.401740][ T1490] usb 10-1: USB disconnect, device number 77 [ 482.431270][ T5837] shield 0003:0955:7214.002B: unknown main item tag 0x0 [ 482.434633][ T5837] shield 0003:0955:7214.002B: unknown main item tag 0x0 [ 482.437633][ T5837] shield 0003:0955:7214.002B: unknown main item tag 0x0 [ 482.440824][ T5837] shield 0003:0955:7214.002B: unknown main item tag 0x0 [ 482.443818][ T5837] shield 0003:0955:7214.002B: unknown main item tag 0x0 [ 482.450292][ T5837] input: HID 0955:7214 Haptics as /devices/virtual/input/input58 [ 482.463405][ T64] Bluetooth: hci0: command tx timeout [ 482.473540][ T5837] shield 0003:0955:7214.002B: Registered Thunderstrike controller [ 482.477014][ T5837] shield 0003:0955:7214.002B: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 482.630311][ T5830] shield 0003:0955:7214.002B: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 482.634765][ T34] usb 6-1: USB disconnect, device number 63 [ 482.640440][ T5830] shield 0003:0955:7214.002B: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 482.646595][ T5830] shield 0003:0955:7214.002B: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 482.650402][ T5830] shield 0003:0955:7214.002B: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 483.239129][ T1490] usb 7-1: new low-speed USB device number 86 using dummy_hcd [ 483.398346][ T1490] usb 7-1: Invalid ep0 maxpacket: 16 [ 483.537823][ T1490] usb 7-1: new low-speed USB device number 87 using dummy_hcd [ 483.780630][ T42] audit: type=1804 audit(1784580182.392:2149): pid=13908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.2261" name="/newroot/393/file1" dev="fuse" ino=1 res=1 errno=0 [ 483.793331][ T42] audit: type=1804 audit(1784580182.402:2150): pid=13909 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2261" name="/newroot/393/file1" dev="fuse" ino=1 res=1 errno=0 [ 483.802326][ T42] audit: type=1800 audit(1784580182.402:2151): pid=13909 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2261" name="/" dev="fuse" ino=1 res=0 errno=0 [ 483.816408][ T1490] usb 7-1: Invalid ep0 maxpacket: 16 [ 483.818528][ T1490] usb usb7-port1: attempt power cycle [ 483.932292][ T42] audit: type=1804 audit(1784580182.543:2152): pid=13913 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2262" name="/newroot/3/bus/bus" dev="overlay" ino=41 res=1 errno=0 [ 484.164019][ T1490] usb 7-1: new low-speed USB device number 88 using dummy_hcd [ 484.194841][ T1490] usb 7-1: Invalid ep0 maxpacket: 16 [ 484.323681][ T1490] usb 7-1: new low-speed USB device number 89 using dummy_hcd [ 484.343498][ T1490] usb 7-1: Invalid ep0 maxpacket: 16 [ 484.347777][ T1490] usb usb7-port1: unable to enumerate USB device [ 484.542938][ T64] Bluetooth: hci0: command tx timeout [ 484.745240][T13917] genirq: Flags mismatch irq 4. 00200000 (das16m1) vs. 00200080 (ttyS0) [ 485.109099][ T5894] usb 9-1: new high-speed USB device number 78 using dummy_hcd [ 485.258364][ T5894] usb 9-1: Using ep0 maxpacket: 16 [ 485.262225][ T5894] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 485.266612][ T5894] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 485.270897][ T5894] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 485.275318][ T5894] usb 9-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 485.278513][ T5894] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.282798][ T5894] usb 9-1: config 0 descriptor?? [ 485.417289][T13943] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2270'. [ 485.420885][T13943] openvswitch: netlink: Flow actions attr not present in new flow. [ 485.714031][ T5894] usbhid 9-1:0.0: can't add hid device: -71 [ 485.719612][ T5894] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 485.731240][ T5894] usb 9-1: USB disconnect, device number 78 [ 486.300005][T13956] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2274'. [ 486.303073][T13956] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 486.421558][T13956] vlan2: entered promiscuous mode [ 486.423743][T13956] hsr0: entered promiscuous mode [ 486.425998][T13956] vlan2: entered allmulticast mode [ 486.427629][T13956] hsr0: entered allmulticast mode [ 486.429964][T13956] hsr_slave_0: entered allmulticast mode [ 486.433219][T13956] hsr_slave_1: entered allmulticast mode [ 486.486005][T13956] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2274'. [ 486.491825][T13956] hsr_slave_0: left promiscuous mode [ 486.496089][T13956] hsr_slave_1: left promiscuous mode [ 486.931293][T13968] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2278'. [ 487.044238][ T42] audit: type=1804 audit(1784580185.670:2153): pid=13978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2280" name="/newroot/9/bus/bus" dev="overlay" ino=83 res=1 errno=0 [ 487.282422][ T42] audit: type=1804 audit(1784580185.911:2154): pid=13987 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.2282" name="/newroot/539/bus/bus" dev="overlay" ino=2989 res=1 errno=0 [ 487.755422][ T9] usb 10-1: new low-speed USB device number 78 using dummy_hcd [ 487.914344][ T9] usb 10-1: Invalid ep0 maxpacket: 16 [ 488.043684][T13035] usb 9-1: new high-speed USB device number 79 using dummy_hcd [ 488.053951][ T9] usb 10-1: new low-speed USB device number 79 using dummy_hcd [ 488.193235][T13035] usb 9-1: Using ep0 maxpacket: 16 [ 488.198052][T13035] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 488.203266][T13035] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 488.204304][ T9] usb 10-1: Invalid ep0 maxpacket: 16 [ 488.207457][T13035] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 488.217152][T13035] usb 9-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 488.217195][ T9] usb usb10-port1: attempt power cycle [ 488.226375][T13035] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.241700][T13035] usb 9-1: config 0 descriptor?? [ 488.453476][T14009] tc_dump_action: action bad kind [ 488.581362][ T9] usb 10-1: new low-speed USB device number 80 using dummy_hcd [ 488.611453][ T9] usb 10-1: Invalid ep0 maxpacket: 16 [ 488.678191][T13035] usbhid 9-1:0.0: can't add hid device: -71 [ 488.681506][T13035] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 488.690187][T13035] usb 9-1: USB disconnect, device number 79 [ 488.740877][ T9] usb 10-1: new low-speed USB device number 81 using dummy_hcd [ 488.760712][ T9] usb 10-1: Invalid ep0 maxpacket: 16 [ 488.763582][ T9] usb usb10-port1: unable to enumerate USB device [ 489.120972][T14014] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2290'. [ 489.441842][ T42] audit: type=1804 audit(1784580188.082:2155): pid=14021 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2292" name="/newroot/13/bus/bus" dev="overlay" ino=112 res=1 errno=0 [ 489.496354][ T34] usb 9-1: new high-speed USB device number 80 using dummy_hcd [ 489.645914][ T34] usb 9-1: Using ep0 maxpacket: 8 [ 489.651501][ T34] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 489.656063][ T34] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 489.662506][ T34] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 489.668629][ T34] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 489.674099][ T34] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 489.680595][ T34] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 489.688285][ T34] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 489.693959][ T34] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.709062][ T34] usbtmc 9-1:16.0: probe with driver usbtmc failed with error -22 [ 490.143206][ T9] usb 7-1: new high-speed USB device number 90 using dummy_hcd [ 490.294381][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 490.299519][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 490.304177][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 490.309874][ T9] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 490.314703][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.321347][ T9] usb 7-1: config 0 descriptor?? [ 490.467972][T14032] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2296'. [ 490.475441][T14032] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 490.730917][ T9] usbhid 7-1:0.0: can't add hid device: -71 [ 490.733854][ T9] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 490.740964][ T9] usb 7-1: USB disconnect, device number 90 [ 491.586114][T13035] usb 7-1: new high-speed USB device number 91 using dummy_hcd [ 491.714747][T14056] could not allocate digest TFM handle blake2s-160-generic [ 491.745361][T13035] usb 7-1: Using ep0 maxpacket: 16 [ 491.749373][T13035] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 491.753463][T13035] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 491.757093][T13035] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 491.761213][T13035] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 491.764335][T13035] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.768894][T13035] usb 7-1: config 0 descriptor?? [ 492.084177][ T1043] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 492.191850][T13035] usbhid 7-1:0.0: can't add hid device: -71 [ 492.198772][T13035] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 492.207448][T13035] usb 7-1: USB disconnect, device number 91 [ 492.235642][ T1043] usb 6-1: config 1 interface 0 altsetting 253 bulk endpoint 0x3 has invalid maxpacket 1024 [ 492.242506][ T1043] usb 6-1: config 1 interface 0 altsetting 253 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 492.262896][ T1043] usb 6-1: config 1 interface 0 has no altsetting 0 [ 492.268443][ T9] usb 9-1: USB disconnect, device number 80 [ 492.272276][ T1043] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 492.277605][ T1043] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 492.280964][ T1043] usb 6-1: SerialNumber: syz [ 492.292326][T14064] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 492.323942][ T5829] usb 10-1: new low-speed USB device number 82 using dummy_hcd [ 492.471941][ T5829] usb 10-1: Invalid ep0 maxpacket: 16 [ 492.503336][T14064] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 492.601304][ T5829] usb 10-1: new low-speed USB device number 83 using dummy_hcd [ 492.750624][ T5829] usb 10-1: Invalid ep0 maxpacket: 16 [ 492.753390][ T5829] usb usb10-port1: attempt power cycle [ 492.756805][T14074] Bluetooth: hci1: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 492.766515][ T1164] Bluetooth: hci1: Frame reassembly failed (-84) [ 492.856063][ T1043] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 492.864488][ T1043] usb 6-1: USB disconnect, device number 64 [ 493.099329][ T5829] usb 10-1: new low-speed USB device number 84 using dummy_hcd [ 493.130726][ T5829] usb 10-1: Invalid ep0 maxpacket: 16 [ 493.278173][ T5829] usb 10-1: new low-speed USB device number 85 using dummy_hcd [ 493.298682][ T5829] usb 10-1: Invalid ep0 maxpacket: 16 [ 493.301707][ T5829] usb usb10-port1: unable to enumerate USB device [ 493.754027][T14084] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 493.882974][ T42] audit: type=1804 audit(1784580192.543:2156): pid=14088 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.2308" name="/newroot/484/bus/bus" dev="overlay" ino=2765 res=1 errno=0 [ 494.801601][ T64] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 495.000395][ T9] usb 9-1: new high-speed USB device number 81 using dummy_hcd [ 495.149663][ T9] usb 9-1: Using ep0 maxpacket: 16 [ 495.154557][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 495.158913][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 495.165464][ T9] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 495.170580][ T9] usb 9-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 495.174260][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.179944][ T9] usb 9-1: config 0 descriptor?? [ 495.508197][ T5894] usb 10-1: new high-speed USB device number 86 using dummy_hcd [ 495.603175][ T9] shield 0003:0955:7214.002C: unknown main item tag 0x0 [ 495.607754][ T9] shield 0003:0955:7214.002C: unknown main item tag 0x0 [ 495.610729][ T9] shield 0003:0955:7214.002C: unknown main item tag 0x0 [ 495.613630][ T9] shield 0003:0955:7214.002C: unknown main item tag 0x0 [ 495.616416][ T9] shield 0003:0955:7214.002C: unknown main item tag 0x0 [ 495.625772][ T9] input: HID 0955:7214 Haptics as /devices/virtual/input/input59 [ 495.658765][ T5894] usb 10-1: Using ep0 maxpacket: 8 [ 495.662302][ T9] shield 0003:0955:7214.002C: Registered Thunderstrike controller [ 495.668536][ T5894] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 495.672122][ T9] shield 0003:0955:7214.002C: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.4-1/input0 [ 495.680505][ T5894] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 495.684674][ T5894] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 495.689215][ T5894] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 495.693367][ T5894] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 495.697705][ T5894] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 495.703171][ T5894] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 495.707114][ T5894] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.717684][ T5894] usbtmc 10-1:16.0: probe with driver usbtmc failed with error -22 [ 495.806009][ T10] usb 9-1: USB disconnect, device number 81 [ 495.808502][ T9] shield 0003:0955:7214.002C: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 495.818473][ T9] shield 0003:0955:7214.002C: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 495.824745][ T9] shield 0003:0955:7214.002C: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 495.835299][ T9] shield 0003:0955:7214.002C: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 495.841669][T14105] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(10) [ 495.844575][T14105] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 495.848571][T14105] vhci_hcd vhci_hcd.0: Device attached [ 496.318372][T14106] vhci_hcd: connection closed [ 496.320577][T11472] vhci_hcd vhci_hcd.2: stop threads [ 496.325219][T11472] vhci_hcd vhci_hcd.2: release socket [ 496.327571][T11472] vhci_hcd vhci_hcd.2: disconnect device [ 496.402738][T14111] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(10) [ 496.405507][T14111] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 496.409020][T14111] vhci_hcd vhci_hcd.0: Device attached [ 496.419994][T14112] vhci_hcd: connection closed [ 496.420275][T11469] vhci_hcd vhci_hcd.4: stop threads [ 496.424676][T11469] vhci_hcd vhci_hcd.4: release socket [ 496.426791][T11469] vhci_hcd vhci_hcd.4: disconnect device [ 497.956517][ T42] audit: type=1326 audit(1784580196.632:2157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 497.966993][ T42] audit: type=1326 audit(1784580196.632:2158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 497.975897][ T42] audit: type=1326 audit(1784580196.642:2159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 498.116282][ T42] audit: type=1326 audit(1784580196.642:2160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 498.124742][ T42] audit: type=1326 audit(1784580196.642:2161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=396 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 498.132223][ T42] audit: type=1326 audit(1784580196.642:2162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 498.158887][ T42] audit: type=1326 audit(1784580196.652:2163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 498.173347][ T42] audit: type=1326 audit(1784580196.652:2164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 498.191180][ T34] usb 10-1: USB disconnect, device number 86 [ 498.201270][ T42] audit: type=1326 audit(1784580196.652:2165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 498.222363][ T42] audit: type=1326 audit(1784580196.652:2166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14135 comm="syz.4.2323" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fa7fec code=0x7ffc0000 [ 498.417584][T14148] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(10) [ 498.419714][T14148] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 498.422457][T14148] vhci_hcd vhci_hcd.0: Device attached [ 498.503256][T14155] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2328'. [ 498.507026][T14155] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2328'. [ 498.516325][T14155] syz_tun: entered promiscuous mode [ 498.521235][T14155] syz_tun: left promiscuous mode [ 498.554573][T14157] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2328'. [ 498.557569][T14157] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2328'. [ 498.563525][T14157] syz_tun: entered promiscuous mode [ 498.567601][T14158] netlink: 'syz.5.2325': attribute type 1 has an invalid length. [ 498.590270][T14157] syz_tun: left promiscuous mode [ 498.779609][T14165] binder: BINDER_SET_CONTEXT_MGR already set [ 498.782513][T14165] binder: 14164:14165 ioctl 4018620d 80000240 returned -16 [ 498.807180][T14165] binder: BINDER_SET_CONTEXT_MGR already set [ 498.813281][T14165] binder: 14164:14165 ioctl 4018620d 80000040 returned -16 [ 498.830255][T14165] binder: 14164:14165 ioctl 40045532 80000680 returned -22 [ 498.863726][ T5894] usb 40-1: SetAddress Request (26) to port 0 [ 498.866027][ T5894] usb 40-1: new SuperSpeed USB device number 26 using vhci_hcd [ 499.006117][T14152] vhci_hcd: connection reset by peer [ 499.008480][T11472] vhci_hcd vhci_hcd.1: stop threads [ 499.011371][T11472] vhci_hcd vhci_hcd.1: release socket [ 499.014220][T11472] vhci_hcd vhci_hcd.1: disconnect device [ 499.241728][ T1490] usb 9-1: new high-speed USB device number 82 using dummy_hcd [ 499.410639][ T1490] usb 9-1: Using ep0 maxpacket: 8 [ 499.414550][ T1490] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 499.417235][ T1490] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 499.420204][ T1490] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 499.423327][ T1490] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 499.426414][ T1490] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 499.429435][ T1490] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 499.433551][ T1490] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 499.436682][ T1490] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.449925][ T1490] usbtmc 9-1:16.0: probe with driver usbtmc failed with error -22 [ 500.151962][T14192] netlink: 'syz.2.2338': attribute type 1 has an invalid length. [ 500.172549][T14189] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 500.176087][T14189] block device autoloading is deprecated and will be removed. [ 500.222104][T14195] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2338'. [ 500.330069][T14192] IPVS: Scheduler module ip_vs_sip not found [ 500.543995][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.638998][T14210] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(10) [ 500.641836][T14210] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 500.645059][T14210] vhci_hcd vhci_hcd.0: Device attached [ 500.786182][T14220] input: syz1 as /devices/virtual/input/input60 [ 501.077452][T14214] vhci_hcd: connection closed [ 501.077807][T11472] vhci_hcd vhci_hcd.2: stop threads [ 501.083439][T11472] vhci_hcd vhci_hcd.2: release socket [ 501.085648][T11472] vhci_hcd vhci_hcd.2: disconnect device [ 501.671720][T14225] netlink: 'syz.5.2347': attribute type 4 has an invalid length. [ 501.684752][T14227] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 501.686776][T14227] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 501.704392][T14227] vhci_hcd vhci_hcd.0: Device attached [ 501.717187][T14228] vhci_hcd: cannot find the pending unlink 8 [ 501.934522][T14234] netlink: 112 bytes leftover after parsing attributes in process `syz.1.2349'. [ 501.938308][T14234] netlink: 112 bytes leftover after parsing attributes in process `syz.1.2349'. [ 501.940107][ T1043] usb 41-1: new high-speed USB device number 3 using vhci_hcd [ 502.017633][ T34] usb 9-1: USB disconnect, device number 82 [ 502.513401][T14228] vhci_hcd: connection reset by peer [ 502.517428][T11472] vhci_hcd vhci_hcd.2: stop threads [ 502.527569][T11472] vhci_hcd vhci_hcd.2: release socket [ 502.534335][T11472] vhci_hcd vhci_hcd.2: disconnect device [ 503.091978][T14261] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 503.232812][T14258] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 503.259599][ T9] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 503.411371][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 503.427757][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 503.438218][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 503.452067][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 503.457550][ T9] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 503.460810][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.467267][ T9] usb 6-1: config 0 descriptor?? [ 503.863644][T14263] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2358'. [ 503.884191][ T5894] usb 40-1: device descriptor read/8, error -110 [ 504.242040][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 504.244700][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 504.251192][ T9] usb 6-1: USB disconnect, device number 65 [ 504.461161][ T5894] usb usb40-port1: attempt power cycle [ 505.288711][ T5894] usb usb40-port1: unable to enumerate USB device [ 505.871590][T14288] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2365'. [ 505.904462][ T5830] usb 10-1: new full-speed USB device number 87 using dummy_hcd [ 506.104364][ T5830] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 506.130777][ T5830] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 506.242017][ T5830] usb 10-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 506.244659][ T5830] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.251414][ T5830] usb 10-1: config 0 descriptor?? [ 506.260857][ T5830] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 506.326255][ T5830] dvb-usb: bulk message failed: -22 (3/0) [ 506.447216][T14293] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 506.757919][ T5830] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 506.762150][ T5830] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 506.790037][ T5830] usb 10-1: media controller created [ 506.803005][ T5830] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 506.966693][ T5830] dvb-usb: bulk message failed: -22 (6/0) [ 506.978456][ T5830] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 507.040226][ T5830] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb10/10-1/input/input61 [ 507.119248][ T1043] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 507.132600][ T5830] dvb-usb: schedule remote query interval to 150 msecs. [ 507.135471][ T5830] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 507.151309][ T5830] usb 10-1: USB disconnect, device number 87 [ 507.662853][ T5830] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 507.853836][T14302] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2370'. [ 508.094068][T14308] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2373'. [ 508.112851][T14308] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2373'. [ 508.119036][T14313] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2374'. [ 508.140245][T14308] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2373'. [ 508.951901][ T5830] usb 6-1: new low-speed USB device number 66 using dummy_hcd [ 509.573438][ T5830] usb 6-1: Invalid ep0 maxpacket: 16 [ 509.768780][T14335] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 509.780159][ T5830] usb 6-1: new low-speed USB device number 67 using dummy_hcd [ 510.029391][ T5830] usb 6-1: Invalid ep0 maxpacket: 16 [ 510.033935][ T5830] usb usb6-port1: attempt power cycle [ 510.481205][ T5830] usb 6-1: new low-speed USB device number 68 using dummy_hcd [ 510.511787][ T5830] usb 6-1: Invalid ep0 maxpacket: 16 [ 510.756574][ T5830] usb 6-1: new low-speed USB device number 69 using dummy_hcd [ 510.819480][ T5830] usb 6-1: Invalid ep0 maxpacket: 16 [ 510.823354][ T5830] usb usb6-port1: unable to enumerate USB device [ 511.196312][T14343] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(10) [ 511.198249][T14343] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 511.224796][T14343] vhci_hcd vhci_hcd.0: Device attached [ 511.416982][T14344] vhci_hcd: connection closed [ 511.417391][T11472] vhci_hcd vhci_hcd.5: stop threads [ 511.420880][T11472] vhci_hcd vhci_hcd.5: release socket [ 511.423223][T11472] vhci_hcd vhci_hcd.5: disconnect device [ 512.229203][ T1490] IPVS: starting estimator thread 0... [ 512.262163][T14352] IPVS: set_ctl: invalid protocol: 94 10.1.1.1:20000 [ 512.341115][T14353] IPVS: using max 30 ests per chain, 72000 per kthread [ 512.348338][T14358] netlink: 'syz.5.2386': attribute type 1 has an invalid length. [ 512.500472][T14360] gretap1: entered allmulticast mode [ 512.543448][T14360] bond2: (slave gretap1): making interface the new active one [ 512.591860][T14360] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 514.211425][T14382] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2390'. [ 514.543713][ T1043] usb 6-1: new low-speed USB device number 70 using dummy_hcd [ 514.949656][ T1043] usb 6-1: Invalid ep0 maxpacket: 16 [ 515.174974][ T1043] usb 6-1: new low-speed USB device number 71 using dummy_hcd [ 515.527247][ T1043] usb 6-1: Invalid ep0 maxpacket: 16 [ 515.540429][ T1043] usb usb6-port1: attempt power cycle [ 515.959628][ T1043] usb 6-1: new low-speed USB device number 72 using dummy_hcd [ 516.041230][ T1043] usb 6-1: Invalid ep0 maxpacket: 16 [ 516.328003][ T1043] usb 6-1: new low-speed USB device number 73 using dummy_hcd [ 516.350040][ T1043] usb 6-1: Invalid ep0 maxpacket: 16 [ 516.353297][ T1043] usb usb6-port1: unable to enumerate USB device [ 516.670699][T14396] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 516.684413][T14396] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 516.789773][T14396] overlayfs: inode number too big (/, ino=4611686018427387905, xinobits=3) [ 516.931550][T14396] overlayfs: d_ino too big (., ino=4611686018427387926, xinobits=3) [ 516.938404][T14396] overlayfs: d_ino too big (gadget, ino=4611686018427391513, xinobits=3) [ 516.950615][T14396] overlayfs: d_ino too big (snd_seq, ino=4611686018427391704, xinobits=3) [ 517.097355][T14396] overlayfs: d_ino too big (netdevsim, ino=4611686018427415268, xinobits=3) [ 517.240573][T14396] overlayfs: d_ino too big (serio, ino=4611686018427391530, xinobits=3) [ 517.306270][T14396] overlayfs: d_ino too big (ulpi, ino=4611686018427391467, xinobits=3) [ 517.354620][T14396] overlayfs: d_ino too big (coreboot, ino=4611686018427391616, xinobits=3) [ 517.358059][T14396] overlayfs: d_ino too big (hdaudio, ino=4611686018427391710, xinobits=3) [ 517.362430][T14396] overlayfs: d_ino too big (iio, ino=4611686018427391646, xinobits=3) [ 517.366374][T14396] overlayfs: d_ino too big (firewire, ino=4611686018427415282, xinobits=3) [ 517.769345][T14411] 9p: Bad value for 'port' [ 517.882618][ T1043] usb 9-1: new high-speed USB device number 83 using dummy_hcd [ 517.953599][ T1490] libceph: connect (1)[c::]:6789 error -101 [ 517.956094][ T1490] libceph: mon0 (1)[c::]:6789 connect error [ 518.047914][T14414] ceph: No mds server is up or the cluster is laggy [ 518.052052][ T1043] usb 9-1: Using ep0 maxpacket: 32 [ 518.057095][ T1043] usb 9-1: unable to get BOS descriptor or descriptor too short [ 518.062345][ T1043] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 518.065985][ T1043] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 518.069579][ T1043] usb 9-1: config 14 has no interface number 0 [ 518.072835][ T1043] usb 9-1: config 14 has no interface number 1 [ 518.075611][ T1043] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 518.079678][ T1043] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 518.129976][ T1043] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 518.141360][ T1043] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 518.146454][ T1043] usb 9-1: config 14 interface 57 has no altsetting 0 [ 518.152919][ T1043] usb 9-1: config 14 interface 228 has no altsetting 0 [ 518.163942][ T1043] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 518.168071][ T1043] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.179455][ T1043] usb 9-1: Product: syz [ 518.188042][ T1043] usb 9-1: Manufacturer: syz [ 518.190807][ T1043] usb 9-1: SerialNumber: syz [ 518.657679][T14423] overlayfs: failed to resolve './file1': -2 [ 518.694604][T14425] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2406'. [ 518.705085][ T226] Bluetooth: hci1: Frame reassembly failed (-90) [ 519.595297][T14428] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 520.181088][T14448] binder: 14445:14448 ioctl c018620c 80000240 returned -1 [ 520.367449][ T1043] legousbtower 9-1:14.57: interrupt endpoints not found [ 520.376920][ T1043] legousbtower 9-1:14.228: interrupt endpoints not found [ 520.380853][ T1043] usb 9-1: USB disconnect, device number 83 [ 520.416222][T14457] lo speed is unknown, defaulting to 1000 [ 520.714392][ T5756] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 521.022385][ T5837] usb 9-1: new low-speed USB device number 84 using dummy_hcd [ 521.239900][ T5837] usb 9-1: Invalid ep0 maxpacket: 16 [ 521.379765][ T5837] usb 9-1: new low-speed USB device number 85 using dummy_hcd [ 521.533280][T14499] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2430'. [ 521.548103][ T5837] usb 9-1: Invalid ep0 maxpacket: 16 [ 521.551170][T14499] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2430'. [ 521.555198][T14499] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2430'. [ 521.558934][ T5837] usb usb9-port1: attempt power cycle [ 521.909924][ T5837] usb 9-1: new low-speed USB device number 86 using dummy_hcd [ 521.931886][ T5837] usb 9-1: Invalid ep0 maxpacket: 16 [ 522.028116][ T42] kauditd_printk_skb: 112 callbacks suppressed [ 522.028131][ T42] audit: type=1804 audit(1784580476.781:2279): pid=14513 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.2433" name="/newroot/437/bus/bus" dev="overlay" ino=2514 res=1 errno=0 [ 522.059750][ T5837] usb 9-1: new low-speed USB device number 87 using dummy_hcd [ 522.090220][ T5837] usb 9-1: Invalid ep0 maxpacket: 16 [ 522.101482][ T5837] usb usb9-port1: unable to enumerate USB device [ 522.196973][T14520] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2437'. [ 522.213574][T14520] bochs-drm 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 522.554787][T14526] bridge4: entered promiscuous mode [ 522.559347][T14526] bridge4: entered allmulticast mode [ 523.700976][T14542] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2444'. [ 524.983293][T14560] xt_TPROXY: Can be used only with -p tcp or -p udp [ 525.004009][ T1043] libceph: connect (1)[c::]:6789 error -101 [ 525.006497][ T1043] libceph: mon0 (1)[c::]:6789 connect error [ 525.042945][T14563] ceph: No mds server is up or the cluster is laggy [ 525.270268][ T1043] libceph: connect (1)[c::]:6789 error -101 [ 525.275470][ T1043] libceph: mon0 (1)[c::]:6789 connect error [ 525.792709][T14585] FAULT_INJECTION: forcing a failure. [ 525.792709][T14585] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 525.802876][T14585] CPU: 0 UID: 0 PID: 14585 Comm: syz.1.2453 Tainted: G L syzkaller #0 PREEMPT(full) [ 525.802898][T14585] Tainted: [L]=SOFTLOCKUP [ 525.802902][T14585] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 525.802931][T14585] Call Trace: [ 525.802990][T14585] [ 525.803000][T14585] dump_stack_lvl+0x100/0x190 [ 525.803186][T14585] should_fail_ex.cold+0x5/0xa [ 525.803228][T14585] save_fsave_header+0x14c/0x2f0 [ 525.803272][T14585] ? __pfx_save_fsave_header+0x10/0x10 [ 525.803307][T14585] ? copy_fpstate_to_sigframe+0x2b8/0xae0 [ 525.803333][T14585] ? __local_bh_enable_ip+0x9e/0x120 [ 525.803350][T14585] copy_fpstate_to_sigframe+0x755/0xae0 [ 525.803368][T14585] ? do_raw_spin_lock+0x128/0x260 [ 525.803413][T14585] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 525.803444][T14585] ? posixtimer_deliver_signal+0x19d/0x6e0 [ 525.803464][T14585] ? x86_task_fpu+0x5f/0x90 [ 525.803485][T14585] get_sigframe+0x3fb/0x940 [ 525.803507][T14585] ? __pfx_get_sigframe+0x10/0x10 [ 525.803529][T14585] ? rcu_is_watching+0x12/0xc0 [ 525.803548][T14585] ? siginfo_layout+0x156/0x290 [ 525.803576][T14585] ia32_setup_rt_frame+0xe7/0xaf0 [ 525.803597][T14585] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 525.803622][T14585] arch_do_signal_or_restart+0x459/0x7a0 [ 525.803648][T14585] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 525.803675][T14585] ? fput+0x79/0x100 [ 525.803723][T14585] exit_to_user_mode_loop+0x139/0x6f0 [ 525.803749][T14585] ? rcu_is_watching+0x12/0xc0 [ 525.803767][T14585] do_int80_emulation+0x513/0x720 [ 525.803911][T14585] asm_int80_emulation+0x1a/0x20 [ 525.803929][T14585] RIP: 0023:0xf71372eb [ 525.803943][T14585] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 525.803959][T14585] RSP: 002b:00000000f53cc4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 525.804091][T14585] RAX: 0000000000000001 RBX: 0000000000000008 RCX: 00000000f53cc5c0 [ 525.804102][T14585] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 525.804112][T14585] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 525.804121][T14585] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 525.804131][T14585] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 525.804154][T14585] [ 526.212436][T14588] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2455'. [ 527.060544][T14594] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 527.063277][T14594] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 528.707457][T14607] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 528.710218][T14607] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 528.750065][T14607] vhci_hcd vhci_hcd.0: Device attached [ 529.375895][ T5829] usb 48-1: SetAddress Request (23) to port 0 [ 529.379542][ T5829] usb 48-1: new SuperSpeed USB device number 23 using vhci_hcd [ 529.958040][T14631] 9p: Bad value for 'port' [ 530.197085][T14588] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 530.289782][T14588] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.931708][T14588] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 530.960100][T14588] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.358603][T14608] vhci_hcd: connection reset by peer [ 531.385079][ T13] vhci_hcd vhci_hcd.5: stop threads [ 531.410840][ T13] vhci_hcd vhci_hcd.5: release socket [ 531.413203][ T13] vhci_hcd vhci_hcd.5: disconnect device [ 531.915026][T14645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2466'. [ 531.919088][T14645] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2466'. [ 532.118269][T14588] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 532.135122][T14588] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.357229][T11472] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 532.371188][T11472] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 532.374683][T11472] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 532.378272][T11472] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 532.500140][ T24] usb 10-1: new high-speed USB device number 88 using dummy_hcd [ 532.548711][ T5794] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 532.562567][ T5794] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.734626][ T24] usb 10-1: Using ep0 maxpacket: 8 [ 532.785810][ T5794] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 532.789070][ T24] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 532.789118][ T24] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 532.789136][ T24] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 532.814480][ T5794] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.814601][ T24] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 532.825255][ T24] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 532.833045][ T24] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 532.837167][ T24] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.280950][ T24] usb 10-1: usb_control_msg returned -32 [ 533.387652][ T24] usbtmc 10-1:16.0: can't read capabilities [ 533.920689][T11472] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.926408][T11472] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.934358][T11472] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.937717][T11472] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 533.990623][T14673] usbtmc 10-1:16.0: usb_control_msg returned -32 [ 534.892843][ T5829] usb 48-1: device descriptor read/8, error -110 [ 535.209252][ T60] usb 10-1: USB disconnect, device number 88 [ 535.523387][ T5829] usb usb48-port1: attempt power cycle [ 536.247688][T14701] batadv0: left promiscuous mode [ 536.319776][T14719] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2478'. [ 536.388574][T14701] gretap1: left allmulticast mode [ 536.417624][ T5837] lo speed is unknown, defaulting to 1000 [ 536.420176][ T5837] sz1: Port: 1 Link DOWN [ 536.426220][ T5837] lo speed is unknown, defaulting to 1000 [ 536.658869][ T5829] usb usb48-port1: unable to enumerate USB device [ 536.899740][T14732] comedi comedi0: comedi_bond: 4:2 attached, 32 channels from 1 devices [ 539.382295][T14719] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.385989][T14719] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.938527][T14719] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.957570][T14719] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.039805][T14754] loop7: detected capacity change from 0 to 7 [ 540.204587][T14719] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 540.238850][T14719] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 540.740105][T14754] Dev loop7: unable to read RDB block 7 [ 540.747699][T14754] loop7: unable to read partition table [ 540.750445][T14754] loop7: partition table beyond EOD, truncated [ 540.754075][T14754] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 541.129454][T14719] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 541.151857][T14719] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 542.334890][ T42] audit: type=1326 audit(1784580497.101:2280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.374415][ T42] audit: type=1326 audit(1784580497.131:2281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.423641][ T42] audit: type=1326 audit(1784580497.181:2282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=291 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.439817][ T42] audit: type=1326 audit(1784580497.181:2283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.450157][ T42] audit: type=1326 audit(1784580497.181:2284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.454685][T14777] netlink: 'syz.5.2492': attribute type 10 has an invalid length. [ 542.463510][ T42] audit: type=1326 audit(1784580497.181:2285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=374 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.475066][ T42] audit: type=1326 audit(1784580497.181:2286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.483118][ T42] audit: type=1326 audit(1784580497.181:2287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.490033][ T42] audit: type=1326 audit(1784580497.181:2288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.498652][ T42] audit: type=1326 audit(1784580497.181:2289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14774 comm="syz.1.2491" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 542.523291][T14777] team0 (unregistering): Port device team_slave_0 removed [ 542.553347][T14777] team0 (unregistering): Port device team_slave_1 removed [ 542.562936][T11472] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.566097][T11472] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.604600][T11472] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.607290][T11472] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.635328][T11472] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.649735][T11472] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.701719][T11472] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.709704][T11472] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.785855][ T64] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 542.790991][ T64] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 542.870693][ T64] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 542.884479][ T64] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 542.889882][ T64] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 543.038097][ T5756] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 543.063338][ T5756] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 543.158406][ T5756] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 543.359761][ T5756] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 543.372692][ T5756] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 544.014279][T11472] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.322855][T11472] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.557595][T14787] lo speed is unknown, defaulting to 1000 [ 544.571503][T14808] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 544.646358][T11472] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.710430][T14825] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2501'. [ 544.714037][T14825] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2501'. [ 544.742721][ T5794] netdevsim netdevsim5 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.747310][ T5794] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.753193][ T5794] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.757220][ T5794] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.815372][T14829] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2503'. [ 544.825109][T11472] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 545.085290][T14829] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 545.182653][T14829] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 545.635895][T14827] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 545.641253][T14827] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 545.670845][ C2] ------------[ cut here ]------------ [ 545.674819][ C2] workqueue: cannot queue hci_cmd_timeout on wq hci1 [ 545.677275][ C2] WARNING: kernel/workqueue.c:2305 at __queue_work+0xd2d/0x12b0, CPU#2: kworker/2:1H/5117 [ 545.683145][ C2] Modules linked in: [ 545.685214][ C2] CPU: 2 UID: 0 PID: 5117 Comm: kworker/2:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 545.689363][ C2] Tainted: [L]=SOFTLOCKUP [ 545.691682][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 545.695871][ C2] Workqueue: events_highpri snd_vmidi_output_work [ 545.698547][ C2] RIP: 0010:__queue_work+0xd31/0x12b0 [ 545.700591][ C2] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 52 05 00 00 48 8d 3d 43 f2 56 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 545.707824][ C2] RSP: 0000:ffffc90000538be0 EFLAGS: 00010046 [ 545.710364][ C2] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100f22a94e [ 545.713677][ C2] RDX: ffff88806cdf5970 RSI: ffffffff8aaa7a90 RDI: ffffffff9125aaf0 [ 545.716949][ C2] RBP: ffff888079154a58 R08: 0000000000000005 R09: 0000000000000000 [ 545.720756][ C2] R10: 0000000000000100 R11: 0000000000000000 R12: ffff88806cdf5800 [ 545.724177][ C2] R13: 0000000000000000 R14: ffffffff81cebe40 R15: 0000000000000001 [ 545.727735][ C2] FS: 0000000000000000(0000) GS:ffff888096dee000(0000) knlGS:0000000000000000 [ 545.731514][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 545.734381][ C2] CR2: 0000000080003000 CR3: 00000000707e0000 CR4: 0000000000352ef0 [ 545.737472][ C2] Call Trace: [ 545.738983][ C2] [ 545.740212][ C2] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 545.742804][ C2] call_timer_fn+0x19a/0x610 [ 545.744768][ C2] ? __pfx_call_timer_fn+0x10/0x10 [ 545.746878][ C2] ? __run_timers+0x560/0xb00 [ 545.748591][ C2] ? __run_timers+0x560/0xb00 [ 545.750528][ C2] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 545.752931][ C2] __run_timers+0x570/0xb00 [ 545.754848][ C2] ? __pfx___run_timers+0x10/0x10 [ 545.756753][ C2] ? _raw_spin_lock_irq+0x45/0x50 [ 545.759281][ C2] run_timer_base+0x114/0x190 [ 545.761752][ C2] ? __pfx_run_timer_base+0x10/0x10 [ 545.764167][ C2] run_timer_softirq+0x1a/0x50 [ 545.766657][ C2] handle_softirqs+0x1ea/0x9b0 [ 545.768419][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 545.770111][ C2] ? _raw_spin_unlock+0x28/0x50 [ 545.771693][ C2] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 545.774007][ C2] __irq_exit_rcu+0x162/0x210 [ 545.775816][ C2] irq_exit_rcu+0x9/0x30 [ 545.777165][ C2] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 545.779279][ C2] [ 545.780283][ C2] [ 545.781378][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 545.783463][ C2] RIP: 0010:finish_task_switch.isra.0+0x2cd/0x10c0 [ 545.785874][ C2] Code: ab 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 e9 47 04 00 00 49 8d 7f 48 e8 60 3b e5 09 e8 bb 8b 3c 00 fb 48 8d bb f8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 [ 545.793072][ C2] RSP: 0000:ffffc90004d178f0 EFLAGS: 00000206 [ 545.795446][ C2] RAX: 000000000134c1bb RBX: ffff888026a72540 RCX: 0000000000000040 [ 545.798175][ C2] RDX: 0000000000000000 RSI: ffffffff8e1a6fd9 RDI: ffff888026a73c38 [ 545.800938][ C2] RBP: ffffc90004d17948 R08: 0000000000000001 R09: 0000000000000000 [ 545.803575][ C2] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024420000 [ 545.806382][ C2] R13: 0000000000000001 R14: ffffffff9122a244 R15: ffff88802b43b600 [ 545.809614][ C2] __schedule+0x1264/0x6730 [ 545.811595][ C2] ? __pfx___schedule+0x10/0x10 [ 545.813627][ C2] ? __wake_up+0x3f/0x60 [ 545.815451][ C2] ? __wake_up+0x3f/0x60 [ 545.817186][ C2] ? preempt_schedule_thunk+0x16/0x40 [ 545.819287][ C2] preempt_schedule_common+0x42/0xc0 [ 545.821431][ C2] preempt_schedule_thunk+0x16/0x40 [ 545.823575][ C2] _raw_spin_unlock_irqrestore+0x61/0x80 [ 545.825869][ C2] snd_rawmidi_transmit+0xf1/0x130 [ 545.828003][ C2] snd_vmidi_output_work+0x111/0x390 [ 545.830038][ C2] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 545.832537][ C2] ? rcu_is_watching+0x12/0xc0 [ 545.834499][ C2] process_one_work+0xa23/0x1940 [ 545.836517][ C2] ? __pfx_process_one_work+0x10/0x10 [ 545.838491][ C2] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 545.840944][ C2] worker_thread+0x5ef/0xe50 [ 545.842967][ C2] ? __pfx_worker_thread+0x10/0x10 [ 545.845184][ C2] ? kthread+0x13a/0x450 [ 545.846967][ C2] ? __pfx_worker_thread+0x10/0x10 [ 545.848916][ C2] kthread+0x370/0x450 [ 545.850613][ C2] ? __pfx_kthread+0x10/0x10 [ 545.852701][ C2] ret_from_fork+0x72b/0xd50 [ 545.854588][ C2] ? __pfx_ret_from_fork+0x10/0x10 [ 545.856671][ C2] ? __switch_to+0x800/0x10f0 [ 545.858612][ C2] ? __pfx_kthread+0x10/0x10 [ 545.860519][ C2] ret_from_fork_asm+0x1a/0x30 [ 545.862483][ C2] [ 545.863849][ C2] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 545.866713][ C2] CPU: 2 UID: 0 PID: 5117 Comm: kworker/2:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 545.871130][ C2] Tainted: [L]=SOFTLOCKUP [ 545.872941][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 545.877179][ C2] Workqueue: events_highpri snd_vmidi_output_work [ 545.879845][ C2] Call Trace: [ 545.881326][ C2] [ 545.882553][ C2] dump_stack_lvl+0x100/0x190 [ 545.884537][ C2] vpanic+0x552/0x970 [ 545.886253][ C2] ? __pfx_vpanic+0x10/0x10 [ 545.888198][ C2] panic+0xd1/0xe0 [ 545.889822][ C2] ? __pfx_panic+0x10/0x10 [ 545.891715][ C2] ? check_panic_on_warn+0x1f/0x90 [ 545.893900][ C2] check_panic_on_warn.cold+0x19/0x34 [ 545.896031][ C2] ? __queue_work+0xd2d/0x12b0 [ 545.898026][ C2] __warn.cold+0x191/0x318 [ 545.899888][ C2] __report_bug+0x30f/0x440 [ 545.901816][ C2] ? __queue_work+0xd2d/0x12b0 [ 545.903855][ C2] ? __pfx___report_bug+0x10/0x10 [ 545.905985][ C2] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 545.908256][ C2] ? __lock_acquire+0x49f/0x1a40 [ 545.910455][ C2] ? look_up_lock_class+0x55/0x120 [ 545.912711][ C2] report_bug_entry+0xe1/0x290 [ 545.914743][ C2] ? __queue_work+0xd31/0x12b0 [ 545.916730][ C2] handle_bug+0x1cd/0x2a0 [ 545.918266][ C2] exc_invalid_op+0x17/0x50 [ 545.919836][ C2] asm_exc_invalid_op+0x1a/0x20 [ 545.921685][ C2] RIP: 0010:__queue_work+0xd31/0x12b0 [ 545.923597][ C2] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 52 05 00 00 48 8d 3d 43 f2 56 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 545.931366][ C2] RSP: 0000:ffffc90000538be0 EFLAGS: 00010046 [ 545.933958][ C2] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100f22a94e [ 545.937229][ C2] RDX: ffff88806cdf5970 RSI: ffffffff8aaa7a90 RDI: ffffffff9125aaf0 [ 545.940524][ C2] RBP: ffff888079154a58 R08: 0000000000000005 R09: 0000000000000000 [ 545.943812][ C2] R10: 0000000000000100 R11: 0000000000000000 R12: ffff88806cdf5800 [ 545.947179][ C2] R13: 0000000000000000 R14: ffffffff81cebe40 R15: 0000000000000001 [ 545.950503][ C2] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 545.953123][ C2] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 545.955345][ C2] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 545.957775][ C2] call_timer_fn+0x19a/0x610 [ 545.959537][ C2] ? __pfx_call_timer_fn+0x10/0x10 [ 545.961431][ C2] ? __run_timers+0x560/0xb00 [ 545.963258][ C2] ? __run_timers+0x560/0xb00 [ 545.965050][ C2] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 545.967368][ C2] __run_timers+0x570/0xb00 [ 545.969139][ C2] ? __pfx___run_timers+0x10/0x10 [ 545.971243][ C2] ? _raw_spin_lock_irq+0x45/0x50 [ 545.973391][ C2] run_timer_base+0x114/0x190 [ 545.975402][ C2] ? __pfx_run_timer_base+0x10/0x10 [ 545.977628][ C2] run_timer_softirq+0x1a/0x50 [ 545.979652][ C2] handle_softirqs+0x1ea/0x9b0 [ 545.981581][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 545.983859][ C2] ? _raw_spin_unlock+0x28/0x50 [ 545.987699][ C2] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 545.990090][ C2] __irq_exit_rcu+0x162/0x210 [ 545.992582][ C2] irq_exit_rcu+0x9/0x30 [ 545.994505][ C2] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 545.997028][ C2] [ 545.998709][ C2] [ 546.000114][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 546.002873][ C2] RIP: 0010:finish_task_switch.isra.0+0x2cd/0x10c0 [ 546.005617][ C2] Code: ab 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 e9 47 04 00 00 49 8d 7f 48 e8 60 3b e5 09 e8 bb 8b 3c 00 fb 48 8d bb f8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 [ 546.014068][ C2] RSP: 0000:ffffc90004d178f0 EFLAGS: 00000206 [ 546.016988][ C2] RAX: 000000000134c1bb RBX: ffff888026a72540 RCX: 0000000000000040 [ 546.021002][ C2] RDX: 0000000000000000 RSI: ffffffff8e1a6fd9 RDI: ffff888026a73c38 [ 546.024570][ C2] RBP: ffffc90004d17948 R08: 0000000000000001 R09: 0000000000000000 [ 546.028099][ C2] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024420000 [ 546.031855][ C2] R13: 0000000000000001 R14: ffffffff9122a244 R15: ffff88802b43b600 [ 546.036101][ C2] __schedule+0x1264/0x6730 [ 546.038136][ C2] ? __pfx___schedule+0x10/0x10 [ 546.040833][ C2] ? __wake_up+0x3f/0x60 [ 546.042819][ C2] ? __wake_up+0x3f/0x60 [ 546.044409][ C2] ? preempt_schedule_thunk+0x16/0x40 [ 546.046920][ C2] preempt_schedule_common+0x42/0xc0 [ 546.049028][ C2] preempt_schedule_thunk+0x16/0x40 [ 546.051232][ C2] _raw_spin_unlock_irqrestore+0x61/0x80 [ 546.053065][ C2] snd_rawmidi_transmit+0xf1/0x130 [ 546.054845][ C2] snd_vmidi_output_work+0x111/0x390 [ 546.056559][ C2] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 546.058199][ C2] ? rcu_is_watching+0x12/0xc0 [ 546.059909][ C2] process_one_work+0xa23/0x1940 [ 546.061826][ C2] ? __pfx_process_one_work+0x10/0x10 [ 546.063750][ C2] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 546.065821][ C2] worker_thread+0x5ef/0xe50 [ 546.067660][ C2] ? __pfx_worker_thread+0x10/0x10 [ 546.069993][ C2] ? kthread+0x13a/0x450 [ 546.071656][ C2] ? __pfx_worker_thread+0x10/0x10 [ 546.073451][ C2] kthread+0x370/0x450 [ 546.074871][ C2] ? __pfx_kthread+0x10/0x10 [ 546.076485][ C2] ret_from_fork+0x72b/0xd50 [ 546.078082][ C2] ? __pfx_ret_from_fork+0x10/0x10 [ 546.079749][ C2] ? __switch_to+0x800/0x10f0 [ 546.081473][ C2] ? __pfx_kthread+0x10/0x10 [ 546.083349][ C2] ret_from_fork_asm+0x1a/0x30 [ 546.085861][ C2] [ 546.088324][ C2] Kernel Offset: disabled [ 546.090678][ C2] Rebooting in 86400 seconds..