last executing test programs:

19m45.552995746s ago: executing program 0 (id=2743):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='cdg', 0x3)
close(0x3)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
close(0xffffffffffffffff)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="b800000015000501"], 0xb8}, 0x1, 0x0, 0x0, 0x810}, 0x0)
close_range(r2, 0xffffffffffffffff, 0x0)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="5c00000002060102000000000080000000000000050004000000000009002200cd89ebd693e0f95f73797a30000000000500010007000000050005000a000000140007800800114000000001080012400000ffff0d000300686173683a6e6574000000005d050553b5a237905b5bf12b148378aa1a1a1d49e7550529bc629d62167b98473c957755f43d4d0cb7b643753a4db247be6525870200b76e0c9d88a2add6c2ef460f8b927b58169d308c0865821be33e43bbee7efb722193ae24cfc43a40ca98a2546c66c612a86d99374030691eee93c21d40a668fe5a4b3a1d4dacf5c8115ef25e6cd89d69bfbe13299ef9cb0e3b98d5e20031c7df251d4cff9a6d997978cc628f8dae71bd6cd855833ef84285b7b51dd6834c3837650c55f595378d428be45829c7587339d21ba42ec02a8abd2ada99574896c2bf78e4eca023112d016c1b15f9ee92f8a329856d9298eb579887a79bf090b8c936193cc07f4bb23337baefb3a7b63b0a4f269f6a48d2f971be3660937b45912f0b8b"], 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0x7, @local, 0x1}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e23, @broadcast}, @in6={0xa, 0x4e21, 0x3, @mcast2, 0x1000041f}], 0x58)
r4 = add_key$keyring(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xffffffffffffffff)
r5 = add_key$fscrypt_v1(0x0, &(0x7f00000002c0)={'fscrypt:', @desc1}, &(0x7f0000000300)={0x0, "576b6ef53b7d29775a598a05bd75178e57e16568b009ec328b5d6764d965e1081fc3c390db93cc994509274386773707579006e9c352280cd69fe358a15ef916", 0x36}, 0x48, r4)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000240)='asymmetric\x00', &(0x7f00000001c0)=@keyring={'key_or_keyring:', r5})
getdents(0xffffffffffffffff, 0xffffffffffffffff, 0x5a)
ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f0000000080))
add_key$keyring(&(0x7f0000000100), 0x0, 0x0, 0x0, r4)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000001280)=""/4092, &(0x7f00000010c0)=0xffc)
ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000005c0)={[0x5836, 0x1000000000000008, 0x2, 0x4000000000000e52, 0x1, 0x5479, 0x1043, 0x200000000006, 0x4, 0x1, 0xfffffffffffffffe, 0x100000000, 0x9ca6, 0x1, 0x8000000000005, 0x5c], 0x8080000, 0x42590})
ioctl$KVM_RUN(r8, 0xae80, 0x0)
ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f0000000240))
setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5)
setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@broadcast, 0x4e23, 0xd969, 0x4e24, 0x0, 0x2, 0x40, 0x80, 0x3b, 0x0, 0xee01}, {0xfff, 0x108, 0xffffffffffffffff, 0x7, 0x8, 0x9, 0xfffffffffffffff9, 0xfff}, {0xf5, 0x1ff, 0x3, 0x2}, 0x9, 0x6e6bbd, 0x0, 0x0, 0x1}, {{@in=@remote, 0x4d5, 0x32}, 0xa, @in=@multicast1, 0x3503, 0x4, 0x0, 0x1, 0x347, 0xe, 0xc}}, 0xe8)

19m45.398927183s ago: executing program 0 (id=2744):
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0)
ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000140))
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r4, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x8000001}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0)
syz_80211_inject_frame(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="5000000008021100000108021100000008001100000000000000000000000000640001000006020202020202010182f855c6015d0ff83e1eb456372d3f9ba95fab5c4ab910783ba7633b82e33fe1b6d970e76fba8372a7fccf322666f3fdb7a1fa4956bcaad0aee7dee9e24042ef975d67b8109430c7e3c4c0861f2ad6b1"], 0x2f)
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000840)='highspeed', 0x9)
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {0x52ec}, @device_b, @device_a, @from_mac=@device_b, {0x0, 0x5}}, 0x0, 0x2, 0x5d, @void}, 0x1e)
write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
mmap$dsp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x355737d6d65d287a, 0xffffffffffffffff, 0x0)
clock_adjtime(0x0, &(0x7f0000000e00)={0xe62b, 0x80000000000000, 0x309, 0x0, 0x8000, 0x9f69, 0x0, 0x200000000002000, 0x2, 0x0, 0x0, 0x0, 0x4, 0xd10, 0x0, 0xfffffffffffffffc, 0x80000001, 0x30, 0x80000001, 0x0, 0x0, 0x6, 0x5, 0x0, 0x0, 0xffffffffffffffff})
r8 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r8, 0xc4c85513, &(0x7f0000000040)={0x9, 0x2, 0x7, 0x0, 'syz0\x00', 0x33})
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r9 = socket$inet6_sctp(0xa, 0x1, 0x84)
shutdown(r9, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e23, @empty}}, 0x7, 0x400, 0x2, 0x41, 0x6, 0xffff, 0x10}, &(0x7f0000000080)=0x9c)
socket$nl_generic(0x10, 0x3, 0x10)
syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0)

19m43.934554047s ago: executing program 0 (id=2753):
r0 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, 0x0)
name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x1000)
ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000080)=0x2)
ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xa, 0x4, 0x9, 0xfffffffe}}) (fail_nth: 1)
r1 = syz_open_procfs(0x0, 0x0)
timer_create(0x6, &(0x7f00000000c0)={0x0, 0x2a, 0x1}, &(0x7f0000000100))
getdents64(r1, 0xfffffffffffffffe, 0x64)

19m43.388561978s ago: executing program 0 (id=2757):
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4, 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0)
r2 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0)
mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901)
move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x80000, 0x0)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)=ANY=[@ANYRES16=r4], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYRES16=r0, @ANYRES32=r4, @ANYRES64, @ANYRESDEC=r4, @ANYRESOCT=r1, @ANYRES64=r5, @ANYRES32, @ANYRES8=r5, @ANYRES32=r5], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000aac020000060a0b040000000000000000020000003c020480380201800a0001006d6174636800000028020280080002400000000114020300d67a8527f76ec1d39e537c4c3060c6a405106c72848aa8bcb429b3a20d532452032d5f166334739d1719a5778bd4f724ee4ca57f2527aeeb0c75755d68fc6fa55f4825682ee95e581039823e5963beedcf65b8b005623d90772b8b6ebd2498b0aff725a3eabb6c99cb2edfe10b9c33be8a971e08401bc0807e75a2ff376b7934473bc1f02bb512b77414daf260c9c7d4e1f0758b56ec5823892af310e6252fcfb1d9dbad362baa26f43f12f831fd221926d6536eeff641db46920ae0e48f3ff5de599714ba6510ce479d4116a519792281736f39c9fc0e10ef557392c43389271cebcf36543fcf6f83bf74b93ee4eb5e8c82e35bb4784cc1ed0ad291b16e8368487589f7590bf5896f340a36555a1cf69736da230a809176dbdfba3d47efb9a6932e5503d277532b7d4e6f7c7373a298e5843a9f74d5fd07fbc6ad22bc644ba9b3c94ec3c8f0b9321b16e5826b1f058f781760a5d4b6a8880202b41689139c37cd51f65a92d883f8901add03b650c9ec182fb565a4d657ebba9d6a5eb426b22d5933b72362e6ec327fb679aa8034b8b3b6680ad138be47652a3e77981187d2921cebfc1639aa280e3d38dba9b1af49ceded79c78a2d656b3a3e946e17e6257def6679f70f11aa01a2d906aecf4dbc7d1a332a8932ed719ce7eecb5450f494f944b3f6b637502ddba609c6e45dcfad1db7c7dda3e2c8d5ddcf27132985442e9b8df16f96c82e72e3e2491856d07756b9f08000100627066000900010073797a30000000000900020073797a3200000000440005800800024000000002"], 0x2d4}}, 0x4048010)
move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000000)
close_range(r0, r2, 0x0)
r6 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000005500e50226d270000100000007000000", @ANYRES32, @ANYBLOB="200001f0"], 0x38}, 0x1, 0x0, 0x0, 0x2000c844}, 0x20000140)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @broadcast, 0x4e2e, 0x3, 'fo\x00', 0x11, 0x10000004, 0x8}, 0x2c)
socket$kcm(0xa, 0x2, 0x0)
socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x1}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44)
r7 = socket$netlink(0x10, 0x3, 0x0)
r8 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0)
sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="4000000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="080c000080000000180012800e00010077697265677561720400028008000a0000000000", @ANYRES32=r9, @ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x404c8c0}, 0x0)

19m42.856116084s ago: executing program 0 (id=2760):
r0 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xf}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x7fffffff}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c)
r2 = dup(r0)
r3 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000800)=ANY=[@ANYBLOB="1201000000000040ac05240300000000000109022d00010000e80b0904000001030082000921fd7f000122e30109058103"], 0x0)
syz_usb_control_io$hid(r3, 0x0, 0x0)
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c)
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x60000)
syz_usb_control_io$hid(r3, &(0x7f00000002c0)={0x24, &(0x7f00000000c0)={0x20, 0xb, 0xb3, {0xb3, 0x23, "a7cc4ae63cbf0597c907439c995cf0f5562fea93302d4791f95378eae11ed0ab38548e60abd936bff7297eff20124b106415f2ce079fccfa56314d18bfafc9bf6a68c9f0de8c30f0f59b3ba1f51b81df7ddf5de3860038b937d868a61c079061f7ac50195b0a3010e595a3ed24936a355f06510e169fc869d93a34eaf2ea4712dbacfa8d93d58f89cc4d0e2252e50ae05775bc4d766f27f05c347fba29f1fc02f07cc2a69745e80ba3c37624b1ca276597"}}, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x443}}, &(0x7f0000000200)={0x0, 0x22, 0x17, {[@local=@item_012={0x2, 0x2, 0x2, "2e17"}, @main=@item_012={0x1, 0x0, 0x9, "80"}, @global=@item_4={0x3, 0x1, 0x2, "9c275ae9"}, @local=@item_4={0x3, 0x2, 0x7, "8b1567ba"}, @global=@item_012={0x2, 0x1, 0xa, "a4dc"}, @global=@item_4={0x3, 0x1, 0x3, "0b5c913d"}]}}, &(0x7f0000000280)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7fff, 0x3, 0x1, {0x22, 0xff1}}}}, &(0x7f0000000580)={0x2c, &(0x7f0000000300)={0x0, 0x17, 0x6, "dc07aa7cc273"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x70}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000440)={0x20, 0x1, 0xf8, "e3bd8c5924548ac9420a615865a95b4fc1f3f62cd7f947cf7f9aff14adbedd7afef031194845c1f5ca4d9d80e7b24763eff253a2c5a5dde8e050b7ed76dfb1767e4083600f2a1e3c706c5576f6524388161062a9a1211c820aba0c76b2e1c057970b033ef73b63a8e6be0c5d0b4df96bfee695f6f84e597a73b9a1391ee82936df4f719cd13c327d1410cbf111b5a8fc0e4d5b9ec40f44665ffb3a28a126a02eab8205f564c419b47d4c2826a239d75e4150066a9c148c45f1d515b9420a8025abcad89c6050d02d2780cae831a6ded88c74f75b83181ec0d9d099ba392bc57f89c74e50b9b7dad92f4b1df0fa8bf3d9d702c717d8399ff5"}, &(0x7f0000000540)={0x20, 0x3, 0x1, 0x3}})
syz_usb_control_io$hid(r3, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0})

19m42.723389244s ago: executing program 0 (id=2762):
r0 = socket$kcm(0x2a, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'xfrm0\x00'})
r1 = socket$kcm(0x2a, 0x2, 0x0)
getpeername(r0, 0x0, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, 0x0)
sendmsg$kcm(r1, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = openat$cgroup_int(r2, &(0x7f0000001180)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0)
write$cgroup_subtree(r3, &(0x7f00000000c0)=ANY=[], 0x27)
pipe(&(0x7f00000007c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x1)
close(r4)
r5 = socket(0x1d, 0x80802, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', <r6=>0x0})
bind$can_j1939(r5, &(0x7f0000000380)={0x1d, r6, 0x1, {0x0, 0xf0, 0x3}, 0xfe}, 0x18)
r7 = io_uring_setup(0x1c6c, &(0x7f0000000040)={0x0, 0xaebb, 0xd000, 0x20000a, 0x20002f7})
io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0)
splice(r7, 0x0, r4, 0x0, 0xfffd, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)

19m42.348391192s ago: executing program 32 (id=2762):
r0 = socket$kcm(0x2a, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'xfrm0\x00'})
r1 = socket$kcm(0x2a, 0x2, 0x0)
getpeername(r0, 0x0, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, 0x0)
sendmsg$kcm(r1, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = openat$cgroup_int(r2, &(0x7f0000001180)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0)
write$cgroup_subtree(r3, &(0x7f00000000c0)=ANY=[], 0x27)
pipe(&(0x7f00000007c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x1)
close(r4)
r5 = socket(0x1d, 0x80802, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', <r6=>0x0})
bind$can_j1939(r5, &(0x7f0000000380)={0x1d, r6, 0x1, {0x0, 0xf0, 0x3}, 0xfe}, 0x18)
r7 = io_uring_setup(0x1c6c, &(0x7f0000000040)={0x0, 0xaebb, 0xd000, 0x20000a, 0x20002f7})
io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0)
splice(r7, 0x0, r4, 0x0, 0xfffd, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)

14m19.440878918s ago: executing program 2 (id=4445):
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61124c000000000061139c0000000000bf2000000000000007000000080000002d0301000000000095000000000000006926000000000000bf67000000000000150600000fff070067060000200000006a0200000ee60000bf050000000000003d350000000000006507000002000000070700004a0000000f75000000000000bf54000000000000070400000400f9ff2d53010000000000840400000000000005000000000000009500000000000000db13d5d8b741f2cdaabc8383caf56b8c2b84a8d09535a157f9005bd38addaa65b925cd3ded25b8b9e2a095d2c51ef45c5588ec78c7f32946b17cecfe54c53ab530c58b67851b7e0e82452a083b98a6aa766401047d150203b0417edef332233b081df18961d6822d133bf72a4de1cc0800004537fc211576846ac629d1d93265ba474580047a9dc88de358ce795731891a2031de4e09740c64e5306f991ed4785a9773a433e0db9c1a7d4ab9d658ce9cfdb4db3bed62bcb2bc91ddcdfac2e6d4421c49fb6641cbf56914e76702f673b586c767030090a3967093b000e3806f825f1d0da2a304e06543b56d35235d78b7a7fe912971aab876022e96f5143b6234f5a6b701690b07fb664a44e22b72e843e7cf55f394cf75d1cd3ee79a25fb98cc45b3fde43e62e150d4a2fddd9a976774"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x4b}, 0x48)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x134, 0x10, 0x1, 0x2, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x717, 0x4e23, 0x6, 0x0, 0x80, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0xbfdf, 0x195, 0x6, 0x141, 0x8253c, 0xfffffffffffffffe, 0xfffffffffffffff8}, {0xffffffffffbfffff, 0x0, 0x1e, 0x1}, {0x2, 0x8, 0x4}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x40}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x134}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)={<r2=>0x0, @empty, @loopback}, &(0x7f0000000200)=0xc)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300))
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000240)=@gcm_128={{0x304}, "7f3900005200", "9a5d38a17f00c500000000feff00", "a1e3837f", "542924b4eab9743a"}, 0x28)
recvfrom(r3, &(0x7f0000000440)=""/4070, 0xfe6, 0x117, 0x0, 0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000240)={'ip6_vti0\x00', <r4=>0x0, 0x4, 0x7f, 0x4, 0x7fc000, 0x2e, @dev={0xfe, 0x80, '\x00', 0x41}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x700, 0xf800, 0x4, 0x8}})
sendmsg$ETHTOOL_MSG_RINGS_SET(r1, &(0x7f0000000700)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x6c, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x8}, @ETHTOOL_A_RINGS_HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x4}]}, 0x6c}, 0x1, 0x0, 0x0, 0x2814}, 0x84)
timer_settime(0x0, 0x1, 0x0, 0x0)
syz_open_dev$vcsu(&(0x7f00000000c0), 0x200, 0x108200)
unshare(0x400)
r5 = socket(0x400000000010, 0x3, 0x0)
socket(0xa, 0x3, 0x3a)
ioctl$sock_SIOCETHTOOL(r5, 0x89f0, &(0x7f0000001440)={'batadv_slave_1\x00', &(0x7f0000000100)=@ethtool_ringparam={0xd, 0x0, 0x20040001, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4}})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d00000000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000007608000000c0000018000000000000000000000000000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94)
socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="02092009020000000000000000000000243dcc0101270aa3fd3419ab"], 0x10}}, 0x0)

14m18.169679796s ago: executing program 2 (id=4453):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880)
r4 = socket$unix(0x1, 0x1, 0x0)
r5 = socket$kcm(0x11, 0x3, 0x0)
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1)
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, <r7=>0x0}, 0x2020)
write$FUSE_INIT(r6, &(0x7f0000000040)={0x50, 0x0, r7, {0x7, 0x1f, 0x0, 0x10400}}, 0x50)
write$FUSE_NOTIFY_STORE(r6, &(0x7f0000000400)={0x2a, 0x4, 0x0, {0x1, 0xfff, 0x2, 0x0, [0x0, 0x0]}}, 0x2a)
r8 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000640)=@newtfilter={0x488, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x5}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x45c, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x4}]}}, @TCA_BPF_POLICE={0x444, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x0, 0xfffffffb, 0x1, 0x7, 0xd988, 0x3, 0x7f, 0xa08c, 0x1, 0x3fb, 0x5, 0x5, 0x6, 0xde02, 0x3, 0x92c, 0x7, 0xffffffb2, 0xeaac, 0x2, 0x1000e13, 0x5, 0x10000, 0xded, 0x8, 0x10000000, 0x1, 0x10001, 0x8, 0x80000001, 0x5, 0x7, 0x7, 0x7, 0x5, 0x7, 0x800, 0x9, 0x100, 0x8, 0x9, 0x8, 0x3, 0x5, 0x6, 0xe, 0x3, 0xd, 0x7, 0x5, 0x13f6, 0x4, 0x53, 0x17, 0x4, 0x1, 0x6, 0x4, 0x8, 0x801, 0x86e1, 0x4, 0xfffffff9, 0x5, 0x1, 0x3, 0x7, 0x5, 0x6, 0xf3, 0xd, 0x8, 0xfffffff9, 0x800, 0x2726a3ed, 0x2, 0x14, 0x7, 0x2, 0x10000, 0x2, 0x7ff, 0x1000fd, 0x1ff, 0x7, 0xffffffff, 0xd, 0x8, 0x5, 0x8000002, 0x5, 0x0, 0x4, 0x3, 0x16, 0xff, 0x1, 0xc, 0x9, 0xb, 0x205, 0x8000, 0x8, 0x6, 0x8, 0xfa, 0x3, 0x2, 0x9, 0x1ff, 0x3, 0x4, 0x60000000, 0x8, 0x2, 0x5, 0xee, 0x2, 0x401, 0xa955, 0x5000, 0x3, 0x7fffffff, 0x2, 0x9, 0x6e4, 0xdf5, 0x80005, 0xe, 0x7ff, 0x6, 0x4, 0x80000001, 0x5, 0x99b, 0x9c4, 0x7f, 0xd, 0x5, 0xff800, 0x1, 0x7, 0x6, 0xfd, 0x7, 0x6, 0xfff, 0x800, 0x7, 0x5, 0xff, 0x80000000, 0xd, 0x7, 0x8, 0xff, 0x0, 0x0, 0xff, 0x10, 0xffff, 0x3, 0x7f, 0x9, 0x1, 0x5, 0x4, 0x9, 0x9, 0x8, 0x7, 0xfffffc02, 0x0, 0x40, 0x400, 0x64c, 0x8, 0x7, 0x0, 0x7, 0xfffffffe, 0x6, 0x5, 0x7fc, 0xc7, 0x7, 0xf30, 0x800, 0x0, 0x44, 0x5, 0x4, 0x8, 0x8, 0x1000, 0x8, 0x7, 0xa37f, 0x5, 0xd, 0x10003, 0x1, 0x42b, 0x1, 0x10000, 0xb, 0xdf9, 0x6, 0xfc, 0x9c, 0x62d986b7, 0x1731, 0x3b, 0xff, 0x6, 0x6ad880, 0x266d, 0x7, 0x725, 0x2, 0x400, 0x7d75, 0x52, 0xd3, 0x8, 0x1, 0x4, 0xfffffff8, 0x8001, 0x6, 0x6, 0x8, 0xe, 0x9, 0x7ff, 0x0, 0x80, 0x40, 0x0, 0x9, 0x3feb, 0x800, 0x100, 0xff, 0xfffffff7, 0xfffffb98, 0xfffffffb, 0x0, 0x20001, 0x3, 0x8, 0x1, 0x15b9, 0x7, 0x0, 0xffffffff]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4000005, 0x10000004, 0x7a94, 0x7, 0xb, {0x7, 0x1, 0x1, 0x7d, 0x6572, 0x3}, {0x2, 0x2, 0x400, 0x8, 0x8}, 0x3, 0x4, 0x4}}]}]}}]}, 0x488}, 0x1, 0x0, 0x0, 0x8848}, 0x20044804)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x204001, 0x0)
close(r10)
socket$can_raw(0x1d, 0x3, 0x1)
ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r11=>0x0})
sendmsg$kcm(r5, &(0x7f0000000440)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r11, 0x3c}, 0x80, &(0x7f0000000080)=[{&(0x7f00000005c0)='\'', 0x1}], 0x1}, 0x804)

14m18.021999165s ago: executing program 2 (id=4455):
mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x2d)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
r1 = fcntl$dupfd(r0, 0x0, r0)
write$uinput_user_dev(r1, &(0x7f0000000180)={'syz1\x00', {0x10, 0x0, 0xffff}, 0x9, [0xb86, 0x7, 0x4, 0x7, 0x7ff, 0x3, 0x5, 0x100000, 0x5, 0x4, 0xd, 0x3, 0x9, 0x1f, 0xc795, 0x8, 0x7fff, 0x10001, 0x4, 0x4, 0x1, 0x6, 0xa, 0x6, 0x1, 0x5, 0x0, 0xfb82, 0x3, 0x0, 0x0, 0x1, 0xd, 0x2, 0x0, 0x1, 0x0, 0xfffffffc, 0x400, 0x5, 0x9, 0x5, 0x2, 0x6, 0x0, 0x8, 0x7, 0x4, 0x1, 0xe8, 0x5, 0x7, 0x4, 0x2, 0x2f03132e, 0x0, 0x3, 0x9, 0x3, 0x0, 0x0, 0x0, 0xdf, 0x287f], [0x101, 0x31, 0x6, 0x7, 0x23e, 0x80000001, 0x40a1, 0xe, 0x3, 0x8, 0x9, 0x7f, 0x75, 0x8, 0x7fff, 0x2, 0x7f, 0x5, 0x73, 0x8, 0xfffffffb, 0x1, 0x7ff, 0x4, 0x4d, 0x1, 0x0, 0x9, 0x0, 0x2, 0x8, 0xf, 0xd, 0x2, 0x2a, 0x8, 0x5, 0x3, 0x1, 0x8, 0x2, 0xfffffff0, 0x6, 0x8, 0x7cd, 0x8, 0x7, 0x3, 0xc6, 0x7, 0x9, 0x7, 0x10000, 0x6, 0x5, 0x0, 0x3, 0x4, 0x8, 0x0, 0x2, 0x0, 0x6], [0x0, 0xfffffff8, 0x1, 0x3, 0x9, 0x8001, 0x3, 0x3ea7, 0x6, 0xfffffff8, 0x9, 0x1, 0x700, 0x0, 0xfffffffa, 0xd, 0x7ff, 0x6, 0x80000, 0x7fffffff, 0x9, 0x48, 0x9, 0x6, 0x1, 0x9, 0x3, 0x709, 0x9, 0x9, 0x2, 0x7, 0xff, 0x7fffffff, 0x5, 0x6, 0x43cd, 0x5, 0xd, 0x8000, 0x4, 0x8001, 0x7, 0x7, 0x8, 0x10001, 0x4, 0xffff89a1, 0x1000, 0x19, 0x9, 0xa59, 0x3ff, 0x1, 0x3, 0xfffffff5, 0x9, 0x2, 0x10000, 0x1d, 0x3, 0x4, 0x40000, 0x1], [0x7, 0x8, 0x213, 0x789c, 0x40, 0x6, 0x1000, 0x8000, 0x2, 0x3, 0x2, 0x5, 0x7fffffff, 0xd, 0x6, 0x7, 0x8, 0x9, 0x7fffffff, 0x0, 0xffff, 0x0, 0x6, 0x7, 0x0, 0xda43, 0x2, 0x5, 0x14ac3b3b, 0x2, 0xb, 0x0, 0x2, 0x1, 0x1, 0x1000, 0x81, 0xff, 0xb6, 0x3, 0xffff, 0x10, 0xa114, 0x3, 0x6, 0x800, 0x4, 0x40, 0xfffffffb, 0x4, 0x0, 0xfffffff7, 0x7, 0x800, 0x0, 0x4, 0x5, 0x3, 0x2, 0x6, 0xe, 0x9a6, 0x5, 0xffffffff]}, 0x45c)
ioctl$SG_GET_REQUEST_TABLE(r1, 0x2275, &(0x7f00000018c0))
mkdir(&(0x7f00000000c0)='./file0\x00', 0x22)
ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0)
r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0)
ioctl$SW_SYNC_IOC_INC(r2, 0x40045701, &(0x7f0000000140)=0x5)
unshare(0x62040200)
timer_create(0x6, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, 0x0)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
syz_open_dev$admmidi(0x0, 0x2, 0x242c3)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(0xffffffffffffffff, 0x4018f50b, &(0x7f0000000100)={0xfffffffb, 0x0, 0x40})
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000)
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1})
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0x0, 0x4, 0x0, 0x6, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0xfffffffffffffda3, &(0x7f0000000180)={&(0x7f0000000200)=@delnexthop={0x20, 0x69, 0xb, 0x0, 0x0, {}, [{0x8, 0x1, 0x1}]}, 0x20}}, 0x4000000)

14m17.788354897s ago: executing program 2 (id=4456):
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0)
read$FUSE(r0, &(0x7f0000000100)={0x2020, 0x0, <r2=>0x0}, 0x2020)
write$FUSE_INIT(r0, &(0x7f0000002140)={0x50, 0x0, r2, {0x7, 0x27, 0x0, 0x14a4014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x50)
read$FUSE(r0, &(0x7f000000b040)={0x2020, 0x0, <r3=>0x0, <r4=>0x0}, 0x2020)
write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r3}, 0x10)
syz_fuse_handle_req(r0, &(0x7f0000009040)="c9b6cf40d6a9928c6a8c0fdaba1e7bbd4ee597917b02ec4e8ff3bec8d7d8c08f8813039f40175e54e3d66ec19388ed788cf69c0c5b560f0401f1adb4b1f5198fe0bd7627cb9dc384db5b44495ba6094046fb2c8c7d0af7d67dbc3f5ef4aef8ec6bb01c52b6a10d4f9473987d0809b6a84f2ff8aae19a082abcb68b41c291add3ca2204a38c59e28c7c910aaa5a075676e541b6bb91de3854d2f97d3f80dc56c0705e74624a947f2c21ff936c6ba827742a24fd6d9e10b470ceb73a23fc57f5fa27cf073f2d0235e6fa4d1c29f9d0b6509c890ce0e7c3a2a4dd8b6336f02b9d7cc4c8e37f5f5a57f63aeec3228bd15b6d041eab97bccb14ee1ca6fbf7f7ed2e4dd0a32d41cc41c1031424b94621edcea1bddd40f3ad905202dfba3b912efd3468d2ad42b8a01bcb13b288afdc00b7e5857425d7919651160ec15447a26758f20653e69559f0892efc8f0715d8d79f52a44c79aba8ac58dc726ed721eeab3480eaacc2655d4b8831c9aff049c32709ab7adfb24ae767d45468dc0e42bc34b3568ce95e850eaabbf3a1be4d0f9b3e8781a2a9dc06374fe496a755b48abce67fd56de43816d64e883d9db51489ab8a81d1af3a180b6772d2bdac6313d3c183239d4c0bbbe76173f011f144ba71ac8043107f6533b3ef2f44924039b8587485749647315eb7bfe1e412e94f8cdaa937480fdd23769a69e14ea82d741484c99dd1ddd1edfb4faa51431f15531b61e59d68f9d189b27d0bf925970ac66fc35dbe1e430893cc60b28ca6d8e34931bf02154aee6f1fc58d0c0d8e48eaf8079ded67fdd9f19ebfa85d1ab6ec7f54e1963be353b34a6cb7fa35ddb60a9fc6bd1c6f11bf981b5a1bba81513fe447ff7eb2db0d27f1cfd04353e05f37d6c1bd6eb8219ce799338de3518bfec529373e4acfd644212be283856be064bac0f4926c02c0915816615f1f04d1d5136872029afee663f0bf1b6811c594e1465fba59f5727e5a826e3c60576bc2087f21521ffc90dcca39cbec7c0466c8fb7b1bcea7cffb333d2d16daa269d63f4911d10ed24462b37cdceb7c88e819489e1939e5e3cdcc5a858d09803c98d9e5fd617bc92c0880f072c54608f6ea69edba05b4edcd8d3f5e3c926220a191f2aa0d2f0c9158e298bc2e756ee091a0ac48752e4bb56fac67b02eb2c7b3380244ed66648482d8bc2a29bfc26ade0f4a5665282ea408254fd88e2812a184ee9af9c7769fba1ec380043d5cdf6056f89b4d7f12a441c3013b0fe0d8418fc47c13fbf4fc2b4a89496d4ab9d9826d0e586574e8dd15d4eb8b86ed372e37287fc818df5b6993b650fba844d960e3fd62db0bc7b12ab286d6492388a91ae4da6bdece6e101c13100eaba3b9998706fd4defaa3ed2965ce7fe6062b8c58f20c6b44b01121184ee1dda1cb66b3ababecfc0b7a9a12624e0b826c35d0149335149cfb49fbe68d1dbb7eef96d7956dc573d449847ff4bb7ba0ededd00c904130f1252c3dd4bdcdeccf6f8a83e3abfa14d12c753558022efa0704549b0571e31c4bc9f3e485f8d2d88189b4149569ef83e8feb2ad26c263b0f91f8975c86c8fa9c9457da5ef4a8a94844f824873576f722e32b376ba5f3ed0ea9818d86ddc35ba0e7f322594d9a0fea878af5c03d242bc7b0af89091f088245154391e75ab1b6b2730ccd01c28e9ec99428cc22c2d08ae2829537c34ebd1273327d0d18175698f9fe587e968d19f00ff98555fcfe95d00cb3abae32afcd48f3d4cd7c63c45581203a8a3040363d98bf9426493039fce7bb03493ab6e176cb45e2af461e77fc93d1202fe0bc7b77398c52bbc1c1436439f26cb2e17933a0ae309611e46bebd4d84a939d9b040a08cad90c2eda6ddc933edffc8e562aa64658f99a9ec8a47278edb828b5312a95ca34c0af428aac64d3fa1c4045885891fda7666dfb680da4dc2c02becb8303b76987b6d9be01174df88e41a48a42444caeae5e36118564e57209594285bc2915b222f99f016326430c38c9807994cfa1c3c85aa0f6375c716cd7f27be9b2cef6866d07c8ed00bc101a74219182562467ebbd43d2ba78a4b0eae22c67702f318bc55ccd92f5fd11557335f94ff6f38cfe9fbe31d3fac064dcd7d660d02fbeaa26acf8927c1e3bc71d9ed8ef2e93f0a42813526daa1fad36676734103bcc621a114b098295de578bf8d7df9034fb3ba86ea529bf639cde496b5e48145e4a814f894fb3bf3f41b49d0572dad5988348dad7a064b2d76d9092336cb404934790683b2b3576d3b75534df2c36bc78e05ed250b9aaede772a08bf5972444ecf4e447c062d95e556768e264813369465713834f6e239695b6bfca1b6108a09368688e212b7ba556df50c02486bf1b2196da3d4c0553923fe9b1bb4474d0f569bec1f35dce4be0f5e2408efa69aa66dda6bb1ef43295fe005f4a86840bb608796ce14bcc1134013bf741ad1aa70cc6579edbd42478d3054e1f7bdbd5b1131ded725041270e8a46bcc8bbfe89089f87105939deb2a9f10dd60d059679d4514bfbfc94b333c7dde79576426f07f24ab6a57290b0d723bf3bffa2f66fe191d0dee8b292c8c15eb42245b899ddde3c6afbbf0d7c301dd142878dbca579f387931460c8c37e186f60f8d9209dc98f1a27b84ecefd71de077017261ad6cc3072fe57ec589cd9498946fda8a834e3f02e8a91f7ce6e18e76f936f6f39d354b63dccc706e25b1d8b1a4830c46f249b5e5a40042fea920ed57a2415431f83c238113ee7d152c16f0780c502d5c995168e3f91113af11752f10434b8dc5ef0e46a276c683261aa73877ce96ebd0176977e124c5b93bbb02ef97a6f6a13c15c261f23014f4b13c8f18746727206b245bee70d7b94968141f104f0682a3df4242c6a60fa1b70c227306520b1b9fbd6c916b0edf5e2ce5220fc9ef10ab0a10e1bf259e91eb127d5a31b7633f15130fdb44ce2178a20d5dc3f91688090881c061d75b4b59c3b2b7eb7a3dd1564bfa6c883c217cb76c2a7516dec926add0a1886570531c32b6284b1e80fbde88905f67ea5cea41003325327000a7f7249a99986f19f423843e8dc791df8679a2ed2b024d7d8c79112644a4fbd32bef0cd1f9d55025708135ed34cbf52ce3a0af0f8cd985362ef6fceb6c72f241128b16dad7575558badb3847e051f38d7b5ca638a1f454054659d90b2c046e4f9e2ab127f257ccc92f887b3e0c4fb49d159741fc649638180addf3f23e5265015f6dad9b25cb86d8a33b802e55258749ec050d15d0d7d821f9615c7d8c12ce11c63fb1eb118455c4e2167f66e4eaf9dec0dd2f345a7e2bb369a66b0755003a9c89449393f71acd98afdf6347792251d669ff3c64c50d705a67e543cad95655d6a4cce233acdac5ffc96681772be3c04a1b36f5273815af65ef87c7ad0d51462bf337c2389a8eded875f75eeebe5e5efc26933948e623364d0dbad3402f659a93acaaa21bc8f559dca605aa6732d0eced5a21ee8a6403b1f91722fcbada24a3031d6aa221612a36584d5edc6ba0f64096e9b6eae1555a95945b937457c4c74371f474939d3c3f299f691316497951c646f142adbd6ee49182aec388ce2ca560a1f4b7d8a63e5cd25ba91ebc61175a6955895bcddae7bf1cefccac5c93dd669ab65a2f508adbcfd62ec46027efa396b9f69984d6adcb38fdddb616ec38929fedd97677c3d06060309db5a9cb5fc8919f4310f06bb40f1b76bc197798acbf8d3162257071e034174047006796fac6fbc95c28afd881e1197c20fea8b4be5c5de39a292bd1ff3819d4d4f48162ea1a57930d8f324ce54875d3ad09eea95c4c825765842f9bbb1957fa8188578e86081adfc87502e69c8841218b596d71c4ec49afa60408028012d974051559d924f5f8a59ee195fb01994b8710994d8201ae10f6e88e0e418489c47499b7efd2021f56a6c9fba761beaf79acb6087a496afe7524f2260e14a792cf1a1203d4b0cd8a11d2544293b7657fc393014295fa28e409ab8be0a02695223d17d7caf4f44cf5d0f416130067f28f3fc51c88ad7b53e401e658214abcc8f597f22d662144f878573d0370c874287698784b6ba9abf9b22da2eeb0ce8b817f85e429e799a5edd246d72d77228652b80c4949a85cd5131d851d9f9bda9afa0646de5e477e0fa999562cb46758502c7d63dd3e8b6f88c7ea44f41c4212d633f0160e738c6d36128e9e58c154b08460c899a26276dc1257dc5de18495573693674e40faf1dad49db8ac83baecf92f3aa5c23f639cdcf6e6864c14a8d6a3de95906813fd17f83c406ffd1d2d7bc75737b7b00172448b2ff167b9fa43649db32ab4094652cbb2e18c3bdb527f24049878bb44b82135009f9af22d24ffbee4b5289fa61bd0502f019b2f24a08542db818bffb7c1637b4f4cb9043952f88aa69d9431b8df2e3f9ef6e4a5ba58e79acf082bbd871aa0f0feef71ade8f921bb597ea28548f4116a281ab3542b732c4a8e9973409c75a0c6443d83547d0d314cc7bd62128e3b0db9c03c78b9d78ba714627866230414947523a6a239873f932c2b28c09cbdf182e856bf41598998150cbdd6d54f76c227fb1519f5afb0008e31d6a0b87818d0a2ca0dd6e953a5ba1a347dd927acd36f3fa3a68920eb9c36bce6cef857447aa733e4ffb7014e194993eb1399270b64151ddbb15478c2b762a14d1782608fb24199d9d311281c47726f565b3a3b7be584afb03d87cdc5eb8156772694ab422f59cd7b1e359583a7cc0695b9f64e6416c6b52de230afbc160d2e9384501b40645189434d416c0fbb034e9ffc654d0dee7ee7a878f9e559daac7ee5af769aeac7a92e85b1bc7983803d3bb572befe76184a46b76450feccffa753cc6123cba0686440a5ba81236458831031a4ba4c91d7aab3bb2514208a902face1c12b7dfe25318ab5ca2c1ef9769aa06ba0539f6904f95d3c8440617efc7858d3984f566b3390b9b1a0f2ec3c86dd77a0b82958c4b15278ffaf10e47e613545f4cf67ef7e8b31a6bda35022871840ae1536fb65bb11b932936db7a15642359bb6b157893d19e7918b11d3d3072b78c761c1784afa2214c865fc2aed860dcc17b69cfe9189bcd0767a84cb306a59966e5f96514a7d7182e6aa7204bbd1a84092ba645f86b68813debd5a2290acc93388e5eacc17db51d69604733ea9160a0e77ec5317194654313a9a8a0535c0bc49d0837e2821df92e8ee2f154cbea6b87ffc207aab4ea491e8aa75b90f70136d84ea2f5dfd138371dbdf8fe273956cb7411db6df48ebf56105da42b219b9dad387ca7be9ecd90508c62279a53bc9f7e2a845f9da42d8e85d2653854737948ce228b2d76d1b9fe2e0e456fdff24575939b82a3f6e1a4be6ffcf1c493c17dabbfa0859a87d259ae3931fb6da544589b9b6bb7cc93e078813ac94918942bf113aee5742498d86a70fff31d2a69507739317a9aa9e0289f053dad4eec63cd58e833027f0859fb4ab74e8fc742d03b5b6dca1168d3d47fd95b514a567e6518342d52b3c3bb6438b5aeacb95ff9001d2f5480f6a80a0685b5bda2ceba06925ab5ae0986954c3169e92fedaf3f1681247cb114202c0f728296a51396063fc64aad05662bf05a626b90f656b47069ca668bb96208c287e8f793d77d4fb1f1cc14e73406005e11a2c1c46ca7448be534c97738487527d79e284d7a0ae275bd4361ecf4a352e6dc8b8c8c8e132a3edb7d645f4943445f523fb28bbf857218a117f1288afec49f9def9aabc2381b38a315d5c927aeb96fa1ad3eb13b0151dd570f6734f004467171d2cdd609d1d09d115c9b42e1da3472ada98d3e1da90a8f373a98133fa708f5a62c75b5eb1b643c48de72143ffc8761ccffd7f3336b69faa277d364cdf2d4f2bc428bda8b76e4748d5ae02d9850ac6f2ed0ddcb874c25d210163d4da10c0d6cc5218a3558deee5519c94032158bca02fe1c1b8184fdf417e863352b224b7b06267486296ebd4100ad5f1108c78a7056979f5ad6f97794a0460bf371584d9b962034aa7449f4e6b0f925b7a648d4ed7f2442135629b0baee3385882682fde57e5eb9204647a898c566120e4b577ba215ed863f76d5ad9ed19a6b7465952292e7543110eac3dc436a16c85047f3ff10a00c917d5902d296c063c4b173775f2b612e407bce02c8647877abcc07b21b89a60e16ff5c5cdc3708f285d6e411036661e97f628c6c2bef7a6e297f0ea7db2aaceb87d13425e80c28cf095b1dd4e08122e89f58862c6466d79fe7d06e0038a9a1869cba0d1554bffc08b94bf3dc7ec4d108073a4dcb7a6a503b608e777f1ca6b64deec19072052cdab8e7222966170bd35cfa66d3d013c537e723bfa2f634b34edba64ee27ab814bf66c5943e5b7b4d2cbad0550982b2d68ea0633a48f24ef5a59da6e9671717afed4253db66afce693ab08e2b4343d9efd1705802393ba22af5f0e04fc559ddafd78bb1c013b2826cfd77591736cd8a1e079c00f72dc89ee419cf4cc5e867138e35372bb0854df45d2142ce56ea01465d7cf42d3beabbed8602ff568df5d8e53d22bbd897c0aa050165319ba28d6f861a128556e420275562b8a19c0a2112df4490925f52090c6c7ac79b8533936d4020af3ea5d383cc8e4f23cf275194887d42bde7061bc17246a91b735472c4dee6f2d159a4fb2cce10f0727a964658f6d60aa18bd474ce1e88114ce3c2a3acabd74175b82afc6126ed79d8d333ed993e3a0d67afba888c94cb266f906681d9595f2ca21946f32d8f07eb7cfc979cdd56a885e6a5deb1dc54ffbbbac728db4145056cc9b78386f1f17ad16856cc10b04038f0d835a5842584b6a9516a770abd839ade5d379db9889d22d9049dd13010ad612a64128f724f7a643505b8ca50bddc4ec4875beed2f8593b7382645625809bbc3591027d53bde8a16be5bb209cd49e71aaa435c923ef3c4d1aefec7111773b0d58b47efabc7a43b93cb7eab287cefe554a5b59e2a746081d0d875919df356504008374ef184be2f7ef7e644bf5535dedf5b969b30dcedcfbecb83173b0cea015efe45630880c303472daf1dc22b384e65078cb0ae21baa4834fcd4b4f7c995b700117e1448d041a7106277302fabf3a512ad4e802988c43e6cad0b4b74962e195b355b653acfab53d9f38337e46758c0f8c147333d30f8fbb508a889b84d4672e025b0d9adec09fd4e2d62bda0e0c40570d8fcf5487a59380584f7b85a8576985a4423cbdb1503ea4f93d4f3dbb2c384efcac84dd8649e6f09d2ac37e1d8268c3c07db365581c7c3752410909968598b8ea5ea05b68e6013965cc60be6f6b24e493655f5ddd572a84a924803a7df025914f4b57527841928d30c03b09aeee28c8b81860968f53a663f4f56b004e07cc380f5b0b0dad43869faeed5f240ce389a0fb0920073b8d3de611e54d4011f55ba28743a3b51af6293ed1376fcfe3592c877e2d81d14ee882410cf8207476409b5673eb65297155e91cbe089c8c043964063f9b469419bce6e59e0017e0f527d20eab5d9579208df9cc65389ca8fdb3d62618395bb0274b8094799cb4c36632488e79950ac3bd3d982d521614f56df1bd16c1f928481dd4580a796eb7892b3e4a33b748b16f96b1def674c2b70d0315b486a94a979292d635a2ad1fa877927de9355f38a612747fb982bccf12040d9a14a63c34b6f2b3b450a6401d4d0c96a9090ab80d30f7e7af84bade864791455402cbd278427c5a1e84e2e2286c4bf773da614e6705802c130ade8a3a67b309f9db1558372046ec276a34fb50f72c7df40e33f447ab5f0af05eece4e8f654b3c2dad6ea76ef6b694699f4ad8c6fdcbfd8bdc23d0c580631d0c95ac6ae9613dad680939db2ecf9e7a0d4d0f2f2b7f1c1d308cfaccacc2381e97bb278a53b14daf686c0541e56264c33d5176b830ac7d13c28edb2d8e77d7acbced061c4ec315cb1a259966ad997c7c7beae44d4d1b6955842d7fbba0bb0c461bb22db3e15f0fc1cd3fd997dac5e6a4bff6e2eb8310d828f15309b2c8feaa21281963d35ab2d5c099beb806cd384d304449c58d89910105df11225fb893e984734a8e5cba2e553f03ebd5ce4cae24826547df81db3f2bd7d930f785755c8b6311f221da59679ce50479adef1cc5dac984a5d2f9343fe4892b2b5640892892cfd50d0015c1f568792d8919943a578b62585081175237444d9542a2241c967bcfbc3dab4e8961ecad89165eaada2d759e844be5021aed42b971e9ffea8c08a3d6e4073ce4226b4e54b83f3d8ccd207a0cfcf9da7b5e55d1a26a90e03f7c3611c6562b65edb42fe110dc3970b44aa36660d1cdbc882495271f80816350b945aedb0d46ca6d160d5f0096e8263325e257dbb574932e32f1b28ce2b7f5b3ee6ccec64085496bb513ec168b53d79e6ecb72622a70b22e1f9116fa48815709b2080b27b31a6b26dde0701cd74c31b4e33a702f051ae07ad54ce23ae33e6060e5451a4171cc930af2ab70862044c5a0ff9e8aeebd3cc41c62d38e7b79596d3851430dd661b071c319751985d48eeea2afb463d7d9390ed4e68a60f90ad80aeca4b8d283ae0538e590668c857a526a264be238641eeb5f321248d829539efccf03dcefa54c6def8b7d4a8cdf6bc76d71eefaca1a7a33bd4b56e94b8e38f784b742bdd080faca4769e1aa91ff50d9374f3632cb7b66a0042beb802c6cedff0a3634aec072f57d38a6ea61439029ba5d921f57bfbc281d75f5ec322b8f8c90b4d3f65d00ef97dcffe7e07fa01af8e7f8da15532f0c18b73d7a183327aea46680651645782f4f318c00f2355c301fe2e805a22f8586119768b8424735f5495607d170f0818be232cec1d9e40daf79bcd63a26cbead93753b7171bcad462da2af68e9ea9c0b207200f1fcf3793283931603a719e745120273efb541a7af896f6eea7359939d7226896c8023cc963e4e0a7579bc83a37cb8d871324bb3e66b671d8df83d645495740c5b99aaf2edda3018e1895dda6744b1e6623cb62d4b80ac208f69a81caa0277a497e41bf637817518cbe0fcd2028d07be199a126f82641f2fd54e6b20287b912ee8d8dd72db5824ca9e464a94d45beda7f52932d1bb57a28a4e99ac32ea4c3650197613a87e4cec91d82f37069fde871575d3cb2220aaad9277511271a86377da5f2a9f94303e7151acb087ca549fd0cb9b1961954ddb28333a24b510b92cddc057ec5a147ccdd708a2db3c8cb3600756100b38b71f0676f6fc5a7f5912b5e81bf6d2b07e15fb5b1c96459110ceb22ba4f2fb0e531dcaa913a13437cc6276c8b4e1bdbc5365144c7abd2e2a6c93ef102e26b14e576ada244408d9db50aab045f9879bf95425eaa7b11d77e0dc503851c5c278c282aa736103adf5ca2b30724bde27f98e4e7a947f964b7abfe58a3da354e3008a2b86d50223d3077e151ce2e086172002eab7279ac1948361e172073184401d5650181547f1bacc1534f9ab2ad66fd9d200d867de79a92e465dda8d781b15881acc9bfdc53815f3fc3f064c830db3908cdb173e3e1295ea7dca280273ca99073d5663003f14c4f7ac9ef9bc735b2a413daaa7d97101553f90a0d33b043d1f2b0f131d35c9244808bb4b76213ff5c418053a569d760498518d701aae39cfbd7a052b586c53617dfaad1415c1cafbb41640d1650be9297dd42c803d8bfd443916310bb80a74c991cc26331ab70c0c4bc4f2295f069787f6759878e42ffbc76b34493f71d88a109b0813ebfcd24953b2b5f1f5164d9974bab7ed1f4d42f62b8379912dd7e9f35a19951e4d57b0c70fe516cd2059c4ef879d9f9b1191d5bb51b852d3e9462e4528b9c1f7c676e6039d1deb00442a482e297b08a67c79bb818d0316072d8174885de3413ae0505232100f217e424e0106811902d60ecc0e0aaca7c5f00f4f365e1360f10aa645b9215c93668a08be97cacd6b0f9c80ead76478846d12e8f24a53bfab01628afd199b2db332d38d5009d7a1437f0f5b2a0d36b5c98f3a35e5043ffd55bac325d3927888fa5d0e3569d9be002205b501b3e68d661515bb9eac9d4f234e22e4e5bd0b4c4530933aadd99f132794ce48e9a3220d2c17748c012fc5fd93d265cebb3edc3be29a1ba26f2adcf510663c28d29e28774c4ec1190fbfbf614aa8e2745f8605f7d7e94fdd06322454a08833f1a22c77deedb1337e380a8e18f85168e045d1e7cf32fda1a709d3eddf62909a9e580ed8abd605e07dbab79b5bcc2f4533e6fec589b976816471b1f11ac3c89336c52e03b72520995d05275024e9988727f2e1ac9421ccaaa0b736e9f7f296c2d27cbd774d7179f9c6921df68985998034862c15adc452666deb40c0c40cedf16f4d187524a0a5cdff6f7b2531eda54fbe15a7ad1aea46466a51642326c5d7d374fb38475d119027a3714598fe7307de94bece2741b7a742b053682dae9452eed3b820b1386b604fa647e392b35b205019cf1ad317d1441cbee2aea5ca95e56fd5e959689bf96c9f470acb8e4e630b13403e9459242b629fa28e1ba8eacf1ed572b1db735a20ee1a5b8500b6edf66cbe671c5938741ab2b36ccd4e92160f6df9e1d465cdaf3a7746e128e26e0e7a7aa4869b2a482c6e9bf7e58408411016740c547129e4f11d2317af3c5bb55b2468e6d08e75e5039c3bfdc9b6da06e7c27933a8c9d8ad0e4c74a093e6d57c02b1b49e995962c1046b5c8a3df0ea4c20049e300cbe41bd92a0ea5993ef6fd92ea74e28e1cfaf4a8533c224104d6081b64ae08b4e7a23a259b2b03655b987c23687c6e279bab469a3e0881a30620910566982945f8f86229fd614ca2bb2adcbdd49a5c579c0d1bbdefb9e33cd0641bb43f6ca3fab33dc4188e1508e4293e6de932040b895a97bc1f196467ad4a0d4899e6078c014f42521cf39411e2e4f1b5adc26f1f3bb2fcd27b89ac418c8251423de82c4b5980a4e66649b9f3ec48c833c35f8653ca510a0a1b049561e64a6938714c3a1946b3fa5079533698bb8f8f85bea8711ccda5cf01de150b055d3586a890d0654d2b4cfba25c434e2ff492b69798aa197dffbfe2bba77d4b4eea35c42e698221e971a4bca34e59c46084f48f2170b83db6719324ecb55e07a9cf74a84ee0fc3567fa5cd2f3937ad956b4ed2187e2026b7d4166d50fd9c937fb4dd5aa96f2731f1db1dda4eac4e589295ffe9b72a7b9533f6e23c82b57c8361c8cb3b15128235f65c84b99d93383b7398e936884542d0e73bdf37cadfb6c70da47af3c5a3cde0d8e381cdf9ec1a39d2fc963f0d8ee31b76d9668c0171967cb9ef2f15d5bbdbd1058328da7a60bbc7d77efed2de74a2ed5637a8a84e1163325dd22b584b15fe894c9b1ce89d24619a344a8987f6d21b7de7ccf6fad223134e1c389a8e6baa375dd142baf4a8852e984eb6c281cf86e2457a7f85782c7764564af26d331d3ddf4850d24742ef449cd5e32f5957d2ee10e05e7d3312215e4d36ac5c8c4bae3340f074f88a20e18b270b3baf05de1b0363f4c6f2ab9386d6034e8567e4828ad256cd250448c70147c318a621697be402c1e8365d2798084f968a8897242ff6756c2937e4d1300", 0x2000, &(0x7f0000006b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002700)={0x90, 0x0, 0x45, {0x6, 0x0, 0x0, 0xfa0, 0xffffffff, 0x0, {0x8000, 0x0, 0x0, 0x0, 0x22, 0xf7fe, 0x3, 0x0, 0xfffffff7, 0x4000, 0x1, r4, 0x0, 0x0, 0xfffff8af}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
openat(r1, &(0x7f0000000000)='./file0\x00', 0x1000, 0x28)
r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0xfffffffe, 0x1e5}, &(0x7f0000000000)=<r6=>0x0, &(0x7f0000000080)=<r7=>0x0, &(0x7f0000000140)=<r8=>0x0)
syz_io_uring_submit(r6, r7, r8, &(0x7f0000000180)=@IORING_OP_RECVMSG={0xa, 0x0, 0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x40002102, 0x1, {0x2}})
r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
add_key$fscrypt_v1(0x0, 0x0, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xffffffff}, 0x48, 0xffffffffffffffff)
ptrace(0x10, r9)
ptrace$setregs(0xd, r9, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb")
ptrace$getregset(0x4205, r9, 0x200, &(0x7f0000000080)={&(0x7f00000000c0)=""/112, 0x70})
syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0)

14m17.593154329s ago: executing program 2 (id=4457):
r0 = socket$inet(0x2, 0x3, 0x2)
setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc)
syz_emit_ethernet(0x89, &(0x7f0000001800)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @random="50a245d5cde0", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0xfd, 0x2, 0x0, @empty, @broadcast}, @timestamp_reply={0x12, 0x0, 0x0, 0xe000, 0x2}}}}}, 0x0) (fail_nth: 3)

14m17.428518569s ago: executing program 2 (id=4458):
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff)
write$binfmt_elf64(r0, &(0x7f0000000800)=ANY=[], 0x78)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f00000000c0)='./file1\x00', 0x2000775)
r2 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0)
sendfile(r2, r2, 0x0, 0x802000005)

14m17.225739247s ago: executing program 33 (id=4458):
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff)
write$binfmt_elf64(r0, &(0x7f0000000800)=ANY=[], 0x78)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f00000000c0)='./file1\x00', 0x2000775)
r2 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0)
sendfile(r2, r2, 0x0, 0x802000005)

8m19.904575243s ago: executing program 3 (id=6242):
r0 = socket$kcm(0x11, 0x3, 0x0)
r1 = socket$unix(0x1, 0x5, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x9102})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x40480, 0x0)
close(r3)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
sendmsg$nl_route_sched(r4, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56)
sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2b, 0x300, r5, 0x3e}, 0x80, &(0x7f0000003600)=[{&(0x7f0000000180)="27030200590214000600006fb96dbcf706e10500000086ddffff1144ee1611", 0x1f}, {&(0x7f0000000f00)="0b676ae7ce0aa301d6ff23b6557b3e02be56268cb67cc8df76c62092c9dc73bf02e2fbfd0d14f594db9a8faca2d1ee15bc4c2c588479eb0b462fed8714ae90e42c4c1477864b7c37d96279e5c380cb5f53b2983f7e1ec1fb074a8d4be7374be1c9b65b8587e435b5dc319cd5d25258ed81710608c0331449192c63736d71c7fbb72bd9ef8a3be726b464f445638ea32879fe12b88ebe8e141ba4b0efe8ae02c225a3c07cbd1c65a5f9a57267f88213743ea2ab323a2f8f1c50ecca7b6ee9a0fea79147e75e0eca42d7cf6d4d9a1e658e44cd8dc36a7b91cca77237962b41d760dd6e3aed631486ad0f453ef4501e60f923d992103a3845a67fca331897cac2bd51790acf2661efa41d90eda2061ce1aa53cbeab80229844f3954fe9ac6447af516907739ea3e6bbb832770194e6e655ec3a7ab80374b17059080c1fa21970d0147401a1ca1e58e3c86d77d116f4208299d7a3665898b2009c3752c786e4b45042b51366a133974ec564c9d2f0d7cbad234223a19b52e0efeccd654fd2bdd57df81cd7b478ef2b59f8446075d812f9d62e63d1b38375765aa7d63965484ef4d9b0b90ec00b39ac0430cbfee05cd73c34ad9922f50292d69194220339e3c923a9121d0e5ab3b7fc0bc6a33cc87d4cc23eb205848aa1febd8dd07bc25978ee5c6f83db659433b6187af151b76870a994fe4440c46b27fc4fae2e4ed9d711e652e6c397ccd89fc7181d168405d21d9f218508d0af65af34d43b95a83cdeb6a2bed82a8b75dcd514403aa7201818b9a0b5fe9c6ef1ce91bb73a66ee7c1a9a66b736f5556eb0d06ddef99bd96b0e9385db94623bbb509536211963e99cf3cacab5e61491086104702d8df708e72b81f4ad4e045b51deece6dc18eab276de", 0x27b}], 0x2}, 0x0)

8m14.481446986s ago: executing program 3 (id=6250):
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0x9, &(0x7f0000006680))
accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000)
write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000700)='0', 0x1)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000086a82, 0x0)
dup(r0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
socket$packet(0x11, 0x2, 0x300)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, <r1=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)=<r2=>0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0xf0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac141400340008"], 0x2c}}, 0x0)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b)
syz_usb_connect(0x0, 0x49, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r3 = syz_open_dev$sg(0x0, 0x0, 0x1)
ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000010000002f000000bcfe711b8fc156a572ddd4858f75b651a7632cf1ad26f738367a7db0bb994e48dcf492d58d5303766ab374c05f7900984c92f922d8bfef0caa3452b490c08fadf6a9653523501949e6f74077ad7e3f34a6f058a585caf0d2795a7647974a2f757eb4fa4c23cd72766acdb64b02189d98a33ba180c38d1792f692b850d73d1f889ed11e549e07707f16e0730a8cfeaf09e3a7c7f6eec77874a2130f323ae5ce730a43ce59b506c060db51d1c0aa96f5787ac2e8e46240ec50f15546c9c198a59b8d847f093eb517f568673f00"/228])
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160-generic\x00'}, 0x58)
r5 = accept4(r4, 0x0, 0x0, 0x0)
recvmmsg$unix(r5, &(0x7f00000053c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0xa32, 0x60, 0x0)
syz_ublk_setup_queues(0xffffffffffffffff, r2, &(0x7f0000000200)={0x0, 0x2e62, 0x2000, 0x3, 0xb4}, 0x0, 0x4, &(0x7f0000001540)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r1, '\x00', {0x2, 0x48a, 0x0, 0x0}}, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000200)=""/87, 0x57}], 0x1, 0xe, 0x7)

8m13.557629866s ago: executing program 3 (id=6254):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x8e40, 0x0)
close(r1)
socket$netlink(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff5644d, 0x70b923, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {}, {0xe, 0xb}, {0xf, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x6, 0x808, 0x205, 0x1, 0xc}, 0xb, 0x1, 0x32, 0x5, 0xa, 0x2, 0x9, 0xd, 0x1, 0xfffffffb, {0xffff1c72, 0x23, 0x7, 0xc, 0xfffffffe, 0x7583}}}}]}, 0x78}}, 0x20048040)
sendto$packet(r4, &(0x7f00000003c0)="f9d33075218151db3d316f3a277fedbc88a846fe766f486d7cea18d5be2cf4380cc2470072201f35", 0x28, 0x4004011, &(0x7f0000000080)={0x11, 0x11, r3, 0x1, 0xdb, 0x6, @multicast}, 0x45)

8m13.283652968s ago: executing program 3 (id=6256):
r0 = socket(0x1e, 0x4, 0x0)
r1 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0xfffffffc}, 0x10)
setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000)
recvmmsg(r1, &(0x7f0000002740)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000003100)=""/4089, 0xff9}], 0x1}, 0x9}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001580)=""/32, 0x20}], 0x1}, 0xfffffffd}, {{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=""/73, 0x49}], 0x1}, 0x4}], 0x4, 0x7ffeece0, 0x0)
ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, &(0x7f0000000200))

8m13.082714206s ago: executing program 3 (id=6258):
r0 = socket(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000)
sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2c0000000d0a0108000000c50d66422468bfd300100000000a00fffe0900020073797a310000000009000100"], 0x2c}, 0x1, 0x0, 0x0, 0x4044840}, 0x8000)
r4 = socket$inet(0xa, 0x801, 0x84)
listen(r4, 0x8)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, 0x0, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
write$binfmt_script(r5, &(0x7f0000000200), 0xfffffd9d)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
madvise(&(0x7f00009c0000/0x1000)=nil, 0x1000, 0xc)
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @mcast1, 0x4}, 0x1c)
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000300)={0x7, 0x90b, 0x0, 0x8}, 0x60)
sendmsg$kcm(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1c00000022008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0)
statx(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1000, 0x40, &(0x7f0000000200))

8m11.434211512s ago: executing program 3 (id=6261):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94)
ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x0, [0x806f, 0x0, 0x2d5, 0x5, 0x6], [0x9d8, 0x5, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x200000100, 0x5, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x3, 0xc3c, 0x3, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x4, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x1, 0x8, 0x8, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0x0, 0x4, 0x5, 0x8, 0x8000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0x14, 0x5bc, 0x1, 0x7ffffffb, 0x4, 0x8000, 0xc9, 0x7, 0x6, 0x9, 0x82c, 0x7ff, 0xe000000000000, 0xe4, 0xf, 0x0, 0x8, 0x22, 0xffffffffffffffff, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x7, 0x0, 0x6, 0x6, 0xb, 0x100000002, 0x4, 0x4, 0x7, 0x7, 0x7, 0x8, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x100000003, 0x4, 0x7, 0x406, 0x3, 0x6, 0x2, 0x0, 0x3, 0x40, 0x7fffffff, 0x7, 0xe, 0x3]})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r1 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x973, 0x1c080, 0x0, 0x44a})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000cea000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000257000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x4, 0xfff3}, {}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000300)={0x7ff, 0x1, {0x3, 0x0, 0x6, 0x3}})
io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x2f)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = openat$cgroup_freezer_state(r2, &(0x7f0000000140), 0x2, 0x0)
write$cgroup_freezer_state(r3, &(0x7f0000000040)='FROZEN\x00', 0x7)
write$cgroup_freezer_state(r3, &(0x7f0000000080)='THAWED\x00', 0x7)

7m56.160687593s ago: executing program 34 (id=6261):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94)
ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x0, [0x806f, 0x0, 0x2d5, 0x5, 0x6], [0x9d8, 0x5, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x200000100, 0x5, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x3, 0xc3c, 0x3, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x4, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x1, 0x8, 0x8, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0x0, 0x4, 0x5, 0x8, 0x8000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0x14, 0x5bc, 0x1, 0x7ffffffb, 0x4, 0x8000, 0xc9, 0x7, 0x6, 0x9, 0x82c, 0x7ff, 0xe000000000000, 0xe4, 0xf, 0x0, 0x8, 0x22, 0xffffffffffffffff, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x7, 0x0, 0x6, 0x6, 0xb, 0x100000002, 0x4, 0x4, 0x7, 0x7, 0x7, 0x8, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x100000003, 0x4, 0x7, 0x406, 0x3, 0x6, 0x2, 0x0, 0x3, 0x40, 0x7fffffff, 0x7, 0xe, 0x3]})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r1 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x973, 0x1c080, 0x0, 0x44a})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000cea000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000257000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x4, 0xfff3}, {}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000300)={0x7ff, 0x1, {0x3, 0x0, 0x6, 0x3}})
io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x2f)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = openat$cgroup_freezer_state(r2, &(0x7f0000000140), 0x2, 0x0)
write$cgroup_freezer_state(r3, &(0x7f0000000040)='FROZEN\x00', 0x7)
write$cgroup_freezer_state(r3, &(0x7f0000000080)='THAWED\x00', 0x7)

11.309532861s ago: executing program 7 (id=8444):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00')
getdents(r1, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000f40)=ANY=[@ANYBLOB="12010000dc3f6e4013080100083a000000010902120001000000000904"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f0000000140)={0x7, 0xffffffff, 0x5})
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000000)=0x200000000)
write$vhost_msg_v2(r4, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000340)=""/185, 0xb9, 0x0, 0x2, 0x2}}, 0x48)
write$vhost_msg_v2(r4, &(0x7f0000000640)={0x2, 0x0, {&(0x7f0000001900)=""/4082, 0xff2, 0x0, 0x2, 0x2}}, 0x48)
write$vhost_msg(r4, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48)
write$vhost_msg_v2(r4, &(0x7f00000004c0)={0x2, 0x0, {&(0x7f0000000400)=""/192, 0xffffffdc, 0x0, 0x3, 0x2}}, 0x48)
write$vhost_msg_v2(r4, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000940)=""/193, 0xfffffffffffffd00, 0x0, 0x2, 0x3}}, 0x48)
socket$unix(0x1, 0x5, 0x0)
connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_int(r3, 0x6, 0x18, &(0x7f0000000100)=0xfefffff9, 0x4)
r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0)
ioctl$RTC_UIE_ON(r5, 0x7003)
ioctl$RTC_WKALM_SET(r5, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0xf, 0x35, 0x17, 0x8, 0x9, 0xfb, 0x2, 0x11, 0xffffffffffffffff}})
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
close_range(r6, 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000002c0)=[@mss={0x2, 0x4e}, @window={0x3, 0x7}, @timestamp, @mss={0x2, 0x1}, @mss={0x2, 0x94b}, @sack_perm, @mss={0x2, 0x7fffffff}], 0x7)
bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x48)
creat(&(0x7f0000000140)='./file0\x00', 0x2d)

9.217098384s ago: executing program 1 (id=8456):
bpf$PROG_LOAD(0x5, 0x0, 0x0)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0)
fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x1)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe})
fremovexattr(r0, &(0x7f0000000000)=@known='system.posix_acl_default\x00')
getsockopt$MRT(0xffffffffffffffff, 0x0, 0xd0, &(0x7f0000000000), 0x0)

8.350707506s ago: executing program 1 (id=8459):
ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff2424852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633bffff0e0b5a293e3877adc1660edbc9a0307a25720a70e419dc44febf7ddc73fd4a5a0b6c28667f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4a3ab2e156a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d3acc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a5ee0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b417354335f8cf20d0d96ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"})
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e000000000000000000140000001100"], 0x80}}, 0x0)
syz_emit_ethernet(0x55, &(0x7f0000000000)={@remote, @local, @val={@val={0x88a8, 0x0, 0x0, 0x1}, {0x8100, 0x3, 0x0, 0x3}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x1, 0x14, 0x67, 0x0, 0x6, 0x32, 0x0, @loopback, @multicast1}}}}}, 0x0)

8.320717748s ago: executing program 1 (id=8460):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x940, 0x0)
syz_usb_connect(0x3, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109021b00010000000009043200019740a40009058203ffeac80f936640fe3b6cbdabcd0e6a4fc95a80e3f65dbba2ac0ab0b9efda6209b5881499b3a29ab430a606de3918d7"], 0x0)
syz_clone(0x8847280, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
write$char_usb(r1, &(0x7f00000003c0)='0', 0x1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02})
ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000100)=0x1)

8.206225392s ago: executing program 7 (id=8461):
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000001200)=""/139, 0x8b}], 0x1)
timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r1=>0x0)
fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
socket$nl_route(0x10, 0x3, 0x0)
timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450)
sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a48000000060a010400000000000000000a0000050900020073797a32000000001c000480180001800d00010073796e70726f787900c72b00040002800900010073797a310000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x8080}, 0x24000840)
sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[], 0xe0}}, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0)
preadv(r3, &(0x7f0000000180)=[{&(0x7f00000001c0)=""/36, 0x24}], 0x1, 0x4, 0x2)
close(r2)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9, 0x0, "000080f100df000000a7d9de16c708db7200"})
dup2(0xffffffffffffffff, 0xffffffffffffffff)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000440)={{0x5000, 0xeeef0000, 0x3, 0x9c, 0x4, 0xf, 0x5, 0x6, 0xa, 0x3, 0x8, 0x5}, {0xffff0fff, 0xeeee8000, 0xe, 0xc, 0x7, 0x5, 0x8, 0x8, 0x7, 0x6, 0x5, 0xfd}, {0xd000, 0x800c000, 0xc, 0x24, 0x1, 0xa, 0x4, 0x9, 0x5, 0x0, 0x82, 0x1}, {0xa000, 0x6000, 0xd, 0x6, 0x8, 0x0, 0x0, 0x9, 0xf, 0x5, 0x2, 0x47}, {0x8000000, 0x0, 0x4, 0x9, 0xe, 0x80, 0x8, 0x0, 0x0, 0xe5, 0x3a, 0x9}, {0x1000, 0x80a0000, 0xd, 0x1d, 0x1, 0x8, 0xc, 0x10, 0x2, 0x3, 0x3, 0x5}, {0x8000000, 0x8080000, 0xb, 0xff, 0x6, 0x3, 0x6, 0xdd, 0xf9, 0x2, 0xa1, 0xf}, {0x25000, 0x4000, 0x3, 0x6, 0xad, 0x8, 0x3, 0x4, 0x3, 0x3, 0x3, 0xfc}, {0x0, 0x7}, {0x3000, 0x4}, 0x80010000, 0x0, 0xa000, 0x0, 0x3, 0x800, 0x8000000, [0x6, 0x80000001, 0x401, 0x10001]})
bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e1e, 0x19fb, @empty, 0x75c41ba2}, 0x1c)
setsockopt(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8)
ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000380)={0x1, @pix_mp={0x8000000, 0x0, 0x32525942, 0x9, 0x0, [{}, {0x0, 0xffffffff}, {}, {}, {}, {0x0, 0x6}, {0x6}], 0x0, 0x8, 0x16, 0x1, 0x7}})

7.144920985s ago: executing program 7 (id=8465):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00')
getdents(r1, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000f40)=ANY=[@ANYBLOB="12010000dc3f6e4013080100083a000000010902120001000000000904"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f0000000140)={0x7, 0xffffffff, 0x5})
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000000)=0x200000000)
write$vhost_msg_v2(r4, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000340)=""/185, 0xb9, 0x0, 0x2, 0x2}}, 0x48)
write$vhost_msg_v2(r4, &(0x7f0000000640)={0x2, 0x0, {&(0x7f0000001900)=""/4082, 0xff2, 0x0, 0x2, 0x2}}, 0x48)
write$vhost_msg(r4, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48)
write$vhost_msg_v2(r4, &(0x7f00000004c0)={0x2, 0x0, {&(0x7f0000000400)=""/192, 0xffffffdc, 0x0, 0x3, 0x2}}, 0x48)
write$vhost_msg_v2(r4, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000940)=""/193, 0xfffffffffffffd00, 0x0, 0x2, 0x3}}, 0x48)
socket$unix(0x1, 0x5, 0x0)
connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_int(r3, 0x6, 0x18, &(0x7f0000000100)=0xfefffff9, 0x4)
r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0)
ioctl$RTC_UIE_ON(r5, 0x7003)
ioctl$RTC_WKALM_SET(r5, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0xf, 0x35, 0x17, 0x8, 0x9, 0xfb, 0x2, 0x11, 0xffffffffffffffff}})
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
close_range(r6, 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000002c0)=[@mss={0x2, 0x4e}, @window={0x3, 0x7}, @timestamp, @mss={0x2, 0x1}, @mss={0x2, 0x94b}, @sack_perm, @mss={0x2, 0x7fffffff}], 0x7)
bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x48)
creat(&(0x7f0000000140)='./file0\x00', 0x2d)

5.411038762s ago: executing program 6 (id=8473):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c40)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010329bd7000fcdbdf25240000000c000180080001"], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x20004000)

5.309027333s ago: executing program 6 (id=8474):
mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, <r1=>0x0}, 0x2020)
write$FUSE_INIT(r0, &(0x7f0000000340)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34014c40, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50)
syz_fuse_handle_req(r0, &(0x7f0000008340)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x6, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101)
dup2(r2, r0)
r3 = syz_io_uring_setup(0x34b9, &(0x7f0000000540)={0x0, 0x69ee, 0x10000, 0x5, 0x50, 0x0, r2}, &(0x7f00000000c0)=<r4=>0x0, &(0x7f0000000080)=<r5=>0x0, &(0x7f0000000180)=<r6=>0x0)
syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r3, 0x1, 0x1, 0x1, 0x0, 0x0)

5.259826835s ago: executing program 6 (id=8475):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0x2, 0x0, 0x20, 0x8}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}}, [@tmpl={0xc4, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x0, 0x2b}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 0x0, 0xff}, {{@in=@multicast1, 0x0, 0x2b}, 0x0, @in6=@empty}, {{@in6=@mcast2, 0x0, 0x3c}, 0x2, @in=@remote, 0x0, 0x1, 0x3}]}]}, 0x17c}}, 0x0) (fail_nth: 7)

4.728048499s ago: executing program 6 (id=8477):
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010001080000406d0498c2400001020301090224000101ff78090904000d010301000009217fff7701225b0109058103000203089e"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)
getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240))
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x6, 0xe, 0x4, 0x4, 0x2, 0x1000, 0xf1, 0x0, 0x7fffffffffff9, 0x10000000005, 0x0, 0x1, 0x0, 0x5, 0x0, 0xbde], 0x1000, 0x3c4210})
ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000040)={0x10200, 0x80, 0x300, &(0x7f0000000340)=[0x5, 0x0, 0xe, 0x80, 0xe6b4, 0x101, 0xfffffffffffffffa, 0x2, 0xa, 0x2, 0x2, 0x700000000000000, 0xb, 0xffff, 0xfffffffffffffffe, 0x7, 0x7fffffff, 0x5, 0x26, 0x9880, 0x5, 0x6, 0x8, 0x2, 0xfff, 0x20000000009, 0x9, 0x1fd, 0x8, 0x7, 0x7, 0x5, 0x20005, 0x2, 0x4ff, 0x40, 0xfffffffffffffff5, 0x4, 0x7fffffff, 0x7d, 0x0, 0x6, 0x20008, 0x2e2, 0x101, 0x8, 0x8000000000000001, 0xfffffffffffffff9, 0x4100000000, 0xfffffffffffffffd, 0x8, 0x9, 0x7fff, 0xec, 0x8000000000000000, 0x2, 0x94f, 0x150b0000, 0x7fffffffffffffff, 0x6, 0xffffffffffffffff, 0xd, 0x11, 0xa, 0xe, 0xa8, 0x1, 0x2000000000000007, 0x7fffffffffffffff, 0x38c, 0x7, 0xdc8c, 0xae8f, 0x100001e30fa4c, 0xa, 0x0, 0x4000008, 0xdac, 0xe94, 0x7, 0xfffffffffffffffc, 0xa8, 0xba00, 0x4, 0x5, 0x0, 0x1, 0x100, 0x7fffffffffffffff, 0xe, 0xfffffffffffffff9, 0x3, 0x5, 0x21, 0x5, 0xfffffffffffffffe, 0x401, 0x9, 0x1e4b, 0x2, 0x79, 0xf, 0x10000, 0xe, 0x2, 0x3, 0x3, 0xfffffffffffffff9, 0x0, 0x4, 0xa, 0x40000001, 0x9, 0x2, 0xffe, 0x80, 0x10000003, 0xd, 0x44, 0x6, 0xffff, 0x1, 0x401, 0x4, 0x2, 0x8000000007, 0xea7, 0x1]})
syz_usb_control_io(r0, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000)

4.649956726s ago: executing program 1 (id=8479):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)
getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240))
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xc1b}, 0x28)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x6, 0xe, 0x4, 0x4, 0x2, 0x1000, 0xf1, 0x0, 0x7fffffffffff9, 0x10000000005, 0x0, 0x1, 0x0, 0x5, 0x0, 0xbde], 0x1000, 0x3c4210})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000)

4.085587002s ago: executing program 7 (id=8483):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="20000000100001"], 0x20}}, 0x800)
recvmmsg(r0, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001180)=""/4096}, {&(0x7f0000000440)=""/128}], 0x0, &(0x7f00000004c0)=""/193}, 0x7f}, {{&(0x7f00000005c0)=@in, 0x0, &(0x7f0000000700)=[{&(0x7f0000000640)=""/35}, {&(0x7f0000000680)=""/127}], 0x300, &(0x7f0000000740)=""/23}, 0x3}], 0x400000000000054, 0x40012100, 0x0) (fail_nth: 1)

3.952309466s ago: executing program 7 (id=8484):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0)
close(r0)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
ioprio_set$pid(0x2, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r4 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r4}, 0x68)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00)
r5 = syz_usb_connect(0x3, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0)
syz_usb_connect$printer(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="0d01"], 0x0)
syz_usb_ep_write$ath9k_ep2(r5, 0x83, 0x8, &(0x7f00000000c0)=ANY=[])
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
io_uring_setup(0x705b, &(0x7f00000004c0)={0x0, 0xe58f, 0x8000, 0x2, 0x1db})
r6 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
r7 = openat$binfmt(0xffffffffffffff9c, r6, 0x42, 0x1ff)
write$binfmt_script(r7, 0x0, 0x0)
execveat$binfmt(0xffffffffffffff9c, r6, 0x0, 0x0, 0x0)
sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001400)=@newtfilter={0x43c, 0x2c, 0x8, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xa}, {0x9, 0x5}, {0x1, 0x3}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x40c, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x8, 0x4c18, 0x4, 0xf, 0x5e658b64, 0xfffffffb, 0xf, 0xffff, 0x1, 0x7, 0x0, 0x80, 0x3, 0x4, 0x9, 0x200, 0xfff, 0xfffffffb, 0x7, 0x10, 0x2, 0x5, 0x5, 0x5, 0x2, 0x2, 0x1, 0x0, 0xffffffff, 0x9, 0x8, 0x5, 0x5, 0x40, 0x8, 0x6, 0xe, 0x1ff, 0x2, 0x0, 0x5, 0x5, 0x2, 0x7f800, 0x7, 0x4, 0x2, 0x7, 0x0, 0x0, 0x4, 0x3, 0x0, 0x7, 0x8000, 0x511, 0x1, 0x7, 0x6, 0x3e0, 0x4fe, 0x3, 0x1cb, 0x10000, 0x80000000, 0x9, 0x4, 0x7, 0x3, 0x6, 0x7, 0xf5e, 0x5, 0x9, 0x65, 0x3, 0x10000, 0x7f, 0x10000, 0x2, 0x6, 0x1, 0x8, 0xefb, 0xffffffc0, 0x4, 0x6, 0x4, 0x7, 0x7f, 0x4, 0x4, 0x80000001, 0x0, 0x3b53, 0xbcf, 0x1c, 0x81, 0x4, 0x6, 0x8001, 0x2, 0x4, 0x3, 0x0, 0x40, 0xfec6, 0x0, 0x3, 0x8001, 0x9, 0x3df, 0x890, 0x7, 0xe181, 0x21, 0x1b2, 0x1, 0x10001, 0x86, 0x10, 0x19e, 0x6, 0x5, 0x4aa0, 0x3217, 0x1, 0x0, 0x4, 0x4, 0x8, 0xe, 0x6, 0x5, 0xb005, 0x10000, 0x8, 0x6, 0x7, 0x7, 0x10000, 0xfa, 0x9, 0x1, 0x1, 0x82, 0x8, 0x7, 0xc4e, 0x4, 0x9, 0x3ff, 0x7b82eae2, 0x200, 0x3ff, 0x7, 0xfffffbd5, 0x5, 0x400, 0xfffff360, 0x8, 0x4, 0xd6d, 0x1, 0x9, 0x3, 0x9, 0x0, 0x3ff, 0x8, 0x5, 0xfffffff9, 0x4, 0x0, 0x0, 0x80000001, 0x3, 0x618, 0x5, 0xd0, 0x9, 0xa, 0xec, 0x3, 0x6, 0x5, 0x1, 0xffff8001, 0xf00, 0x9, 0x2, 0x400, 0x3, 0xfffffffd, 0x9, 0x1001, 0x6, 0x2, 0x3, 0x4, 0x7, 0x7, 0x2, 0x9c28, 0x2, 0x2, 0x8000, 0xdb4, 0x6, 0x6, 0x0, 0x100, 0x0, 0x2, 0x40000006, 0xa, 0x2, 0x1, 0x51c7, 0x40, 0x0, 0x0, 0xe1bb, 0x7, 0x3, 0x8, 0x6, 0xa4a, 0xaa, 0x9, 0x1ff, 0x2d0, 0x3, 0x6, 0x1, 0xffff, 0xffffffcc, 0x4, 0x6297, 0x1, 0xa9ef, 0x7, 0x100, 0x3, 0x1, 0x0, 0x8, 0x2a47, 0x5, 0xffffffff, 0xd4a, 0x7, 0x7, 0x2, 0xc, 0x6]}]}]}}]}, 0x43c}}, 0x800)
r8 = mq_open(&(0x7f00000001c0)='ba\xa5J_\xe5\xf9|a\x1dv]\x13mave_1\x00\xe0\xb2\xf0\xabT\x87I\xa4\xd4)c\xf2\xe0\xd0\xba\xdb\f\x16n\x96J\x90c\xc5~#\xc9\xfb\xef5\xab\xb9\xe8\xc7\xde\xc2\x80\f\x19L\xdb\xdc\x14\xb4\x86\x1d\xe0\x9b\xe4\"m\'+\xc8\x05\xa4\x1cT`\xdcL\x8f\xf0\xc9\xb7\xc8D\xcdWG\xe6%\xd9', 0x8c2, 0x30, 0x0)
mq_getsetattr(r8, &(0x7f0000001080)={0x0, 0x20000000006, 0x8001, 0x55e}, 0x0)
mq_timedreceive(r8, &(0x7f0000000140)=""/107, 0x6b, 0x0, 0x0)

3.698811943s ago: executing program 5 (id=8487):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mtu(r1, 0x0, 0xa, 0x0, 0x0)
sendmsg$inet(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x11, &(0x7f0000000980)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x12}, @initdev={0xac, 0x1e, 0x0, 0x0}}}}], 0x20}, 0x4000004)

3.56795965s ago: executing program 5 (id=8488):
r0 = socket$can_raw(0x1d, 0x3, 0x1)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4})
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c090}, 0xc000)
writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}, {0x0}], 0x2)
io_uring_enter(r1, 0x2219, 0x1adf, 0x16, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000780)={0x1, &(0x7f0000000000)=[{0x34, 0x0, 0x0, 0x2}]})
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x31, 0x0, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00'})
r2 = socket(0x10, 0x3, 0x0)
socket$can_raw(0x1d, 0x3, 0x1)
write(r2, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e000000000000ea08000f0001000000", 0x24)

3.120720886s ago: executing program 1 (id=8489):
syz_open_dev$dvb_demux(0x0, 0x0, 0x41)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
r1 = syz_usb_connect(0x3, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0)
syz_usb_control_io$cdc_ncm(r1, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x1a, {0x12}}}, 0x0)
syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xc38, &(0x7f0000001240)=ANY=[@ANYBLOB="7c2f0aec9d222ea5ee20e6b25cf191669d6293d87d67cbc22a8dca55b40c545d1439d9ab278a279afd807e25e3c9aacca664836fec718e063c9b06cd66442b6407fec5c3e5cd9d0f1001c90a801c4fadce8e13a5e0209edf5c5693acccefa24d4f5a2ef062e701d054d19e9e6340a1651e05fd87b70942c679234426f9b19c0723563d0e38ec970aec02a6154ab61081aae03050d00192bd9d59977bb2f1297a7cd0571a0dfc5688a8e3d5f4a226b7e397b43c186967c74821bc70005059ab5606c70045a6a9915285c8215b9abd839f50530dde8ad500d70d8f7c1a0093293e6d632f8e8939f3199ab4ec92caed14c26975b57578c8ea666a2e4253ca9516f3c07bdc5ad27c2ff29e1569795f9dfbd1b92919432e423ff4f9a35b77419d6a8540fc9431ca78e05e278bef5a21b1423a3c9f7c1e2bd16a1ecdfde51cfa4aef38e6afb92770bcefb5fcb277ccede1ddc8647db538661b3d10effa1b6f705ef1b74e5bea20b4f98421b7b4be4c5c6be101f5503a4ecaffae335ef565920d678ed5b41031122b21f9d9b7f270b95f94624a7ddc657c83d3722a8d01f321fd7f685fc74d61a4e1914dda6df4be639c4910c56a84c24a41b9ef07eee4083dd9a30a53a58b50186c12180da4186fe5845b6b325fd112378a82d53bee449bc9d4c2d4331a1323c69c99c778560fc2142d138b23000c5403156cd8223f07a73811ab5b81e287bd6ad95c2fefce002ac77a1ac74d5e868870f29277da69987652b0055b3072efab2fe56fe0fe287f7d51aa772b2e3ae77954a938be2792442e1ab2e6fc078d821c70222142568b6db9609f1db23e8a4a460b9fbbeb48469e6bf0acffd85af86e69535a95c02c30d5ad776002c48e19e134688780bbafaf81097358b0c8f63bcefb61d8f29aacb3dc1a485bb7343539387f1e83b9283674bdc0d7fe8bf86948439f4b4a20e2832c560c743e4c2d37eddbf341c47f71a93101a08a533e96601f98752531428944d88c836c7d7a082859a3120721afd99130e83f689720638e889ddf4a23228dc23e955ae67fe5447e134b63f4c72e5664d2ed8a7406568e08f3582661006cf5800615fc4a5ec88ef3361ea027d2a1a550ac3e017a212570cd145fcc2e1984e4fca28bf4110f33a5ac847fcd3605e546ee8ea49a7de5d4b599926a76028e9d5259db7fd6f908c7a8657d42f895380c88ac85cdc183f6b61172b966a41888ceae895eaf18cb8da8d1918411b297959a8abacf8c4cee15ca87048aae13ffe068dee23a9edc2b259aeb0595b7ed2633431067a999f915934aef1be5f360f0db726f24e8eb89adb8db535de6fd7c06678831d17e47c67cd22f047b92d8fba83a49a1285def4dfdf634408cb05ae73f24df76e7393d1e90d40c50bd388bb53e281b889084a1a19efdfa6be16aed1a621d964c1ac332b65765e7440ccc75ef44851409c458905127bd161bf98cb6a3681af073e3650f52d5ee691c347e86360c3aebae4a691b2485d68c57d09e269656b1efbfd3413d54c8d3e467c0bfa84669d0cc5e9cfd50b9c79171f8b6a5e66e8c6f66c0916083b8e8a464498aed3badd2f267fb56adb0953b9ebd0370f941d796abffa81722d502c8d1e9d844802f4197067598b2394dddf76641f9c2ec0403bd379e8f712668b98e1121a27888b227104875999cd562fa9833458879652bfeffabc6bbb5c354dc36ad91354ccb5050d69b28b562a72bbf277f96bd1d5dc6408329f6f850a96762a6aebf2a7b5bacbbc032be8b29c453867a47094289f6b8aa38f85051fc4d4478a02af664b3250a396583001a7971cfa6f5a4931e32e7bfb7b4c3f7be3bc5f91ba46554773b9102dbd4aba4344c6fe87bd050f79175d7918d57bc137cde33a884bba63a1adf6e7e71ba783eb1fe689b23d3ad18627b0b229c0d982631308a88c4bf1e2079eb0fcc486ef864e7c6a75cce17b133577fa88d62807398b8a795ae2bb7610f8b17cfc56ff11b8ffc4aa316e612fc76955dc44e66467c4d632657d4cac3cc1bda8c2c6207915a89f76bf1fd61c156ba8720bb8048601cd1221f6996e6f04e44b842e00a4487cd59501a65db1f6ade7f22ba5d7ee8e67125e284eef41ad5f2069a48cc71c621eb08d832ef8592874199c5c03249d3ee03422535c2be6919c43724277d56a885ab67753ae8d7f1317b7e534bb1a111a0edb5d298c1374c7824a80fb00ae268f2fd641f1b2a12f712d9a5e027957941ffb4218c6d8a8e7950dca0b4c9018dcfb67244a30080d54781b5111c85cd89e08f51c55975301ff389baf2242ef0fb662122a2eb89c1dcaf82d6391906a1b235635e6c484cd5fa32bc80ce68d505df9a9c6b21e222c3b9330243b8e02a3e661c20e0da633d88f7debaf6643654050ab73613dbea6176109b5c35c4d280739aee77f81a1b58efa9e606259f45745b69523bc81828cfcfffd185ad51b4b183b7a1ef86757172ef67a4f153b7c3a3e99f15ef5b09d81cd1ccec8016ecc9864ccf2efdbf7a79ff9ba814a4a9e3124d735a591c649cdefa98bd569c5f4db18a537c55544c671d398ec50d9fc2b1ca1f9b0278acc9a21779c3815fcb0ee1c66c774b6591e8f6b5c9828db8a5d104213cd4513974be404a50c11009c15a1e2aaa81abc6c706c341f145f975717819c4429007ee648f6c3fca45d714981cd9240beea8b02a19e0ddb083dc8115d64d75ab087c87e00792b8b83551ca82b311444067923656b0e70015ca4775da3d5e984ea8af20955f92d9cbd9acca8cd258df4276a118505d440b74e93bd0b97caeb0e24dbb09e7dbdfe0c3b4bdc0983a7d1eee02bee9c5d381bfbd7dfbb6329539698477f3a8bc7f82c01588d679a167e91487f150e5923cbf3030f09c8fb89cf178f5e953618887b7e56afdfd6a6b5e3003cecdbcba76ed86bc48907fada5e0178f9194970323ae9c818215ae2feb1ee56b289d83e8e9d2ab27056ede5651d2a92a93dd3d6c519ac128a44f1414f93e96c55485a73f3cb7e4750d0f2a2acef87e46a7012a30712f7cfe2ac9372af0efcb6475e3a1a8db1961040002915038412b892eee569aae8f38fb07c27aef5bbab7750a244a7c3b0193004246afa1a72368db45cd3649a89b54e880ea12c92beb59e366d7893f725bb8080aebcd35857ff686d03eddc33af248cecc5198bda6f395b55294821f6853232cb5bde67a4166a35224cd9c5b54e6b5a38376b1fdfaeb7563a8ea93148997e2bf490c67916f059e3e1992a986f96d2720a6418cf8c57d6e72eb90d7ca59a3a20fd414e404900aa4a45f381ff7828e15558b4862055bf795c9134836878999200e71e9ba9f83a2e28955c7b37244f3abc8f9d15a5e6c3d9b2f76620b3b2bcb13c0c44c63b9bddd51e339aedfc3a4d995df0eca66c6891ca9099923577e7cd84cb58cf0d6d6eda2baeb00775c4e717e31dbc881615d5f1a0898017954e882a444017e947b1fc05fdcf4495c5dbe3b7b4ce4c1535070fbc64d135df094fe4f6cdd452e7a5f844145af9b746dc5eecede9a834de1ff65525ea3017478ee08dc1bcff852a9d2ad94f46840bdcf1b6226fb0cdb620787692e52aae3b9b703f30b3ce6ca6dcaeb8b3a5884c30c570b29741c70ad99f5d7f463c7e5e1b4bbaafae33e789c0ae1114674732d50c0a799bfa6388365c392d47c3e0d2992a61d21e4ca034ed3d386fe959a94601a4007f1f2060b59359747635b076db7697ba5ad45af0423dbb9966113fa5eb59118cac394c2e2b17ebec1b7ce18ede120b1f56956b12a95de708e780ba7a1ac3a9e31267a2c195acfcb3b20c2f5d20de288846045211da53649a6d8b23008449b763fe6a58243cde95093a9755e5725307af09c997520f159f4ec7d1e687a0cf5148721062ecc6b080f65a550730da9257f1515a10830e29b85de3138a77ee8d2f0cb129c971417d7bbcd982d684b697364084c5764bafb4e2211a82e8c962eefb1f000ac8f5f2567b580931676943cea9b95977d842c247a98672b5c73594eb51f927ee5ec2b0c45eda29fb83a092880e542c60113ca653923aa0c16e2e1604e5f437876cb7fa7d1498584f8800ff80804d41c7b89e9cba341fed8d260a6abd0fc242ba6b3d624c91c468e269069d0a121f0951c3765f18693a2c547d9bc924058d0ecece5c7802126d293d3033d6bbf83d4b8b0144d27cbb985dba465d75b62a93bf7a438cce59f", @ANYRES16=r1])
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a70000000060a0b0400000000000000000200000244000480400001800b00010074617267657400003000028014000300e18eb063bae294fe8f45a9b02fdf068408000240000000010d000100434f4e4e4d41524b000000000900010073797a30000000000900020073797a32"], 0x98}}, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0)
mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0)
ioctl$EXT4_IOC_MIGRATE(r4, 0x6609)
r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000980)={r7, 0x20, &(0x7f0000000940)={&(0x7f0000000780)=""/174, 0xae, <r8=>0x0, &(0x7f0000000840)=""/228, 0xe4}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x13, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="8500000098000000185100000d00000000000000000000b2bd1d759ef00c9800000000000000000018430000fbffffff0000000000000000850000000d00000085000000ad00000085100000ffffffff2f5a060000000000"], &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x13, &(0x7f0000000240)=""/19, 0x40f00, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000600)={0x2, 0xc, 0x80000001, 0xbd}, 0x10, r8, r7, 0x6, 0x0, &(0x7f00000009c0)=[{0x4, 0x7, 0x2, 0x48d937bcc3591dbe}, {0x1, 0x3, 0x10, 0x2}, {0x4, 0x3, 0xa, 0xb}, {0x4, 0x1, 0x5, 0xc}, {0x0, 0x1, 0xa, 0xb}, {0x4, 0x5, 0xa, 0xa}], 0x10, 0x8}, 0x94)
move_mount(r7, &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x120)
ioctl$SIOCSIFHWADDR(r5, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01320136b1ff"})
r9 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r9, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r9, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r9, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3)
sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f030005000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000)
r10 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2)
ioctl$VIDIOC_ENUM_FREQ_BANDS(r10, 0xc0405665, &(0x7f0000000080)={0x1, 0x1, 0x6, 0x20, 0x7d, 0xa370, 0xa})

2.832556232s ago: executing program 5 (id=8491):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x8, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x25, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0)
fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x1)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe})
fremovexattr(r0, &(0x7f0000000000)=@known='system.posix_acl_default\x00')
socket$igmp(0x2, 0x3, 0x2)

2.472588744s ago: executing program 4 (id=8493):
syz_open_dev$sndctrl(&(0x7f0000000000), 0xfffffffffffffffc, 0x400000)
r0 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081084e81f782db44b904021d080006007c06e8fe55a10a0015400100142603600e120800060000000201a80016000900014003e01100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e97", 0xd7}], 0x1}, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f00000006c0)={@in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x0, 0x0, 0x0, 0x0, "698e86252c563a2eb894ac1de863c527984bfa5ff139aeeef086eed112e6f0ffba88c7d0888990f99dc2416c1cbccf99d18464a65c3587c97aee9217b992893cebfc606ada5e14e782e63da22a6fe97d"}, 0xd8)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040))
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]})
r1 = timerfd_create(0x7, 0x0)
timerfd_settime(r1, 0x1, &(0x7f0000007000)={{0x0, 0x4}, {0x0, 0x989680}}, 0x0)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f00000000c0)={'veth1_to_bond\x00', @random="0131013000"})
r2 = socket$l2tp(0x2, 0x2, 0x73)
setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000bc0)={0x80000000, 0x6bd, 0x960}, 0xc)
r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="b4050000000000006110180000000000760000000000000095000000000000005cb6bf6ef64107127b04c78e7ef363b6bc33ecc11b13e83ecbd1f61e39904a778741f77f5c50716f883347bfe9aa70f5b090554da8a3cd69fdba7290e29636e083dc70e863408d34da4443b7e18e4b21cc2e5046d4254b2aef141728315b2e313c35079350146dc5de546ef2fe7e9a7a4df5430a"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48)
fstatfs(r3, &(0x7f0000000200)=""/210)

2.317011935s ago: executing program 4 (id=8494):
r0 = socket(0x2b, 0x1, 0x1)
setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4)
connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c)
openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0)
ioctl$VIDIOC_TRY_FMT(r3, 0xc0d05640, &(0x7f0000000440)={0x0, @sdr={0x34565559, 0x8}})
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000f00000300000a3c0000000c0a010100000000000000000a0000060915020073797a31000000000900010073797a3100000000c4d4af170c000080080003400000000a1400000011000100e16efe4300000000000000007bc0f2cf414233ce3a5e3c3a2395086e524f0e66e17c3da8299be4ab831b2ba90aff57bba7c67e6401090166bd7a2d1295daa0a30a849f8bb2d8e8e3d94722b145a029ec1e051298692c1a507d1dbbbfa49c41662b229816f755599c2aa590150ad1dc380aeaf9f617f846fe9026041d78c491027e47124ecd0f6975"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
getsockname$packet(r6, &(0x7f0000000600)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4040}, 0x20044004)
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = socket(0x10, 0x803, 0x2)
syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r9)
getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001000030428bd78000000080000000000", @ANYRES32=0x0, @ANYBLOB="46060900000000001c10ce7f09000100766c616e000000000c0002800800000008000500", @ANYRES32=r10, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x4040884}, 0x0)
r11 = syz_open_dev$radio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2)
ioctl$VIDIOC_S_EXT_CTRLS(r11, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f903, 0x0, '\x00', @string=0x0}})
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r7], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r12 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='maps\x00')
ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000180)={0x50000, 0x14000})
prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0)
syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00')
syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r12, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000200)="f30fbd902798baf80c66b8d481be8866efbafc0c66ed673e2665f30fc7760766b9800000c00f326635010000000f300f3066b9800000c00f326635002000000f3066b9800000c00f326635000800000f300f22d8660f2b1064f20f127e08", 0x5e}], 0x1, 0x0, 0x0, 0x0)

1.910781293s ago: executing program 5 (id=8495):
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8849}, 0x40000)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYRESOCT, @ANYRESOCT, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=<r1=>0x0], 0x3c}, 0x1, 0x0, 0x0, 0x20040054}, 0x4000)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=<r2=>0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32], 0x5c}}, 0x40)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000e00)=ANY=[@ANYRESOCT, @ANYRES32=r0, @ANYRESOCT=r0, @ANYRES32=r1, @ANYRES16=r2, @ANYRESOCT, @ANYRESOCT=r0, @ANYRESDEC=r2], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20008084)
sigaltstack(&(0x7f0000000a40)={0x0}, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x9, r4})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
readv(r5, &(0x7f0000000040)=[{0x0}], 0x1)
socket$kcm(0x2, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x4008032, 0xffffffffffffffff, 0x0)
r6 = syz_io_uring_setup(0x5c47, &(0x7f00000002c0)={0x0, 0x23ea, 0x40, 0x0, 0x2a3}, &(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0))
io_uring_register$IORING_REGISTER_NAPI(r6, 0x1b, &(0x7f0000000400)={0xa05, 0x0, 0x3, '\x00', 0x1000}, 0x1)
bpf$PROG_LOAD(0x25, 0x0, 0x0)

1.515971903s ago: executing program 6 (id=8496):
close(0xffffffffffffffff)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r4], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0)
r5 = socket(0x10, 0x803, 0x2)
syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01"], 0x3c}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000)
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt(r7, 0x84, 0x82, &(0x7f0000000000)="c90a378f0b6db4b2", 0x8)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000009b80)=@newchain={0x24, 0x64, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xf}, {0xa, 0x1ffe4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x80)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008001b000000000004001a80180002"], 0x44}}, 0x0)
r8 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0)
r9 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001c000104000000000000000002000000", @ANYRES32=r4, @ANYBLOB="000014000a000100aaaaaaaeaaaa000008000f00010000003e11859a3351e595fc"], 0x30}, 0x1, 0x0, 0x0, 0x20000}, 0x0)

1.448593471s ago: executing program 5 (id=8497):
mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, <r1=>0x0}, 0x2020)
write$FUSE_INIT(r0, &(0x7f0000000340)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34014c40, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50)
syz_fuse_handle_req(r0, &(0x7f0000008340)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x6, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101)
dup2(r2, r0)
r3 = syz_io_uring_setup(0x34b9, &(0x7f0000000540)={0x0, 0x69ee, 0x10000, 0x5, 0x50, 0x0, r2}, &(0x7f00000000c0)=<r4=>0x0, &(0x7f0000000080)=<r5=>0x0, &(0x7f0000000180)=<r6=>0x0)
syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r3, 0x1, 0x1, 0x1, 0x0, 0x0)

1.362174894s ago: executing program 4 (id=8498):
sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYRES16, @ANYBLOB="010000000000fcdbdf2512000000180001801400020076657468300000000000000008000000080009"], 0x3c}}, 0x2004c0a0)
r0 = socket$inet6(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414003400080004"], 0x2c}}, 0x0)
sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) (fail_nth: 7)

1.300239389s ago: executing program 5 (id=8499):
syz_usb_connect(0x5, 0x3f, &(0x7f0000002040)={{0x12, 0x1, 0x250, 0xd4, 0x8b, 0x86, 0x10, 0x45e, 0x468, 0xb29c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x3, 0x40, 0x20, 0x7f, "", [{{0x9, 0x4, 0x4a, 0x1, 0x3, 0xb5, 0xef, 0xe4, 0x9, [], [{{0x9, 0x5, 0x35027ad7510f81c3, 0x2, 0x200, 0x1, 0x1, 0x8}}, {{0x9, 0x5, 0xd, 0x2, 0x8, 0xfc, 0x40, 0x9}}, {{0x9, 0x5, 0x1, 0x3, 0x40, 0x3, 0x96, 0x7}}]}}]}}]}}, &(0x7f0000002500)={0x0, 0x0, 0x0, 0x0})
syz_usb_connect$cdc_ecm(0x6, 0x79, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x67, 0x1, 0x1, 0xd, 0x0, 0xfb, "", [{{0x9, 0x4, 0x0, 0xf5, 0x2, 0x2, 0x6, 0x0, 0x5, {{0xa, 0x24, 0x6, 0x0, 0x0, "e1d4f3506c"}, {0x5, 0x24, 0x0, 0x7d}, {0xd, 0x24, 0xf, 0x1, 0x330, 0x3, 0x3, 0x2}, [@mbim={0xc, 0x24, 0x1b, 0xa, 0x61dd, 0x7, 0x6, 0x8000, 0x9}, @mbim_extended={0x8, 0x24, 0x1c, 0x6, 0x3, 0x5}, @mbim_extended={0x8, 0x24, 0x1c, 0xc, 0x5d, 0xbe}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0xed}, @ncm={0x6, 0x24, 0x1a, 0x800, 0x3b}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0xe0, 0x40, 0xe}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x1, 0x9, 0x7}}}}}]}}]}}, &(0x7f0000000740)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x0, 0x76, 0x2, 0xb, 0x8, 0x7}, 0x12c, &(0x7f0000000280)={0x5, 0xf, 0x12c, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x8, "7508b14e177b656a38dab1d4d3f5b456"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0x3, 0x6, 0x9}, @generic={0xf1, 0x10, 0xa, "fb158e71855ad65d1f261c265b044378ff256a9a5e7eeaf821dd04f3cb1f607ffde139528f2245df8ce117b6082f877d779a76d247ae0fe540e72df3c2ac94a97dc9b33c70a19d1595a994fef04f6f0c30f4cc8211429e626aa70ed98c4c9f766443982e5b272d03352bab63318a64aef4ed5bb3214a6c0b0029c83622cc003a4db7f4dc582042cd1e496314ecfbab4e5b1b82938ffe277e10de3e42f853a7028a5ce67cffeefaf125f19b3f3a9174f940f886d83c9921b81fe2e92e2ab7f4105ae80409d257666754b8041f33e87d1b2c84f4c7ca6414b5138515fcaea1702ee6a48496a7d8d0e48b576cec40df"}, @ssp_cap={0x18, 0x10, 0xa, 0x6, 0x3, 0x1, 0xff0f, 0x8001, [0x0, 0x3f, 0xc000]}]}, 0xa, [{0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x44d}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x8ef}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x61942630a84dd423}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x4466}}, {0x45, &(0x7f0000000500)=@string={0x45, 0x3, "19429ff8d2ca4b5997566211e7a35a9b5736acff7ae82c1c9c96a1e5ae7c0a346b4f39d06deba81e8548b410fd046f083718b9b9b2263cd07ac1731cc62c4b332387d6"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x440a}}, {0xa9, &(0x7f00000005c0)=@string={0xa9, 0x3, "d649354b7158ea7ef81fac725cd5edae7623b9efdbbcecd3e053c602a4851f7edff619861b96db9f9edc7dbd1a810176bf63484f3f811dc71452b30fb0fd8043cf73c0bb16cabe0d95c461ece8d0ec516747610b0f6937b34c11759faf4d7203e309f3ff3b311c8310448d439c38d93088d2f871348bcd0b2e2ecf9e8806f58bd88e9c0a18897ef4b095faabd2cd1a0b307fd45348f6ae43a3b87ec9e2b1a84f633c6435f7f86f"}}, {0x36, &(0x7f0000000680)=@string={0x36, 0x3, "bf230eb2ab01c0a72f9b43d788184aec2a41799c7112e184ddfd76bdc36d369c4a2e314822577c91883b22bfc8b8feb34da91436"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x2409}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x40b}}]})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r0)
recvmmsg(r0, &(0x7f0000002e40)=[{{0x0, 0x0, &(0x7f0000002500)=[{&(0x7f0000002e80)=""/4105, 0x1009}], 0x1}, 0xfffff004}], 0x1, 0x40010080, 0x0)
r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0)
write$dsp(r2, &(0x7f0000000200)='m', 0x1)
r3 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f0000000100))
r4 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0x82d65)
write$snddsp(r4, &(0x7f0000000200)="a3", 0x1)
ioctl$SNDRV_PCM_IOCTL_DRAIN(r4, 0x4144, 0x0)
ioctl$SNDRV_PCM_IOCTL_REWIND(r4, 0x40084146, &(0x7f0000000140)=0xfff)
sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000002400)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5)
sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000840)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000800)={&(0x7f00000001c0)={0x24, r6, 0x8, 0x70bd2d, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x4}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_sock_diag(0x10, 0x3, 0x4)
r7 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_generic(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000003b40)=ANY=[@ANYBLOB="280000001e002102000000000000000007000000140044801000f3800ccc66800800"], 0x28}}, 0x4000080)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x801}, 0x4000000)
r9 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r9, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f)
connect$inet(r9, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)

1.281735518s ago: executing program 6 (id=8500):
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd0000000000000109022400018000000009040000010300000009210500000122050009058103"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x1c, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x2, "d2903a4e"}]}}, 0x0}, 0x0)
r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402)
ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000080)={0x1, 0xf4, 0x8, &(0x7f00000000c0)={0x11, "d31d2a4cc4949d9c770df608c3e9eb85c80fe447883b00"}})
socket(0x1, 0x803, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000046617210460d11208f820102030109021b00010000000009040000012247240009050503"], 0x0)

863.92151ms ago: executing program 7 (id=8501):
r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x4000)
socket$alg(0x26, 0x5, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000000000006110a40000000000bc000800000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
unshare(0x22020600)
r1 = syz_clone(0x0, 0x0, 0x9, 0x0, 0x0, 0x0)
wait4(r1, 0x0, 0x80000000, 0x0)
ptrace(0x10, r1)
r2 = syz_pidfd_open(r1, 0x0)
waitid$P_PIDFD(0x3, r2, 0x0, 0xa000000c, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xffffff3e, &(0x7f0000000580)}, 0x40012000)

863.705886ms ago: executing program 4 (id=8502):
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0)
socket$l2tp(0x2, 0x2, 0x73) (async)
r1 = socket$l2tp(0x2, 0x2, 0x73)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) (async)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000000c0))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x0)
r2 = syz_open_dev$sndctrl(&(0x7f0000000080), 0xe, 0x5b1200)
ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0xc1205531, &(0x7f0000002680)=""/4078)

793.6037ms ago: executing program 4 (id=8503):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'hsr0\x00', <r1=>0x0})
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@ipv6_newnexthop={0x48, 0x68, 0x1, 0x0, 0x25dfdbfd, {0x2}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x2}, @NHA_ENCAP={0x18, 0x8, 0x0, 0x1, @SEG6_LOCAL_NH6={0x14, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}}}, @NHA_ID={0x8, 0x6, 0xf2}, @NHA_OIF={0x8, 0x5, r1}]}, 0x48}, 0x1, 0x0, 0x0, 0x404cc83}, 0x0) (fail_nth: 2)

608.805328ms ago: executing program 4 (id=8504):
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r0=>0x0)
ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, 0x0)
capset(&(0x7f0000000000)={0x20080522}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000c40)={0x14, 0x24, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
madvise(&(0x7f00003ff000/0xc00000)=nil, 0xc00000, 0x9)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, 0x0, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0)
write$USERIO_CMD_REGISTER(r2, &(0x7f0000000140), 0x2)
preadv(r2, &(0x7f0000000b00)=[{0x0}, {&(0x7f0000000100)=""/24, 0x18}], 0x2, 0x5, 0x3)
r3 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r3, 0x0, 0x80)
r5 = openat$cgroup_procs(r4, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0)
sendfile(r5, r5, 0x0, 0x200)
socket$kcm(0x10, 0x2, 0x0)
r6 = socket$inet6(0xa, 0x3, 0x7)
r7 = socket$inet6(0xa, 0xa, 0x8003)
ioctl$sock_ifreq(r7, 0x8910, &(0x7f0000000f80)={'ip6gretap0\x00', @ifru_hwaddr=@local})
connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000340)={{{@in=@rand_addr=0x64010100, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0xfffffffffffffff7, 0x4}, 0x0, 0x6e6bb9, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0xfffffffc, 0x6c}, 0x0, @in6=@empty, 0xfffffffc, 0x0, 0x2, 0x7, 0x200}}, 0xe8)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x12, 0xffffffffffffffff, 0x0)
remap_file_pages(&(0x7f000013e000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x1)
sendmmsg(r6, &(0x7f0000000480), 0x2e9, 0x0)
r8 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_RTOINFO(r8, 0x84, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x9, 0x5}, 0x10)

0s ago: executing program 1 (id=8505):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x8, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x25, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0)
fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x1)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe})
fremovexattr(r0, &(0x7f0000000000)=@known='system.posix_acl_default\x00')
socket$igmp(0x2, 0x3, 0x2)

kernel console output (not intermixed with test programs):

657][T31374]  </TASK>
[ 1646.688039][T31378] FAULT_INJECTION: forcing a failure.
[ 1646.688039][T31378] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 1646.771658][T31378] CPU: 1 UID: 0 PID: 31378 Comm: syz.7.8044 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1646.771692][T31378] Tainted: [L]=SOFTLOCKUP
[ 1646.771699][T31378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1646.771710][T31378] Call Trace:
[ 1646.771718][T31378]  <TASK>
[ 1646.771727][T31378]  dump_stack_lvl+0xe8/0x150
[ 1646.771757][T31378]  should_fail_ex+0x40c/0x560
[ 1646.771789][T31378]  _copy_to_user+0x31/0xb0
[ 1646.771812][T31378]  simple_read_from_buffer+0xe1/0x170
[ 1646.771838][T31378]  proc_fail_nth_read+0x1bb/0x230
[ 1646.771863][T31378]  ? __pfx_proc_fail_nth_read+0x10/0x10
[ 1646.771886][T31378]  ? rw_verify_area+0x24a/0x4c0
[ 1646.771910][T31378]  ? __pfx_proc_fail_nth_read+0x10/0x10
[ 1646.771930][T31378]  vfs_read+0x213/0xa80
[ 1646.771958][T31378]  ? __pfx___mutex_lock+0x10/0x10
[ 1646.771979][T31378]  ? __pfx_vfs_read+0x10/0x10
[ 1646.772003][T31378]  ? __fget_files+0x2a/0x420
[ 1646.772026][T31378]  ? __fget_files+0x3a2/0x420
[ 1646.772044][T31378]  ? __fget_files+0x2a/0x420
[ 1646.772071][T31378]  ksys_read+0x150/0x270
[ 1646.772096][T31378]  ? __pfx_ksys_read+0x10/0x10
[ 1646.772127][T31378]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1646.772149][T31378]  do_syscall_64+0x174/0x580
[ 1646.772167][T31378]  ? trace_irq_disable+0x3b/0x140
[ 1646.772186][T31378]  ? clear_bhb_loop+0x40/0x90
[ 1646.772210][T31378]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1646.772230][T31378] RIP: 0033:0x7f444755d68e
[ 1646.772249][T31378] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 1646.772265][T31378] RSP: 002b:00007f444837efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 1646.772286][T31378] RAX: ffffffffffffffda RBX: 00007f444837f6c0 RCX: 00007f444755d68e
[ 1646.772301][T31378] RDX: 000000000000000f RSI: 00007f444837f0a0 RDI: 0000000000000006
[ 1646.772313][T31378] RBP: 00007f444837f090 R08: 0000000000000000 R09: 0000000000000000
[ 1646.772326][T31378] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1646.772337][T31378] R13: 00007f4447816038 R14: 00007f4447815fa0 R15: 00007f444793fa48
[ 1646.772369][T31378]  </TASK>
[ 1647.141841][T30159] usb 6-1: USB disconnect, device number 113
[ 1647.177050][T13548] usb 2-1: USB disconnect, device number 40
[ 1647.185983][T13548] usblp0: removed
[ 1647.661710][T13548] usb 6-1: new high-speed USB device number 114 using dummy_hcd
[ 1647.831822][T13548] usb 6-1: Using ep0 maxpacket: 32
[ 1647.865837][T31397] misc userio: No port type given on /dev/userio
[ 1647.883092][T13548] usb 6-1: config index 0 descriptor too short (expected 156, got 27)
[ 1647.899785][T13548] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1647.953589][T13548] usb 6-1: config 0 interface 0 has no altsetting 0
[ 1647.987921][T13548] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66
[ 1648.018686][T13548] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172
[ 1648.042200][T13548] usb 6-1: Product: syz
[ 1648.042546][T31400] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8051'.
[ 1648.076353][T13548] usb 6-1: Manufacturer: syz
[ 1648.084223][T13548] usb 6-1: SerialNumber: syz
[ 1648.130496][T13548] usb 6-1: config 0 descriptor??
[ 1648.157683][T13548] ldusb 6-1:0.0: Interrupt in endpoint not found
[ 1648.380928][T13548] usb 6-1: USB disconnect, device number 114
[ 1648.511369][T13535] usb 2-1: new high-speed USB device number 41 using dummy_hcd
[ 1648.672499][T13535] usb 2-1: Using ep0 maxpacket: 16
[ 1648.702611][T13535] usb 2-1: unable to get BOS descriptor or descriptor too short
[ 1648.735387][T13535] usb 2-1: config 3 has an invalid interface number: 74 but max is 0
[ 1648.751681][T13535] usb 2-1: config 3 has no interface number 0
[ 1648.768142][T13535] usb 2-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1648.793459][T13535] usb 2-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1648.825572][T13535] usb 2-1: config 3 interface 74 has no altsetting 0
[ 1648.836589][T31414] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8055'.
[ 1648.860005][T13535] usb 2-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1648.886859][T13535] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1648.912232][T13535] usb 2-1: Product: syz
[ 1648.921789][T13535] usb 2-1: Manufacturer: syz
[ 1648.931740][T13535] usb 2-1: SerialNumber: syz
[ 1648.952842][T31405] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[ 1649.017340][T31419] netlink: 'syz.6.8057': attribute type 1 has an invalid length.
[ 1649.041608][T31419] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8057'.
[ 1649.254835][T31428] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[ 1649.386096][T13535] ipaq 2-1:3.74: PocketPC PDA converter detected
[ 1649.393780][T13535] usb 2-1: active config #3 != 1 ??
[ 1649.407732][T13535] usb 2-1: USB disconnect, device number 41
[ 1650.510215][T31458] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8068'.
[ 1651.341025][T31472] loop5: detected capacity change from 0 to 4743
[ 1651.391105][T27708] buffer_io_error: 16 callbacks suppressed
[ 1651.391126][T27708] Buffer I/O error on dev loop5, logical block 592, async page read
[ 1651.409368][T31472] loop5: detected capacity change from 4743 to 7839
[ 1651.450000][T27708] Buffer I/O error on dev loop5, logical block 979, async page read
[ 1651.493696][T27708] Buffer I/O error on dev loop5, logical block 979, async page read
[ 1651.599033][T27708] Buffer I/O error on dev loop5, logical block 979, async page read
[ 1651.636109][T31479] netlink: 64 bytes leftover after parsing attributes in process `syz.5.8075'.
[ 1651.812101][T27708] Buffer I/O error on dev loop5, logical block 979, async page read
[ 1652.993897][T31513] netlink: 36 bytes leftover after parsing attributes in process `syz.7.8084'.
[ 1653.223702][T31515] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8086'.
[ 1653.471083][T31527] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 1653.525916][T31527] netlink: 64 bytes leftover after parsing attributes in process `syz.4.8091'.
[ 1653.690487][T30161] hid-generic 0000:0000:0000.0031: unknown main item tag 0x0
[ 1653.727212][T30161] hid-generic 0000:0000:0000.0031: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[ 1654.276043][T31548] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 1654.356717][T31548] netlink: 'syz.5.8095': attribute type 10 has an invalid length.
[ 1655.226534][T31570] syzkaller1: entered promiscuous mode
[ 1655.247004][T31570] syzkaller1: entered allmulticast mode
[ 1655.811813][T31577] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8102'.
[ 1655.999676][T31578] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 1656.220330][T30161] hid-generic 0000:0000:0000.0032: unknown main item tag 0x0
[ 1656.238632][T30161] hid-generic 0000:0000:0000.0032: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[ 1656.431593][T17984] usb 2-1: new high-speed USB device number 42 using dummy_hcd
[ 1656.556342][T31589] FAULT_INJECTION: forcing a failure.
[ 1656.556342][T31589] name failslab, interval 1, probability 0, space 0, times 0
[ 1656.611253][T17984] usb 2-1: Using ep0 maxpacket: 16
[ 1656.618107][T31589] CPU: 1 UID: 0 PID: 31589 Comm: syz.7.8107 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1656.618141][T31589] Tainted: [L]=SOFTLOCKUP
[ 1656.618148][T31589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1656.618159][T31589] Call Trace:
[ 1656.618165][T31589]  <TASK>
[ 1656.618170][T31589]  dump_stack_lvl+0xe8/0x150
[ 1656.618192][T31589]  should_fail_ex+0x40c/0x560
[ 1656.618211][T31589]  should_failslab+0xa8/0x100
[ 1656.618224][T31589]  kmem_cache_alloc_noprof+0xa6/0x5f0
[ 1656.618241][T31589]  ? alloc_empty_file+0x5b/0x1d0
[ 1656.618257][T31589]  ? alloc_empty_file+0x5b/0x1d0
[ 1656.618275][T31589]  alloc_empty_file+0x5b/0x1d0
[ 1656.618290][T31589]  alloc_file_pseudo+0x115/0x1e0
[ 1656.618308][T31589]  ? __pfx_alloc_file_pseudo+0x10/0x10
[ 1656.618324][T31589]  ? _raw_spin_unlock+0x28/0x50
[ 1656.618340][T31589]  ? alloc_fd+0x651/0x6c0
[ 1656.618358][T31589]  sock_alloc_file+0xb8/0x2e0
[ 1656.618373][T31589]  ? __sys_socket+0x12b/0x1b0
[ 1656.618388][T31589]  __sys_socket+0x13f/0x1b0
[ 1656.618404][T31589]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1656.618415][T31589]  __x64_sys_socket+0x7a/0x90
[ 1656.618431][T31589]  do_syscall_64+0x174/0x580
[ 1656.618441][T31589]  ? trace_irq_disable+0x3b/0x140
[ 1656.618452][T31589]  ? clear_bhb_loop+0x40/0x90
[ 1656.618464][T31589]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1656.618474][T31589] RIP: 0033:0x7f444759e6c7
[ 1656.618486][T31589] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1656.618495][T31589] RSP: 002b:00007f444837df98 EFLAGS: 00000286 ORIG_RAX: 0000000000000029
[ 1656.618506][T31589] RAX: ffffffffffffffda RBX: 00007f4447815fa0 RCX: 00007f444759e6c7
[ 1656.618514][T31589] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010
[ 1656.618520][T31589] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000
[ 1656.618526][T31589] R10: 00002000000003c0 R11: 0000000000000286 R12: 0000000000000001
[ 1656.618533][T31589] R13: 00007f4447816038 R14: 00007f4447815fa0 R15: 00007f444793fa48
[ 1656.618548][T31589]  </TASK>
[ 1656.940371][T17984] usb 2-1: too many configurations: 216, using maximum allowed: 8
[ 1656.956403][T17984] usb 2-1: unable to read config index 0 descriptor/start: -61
[ 1656.964372][T17984] usb 2-1: can't read configurations, error -61
[ 1657.101389][T17984] usb 2-1: new high-speed USB device number 43 using dummy_hcd
[ 1657.272369][T17984] usb 2-1: Using ep0 maxpacket: 16
[ 1657.285126][T17984] usb 2-1: too many configurations: 216, using maximum allowed: 8
[ 1657.296042][T17984] usb 2-1: unable to read config index 0 descriptor/start: -61
[ 1657.309508][T17984] usb 2-1: can't read configurations, error -61
[ 1657.319589][T17984] usb usb2-port1: attempt power cycle
[ 1657.671342][T17984] usb 2-1: new high-speed USB device number 44 using dummy_hcd
[ 1657.712413][T17984] usb 2-1: Using ep0 maxpacket: 16
[ 1657.728948][T17984] usb 2-1: too many configurations: 216, using maximum allowed: 8
[ 1657.766311][T17984] usb 2-1: unable to read config index 0 descriptor/start: -61
[ 1657.784660][T17984] usb 2-1: can't read configurations, error -61
[ 1657.951288][T17984] usb 2-1: new high-speed USB device number 45 using dummy_hcd
[ 1657.963703][T31603] bond3: Removing last arp target with arp_interval on
[ 1657.972273][T31603] bond3: entered promiscuous mode
[ 1657.977517][T31603] bond3: entered allmulticast mode
[ 1657.987315][T31603] 8021q: adding VLAN 0 to HW filter on device bond3
[ 1658.003741][T17984] usb 2-1: Using ep0 maxpacket: 16
[ 1658.019281][T17984] usb 2-1: too many configurations: 216, using maximum allowed: 8
[ 1658.075387][T17984] usb 2-1: unable to read config index 0 descriptor/start: -61
[ 1658.098837][T17984] usb 2-1: can't read configurations, error -61
[ 1658.132864][T17984] usb usb2-port1: unable to enumerate USB device
[ 1658.902516][T31620] FAULT_INJECTION: forcing a failure.
[ 1658.902516][T31620] name failslab, interval 1, probability 0, space 0, times 0
[ 1658.924004][T31620] CPU: 0 UID: 0 PID: 31620 Comm: syz.5.8118 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1658.924037][T31620] Tainted: [L]=SOFTLOCKUP
[ 1658.924045][T31620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1658.924057][T31620] Call Trace:
[ 1658.924064][T31620]  <TASK>
[ 1658.924073][T31620]  dump_stack_lvl+0xe8/0x150
[ 1658.924102][T31620]  should_fail_ex+0x40c/0x560
[ 1658.924143][T31620]  should_failslab+0xa8/0x100
[ 1658.924168][T31620]  __kmalloc_cache_noprof+0xa8/0x660
[ 1658.924200][T31620]  ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0
[ 1658.924229][T31620]  ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0
[ 1658.924263][T31620]  sctp_auth_asoc_copy_shkeys+0x14e/0x5a0
[ 1658.924290][T31620]  ? sctp_stream_interleave_init+0x55/0x90
[ 1658.924319][T31620]  sctp_association_new+0x15be/0x25d0
[ 1658.924350][T31620]  sctp_connect_new_asoc+0x2e4/0x6b0
[ 1658.924376][T31620]  ? __pfx_sctp_connect_new_asoc+0x10/0x10
[ 1658.924404][T31620]  ? sctp_inet6_send_verify+0x23a/0x300
[ 1658.924430][T31620]  ? sctp_endpoint_lookup_assoc+0xd1/0x260
[ 1658.924454][T31620]  __sctp_connect+0x5cb/0xdc0
[ 1658.924487][T31620]  ? __pfx___sctp_connect+0x10/0x10
[ 1658.924505][T31620]  ? sctp_setsockopt+0x21c/0x12c0
[ 1658.924524][T31620]  ? security_sctp_bind_connect+0x7e/0x2c0
[ 1658.924547][T31620]  ? __sctp_setsockopt_connectx+0xc7/0x190
[ 1658.924576][T31620]  sctp_setsockopt+0x480/0x12c0
[ 1658.924596][T31620]  ? sock_common_setsockopt+0x36/0xc0
[ 1658.924625][T31620]  ? __pfx_sock_common_setsockopt+0x10/0x10
[ 1658.924654][T31620]  do_sock_setsockopt+0x17c/0x1b0
[ 1658.924679][T31620]  __x64_sys_setsockopt+0x13d/0x1b0
[ 1658.924703][T31620]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1658.924724][T31620]  do_syscall_64+0x174/0x580
[ 1658.924742][T31620]  ? trace_irq_disable+0x3b/0x140
[ 1658.924762][T31620]  ? clear_bhb_loop+0x40/0x90
[ 1658.924785][T31620]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1658.924805][T31620] RIP: 0033:0x7f16a859ce59
[ 1658.924823][T31620] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1658.924840][T31620] RSP: 002b:00007f16a9384028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[ 1658.924861][T31620] RAX: ffffffffffffffda RBX: 00007f16a8815fa0 RCX: 00007f16a859ce59
[ 1658.924875][T31620] RDX: 000000000000006b RSI: 0000000000000084 RDI: 0000000000000003
[ 1658.924887][T31620] RBP: 00007f16a9384090 R08: 000000000000001c R09: 0000000000000000
[ 1658.924899][T31620] R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000001
[ 1658.924911][T31620] R13: 00007f16a8816038 R14: 00007f16a8815fa0 R15: 00007f16a893fa48
[ 1658.924942][T31620]  </TASK>
[ 1659.284907][T31623] netlink: 56 bytes leftover after parsing attributes in process `syz.1.8119'.
[ 1659.348113][T13535] hid-generic 0000:0000:0000.0033: unknown main item tag 0x0
[ 1659.362763][T13535] hid-generic 0000:0000:0000.0033: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[ 1659.459314][T31632] blktrace: Concurrent blktraces are not allowed on loop1
[ 1660.377261][T31652] syzkaller0: entered promiscuous mode
[ 1660.384080][T31652] syzkaller0: entered allmulticast mode
[ 1660.713315][T31663] netlink: 56 bytes leftover after parsing attributes in process `syz.5.8131'.
[ 1660.774810][T17984] hid-generic 0000:0000:0000.0034: unknown main item tag 0x0
[ 1660.791395][T13548] usb 5-1: new high-speed USB device number 42 using dummy_hcd
[ 1660.808852][T17984] hid-generic 0000:0000:0000.0034: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[ 1660.841654][T31667] netlink: 7 bytes leftover after parsing attributes in process `syz.5.8133'.
[ 1660.975206][T13548] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[ 1660.991117][T13548] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1661.000180][T13548] usb 5-1: Product: syz
[ 1661.005318][T13548] usb 5-1: Manufacturer: syz
[ 1661.010065][T13548] usb 5-1: SerialNumber: syz
[ 1661.131615][T13535] usb 6-1: new high-speed USB device number 115 using dummy_hcd
[ 1661.189268][T31674] FAULT_INJECTION: forcing a failure.
[ 1661.189268][T31674] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 1661.203355][T31674] CPU: 1 UID: 0 PID: 31674 Comm: syz.1.8135 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1661.203374][T31674] Tainted: [L]=SOFTLOCKUP
[ 1661.203380][T31674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1661.203387][T31674] Call Trace:
[ 1661.203394][T31674]  <TASK>
[ 1661.203399][T31674]  dump_stack_lvl+0xe8/0x150
[ 1661.203417][T31674]  should_fail_ex+0x40c/0x560
[ 1661.203435][T31674]  prepare_alloc_pages+0x230/0x650
[ 1661.203450][T31674]  __alloc_frozen_pages_noprof+0x12f/0x380
[ 1661.203463][T31674]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 1661.203477][T31674]  ? __pfx_policy_nodemask+0x10/0x10
[ 1661.203488][T31674]  ? __lock_acquire+0x683/0x2cf0
[ 1661.203501][T31674]  ? __lock_acquire+0x683/0x2cf0
[ 1661.203512][T31674]  alloc_pages_mpol+0x212/0x380
[ 1661.203527][T31674]  folio_alloc_mpol_noprof+0x39/0x160
[ 1661.203540][T31674]  vma_alloc_folio_noprof+0xe1/0x1e0
[ 1661.203552][T31674]  ? unwind_next_frame+0x8f/0x2550
[ 1661.203567][T31674]  ? __pfx_vma_alloc_folio_noprof+0x10/0x10
[ 1661.203579][T31674]  ? __pte_offset_map+0x29/0x240
[ 1661.203594][T31674]  ? __pte_offset_map+0x29/0x240
[ 1661.203610][T31674]  do_pte_missing+0x173a/0x34b0
[ 1661.203635][T31674]  handle_mm_fault+0x1b36/0x3080
[ 1661.203656][T31674]  ? handle_mm_fault+0xec/0x3080
[ 1661.203673][T31674]  ? __pfx_handle_mm_fault+0x10/0x10
[ 1661.203696][T31674]  ? lock_mm_and_find_vma+0xa7/0x340
[ 1661.203714][T31674]  do_user_addr_fault+0x744/0x1340
[ 1661.203733][T31674]  exc_page_fault+0x6a/0xc0
[ 1661.203751][T31674]  asm_exc_page_fault+0x26/0x30
[ 1661.203761][T31674] RIP: 0010:rep_movs_alternative+0x33/0xa0
[ 1661.203776][T31674] Code: 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb
[ 1661.203785][T31674] RSP: 0018:ffffc900054f7d28 EFLAGS: 00050216
[ 1661.203795][T31674] RAX: 000040000007d000 RBX: 0000000000000020 RCX: 0000000000000020
[ 1661.203802][T31674] RDX: 0000000000000000 RSI: ffffc900054f7e40 RDI: 0000200000003240
[ 1661.203809][T31674] RBP: ffffc900054f7ee0 R08: ffffc900054f7e5f R09: 1ffff92000a9efcb
[ 1661.203817][T31674] R10: dffffc0000000000 R11: fffff52000a9efcc R12: 0000200000003260
[ 1661.203824][T31674] R13: 00007ffffffff000 R14: ffffc900054f7e40 R15: 0000200000003240
[ 1661.203839][T31674]  _copy_to_user+0x8a/0xb0
[ 1661.203853][T31674]  __se_sys_msgctl+0x2b3/0x3c0
[ 1661.203931][T31674]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 1661.203942][T31674]  ? __pfx___se_sys_msgctl+0x10/0x10
[ 1661.203962][T31674]  ? ksys_write+0x242/0x270
[ 1661.203982][T31674]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1661.203992][T31674]  do_syscall_64+0x174/0x580
[ 1661.204002][T31674]  ? trace_irq_disable+0x3b/0x140
[ 1661.204012][T31674]  ? clear_bhb_loop+0x40/0x90
[ 1661.204024][T31674]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1661.204034][T31674] RIP: 0033:0x7fea02b9ce59
[ 1661.204044][T31674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1661.204053][T31674] RSP: 002b:00007fea03a04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000047
[ 1661.204064][T31674] RAX: ffffffffffffffda RBX: 00007fea02e15fa0 RCX: 00007fea02b9ce59
[ 1661.204071][T31674] RDX: 0000200000003240 RSI: 0000000000000003 RDI: 0000000000000000
[ 1661.204077][T31674] RBP: 00007fea03a04090 R08: 0000000000000000 R09: 0000000000000000
[ 1661.204086][T31674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1661.204096][T31674] R13: 00007fea02e16038 R14: 00007fea02e15fa0 R15: 00007fea02f3fa48
[ 1661.204123][T31674]  </TASK>
[ 1661.262692][T13535] usb 6-1: device descriptor read/64, error -71
[ 1661.615271][T13548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE
[ 1661.638473][T13548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE
[ 1661.833896][T13535] usb 6-1: new high-speed USB device number 116 using dummy_hcd
[ 1661.971371][T13535] usb 6-1: device descriptor read/64, error -71
[ 1662.081664][T13535] usb usb6-port1: attempt power cycle
[ 1662.292148][T31694] syzkaller0: entered promiscuous mode
[ 1662.313244][T31694] syzkaller0: entered allmulticast mode
[ 1662.447419][T13535] usb 6-1: new high-speed USB device number 117 using dummy_hcd
[ 1662.492014][T13535] usb 6-1: device descriptor read/8, error -71
[ 1662.692723][T13548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO
[ 1662.731369][T13535] usb 6-1: new high-speed USB device number 118 using dummy_hcd
[ 1662.748537][T13548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED....
[ 1662.768917][T13548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED
[ 1662.772063][T13535] usb 6-1: device descriptor read/8, error -71
[ 1662.810990][T13548] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71
[ 1662.843867][T13548] usb 5-1: USB disconnect, device number 42
[ 1662.916093][T13535] usb usb6-port1: unable to enumerate USB device
[ 1663.590680][T31715] FAULT_INJECTION: forcing a failure.
[ 1663.590680][T31715] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 1663.651904][T31715] CPU: 0 UID: 0 PID: 31715 Comm: syz.7.8145 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1663.651936][T31715] Tainted: [L]=SOFTLOCKUP
[ 1663.651943][T31715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1663.651953][T31715] Call Trace:
[ 1663.651960][T31715]  <TASK>
[ 1663.651969][T31715]  dump_stack_lvl+0xe8/0x150
[ 1663.651995][T31715]  should_fail_ex+0x40c/0x560
[ 1663.652026][T31715]  prepare_alloc_pages+0x230/0x650
[ 1663.652054][T31715]  __alloc_frozen_pages_noprof+0x12f/0x380
[ 1663.652078][T31715]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 1663.652103][T31715]  ? __pfx_policy_nodemask+0x10/0x10
[ 1663.652124][T31715]  ? __folio_batch_add_and_move+0x11a/0xc50
[ 1663.652151][T31715]  ? lock_acquire+0x106/0x350
[ 1663.652178][T31715]  alloc_pages_mpol+0x212/0x380
[ 1663.652204][T31715]  folio_alloc_mpol_noprof+0x39/0x160
[ 1663.652228][T31715]  vma_alloc_folio_noprof+0xe1/0x1e0
[ 1663.652252][T31715]  ? __pfx_vma_alloc_folio_noprof+0x10/0x10
[ 1663.652285][T31715]  do_wp_page+0x1163/0x4c70
[ 1663.652327][T31715]  ? __pfx_do_wp_page+0x10/0x10
[ 1663.652348][T31715]  ? do_raw_spin_lock+0x12b/0x2f0
[ 1663.652376][T31715]  ? __pfx_do_raw_spin_lock+0x10/0x10
[ 1663.652411][T31715]  handle_mm_fault+0x1490/0x3080
[ 1663.652453][T31715]  ? handle_mm_fault+0xec/0x3080
[ 1663.652486][T31715]  ? __pfx_handle_mm_fault+0x10/0x10
[ 1663.652522][T31715]  ? follow_page_pte+0xbd0/0xe70
[ 1663.652556][T31715]  ? __pfx_follow_page_pte+0x10/0x10
[ 1663.652600][T31715]  __get_user_pages+0x1678/0x2720
[ 1663.652653][T31715]  __gup_longterm_locked+0xd52/0x15c0
[ 1663.652682][T31715]  ? lock_acquire+0x106/0x350
[ 1663.652707][T31715]  ? sanity_check_pinned_pages+0x810/0x8d0
[ 1663.652737][T31715]  gup_fast_fallback+0x1d8c/0x20e0
[ 1663.652790][T31715]  ? __pfx_gup_fast_fallback+0x10/0x10
[ 1663.652811][T31715]  ? __kmalloc_noprof+0x1ad/0x720
[ 1663.652838][T31715]  ? kasan_save_track+0x4f/0x80
[ 1663.652860][T31715]  ? pin_user_pages_fast+0x4d/0xb0
[ 1663.652886][T31715]  iov_iter_extract_pages+0x369/0x5f0
[ 1663.652917][T31715]  extract_iter_to_sg+0xee0/0x25f0
[ 1663.652961][T31715]  ? __pfx_extract_iter_to_sg+0x10/0x10
[ 1663.652994][T31715]  ? rcu_is_watching+0x15/0xb0
[ 1663.653018][T31715]  ? trace_kmalloc+0x2a/0xf0
[ 1663.653049][T31715]  ? __asan_memset+0x22/0x50
[ 1663.653077][T31715]  af_alg_get_rsgl+0x493/0x8d0
[ 1663.653117][T31715]  ? af_alg_alloc_areq+0xac/0x200
[ 1663.653146][T31715]  skcipher_recvmsg+0x39d/0xe10
[ 1663.653182][T31715]  ? __pfx_skcipher_recvmsg+0x10/0x10
[ 1663.653199][T31715]  ? __lock_acquire+0x683/0x2cf0
[ 1663.653218][T31715]  ? aa_sock_msg_perm+0xf1/0x1b0
[ 1663.653243][T31715]  ? bpf_lsm_socket_recvmsg+0x9/0x20
[ 1663.653267][T31715]  ? security_socket_recvmsg+0x7e/0x2c0
[ 1663.653295][T31715]  ? __pfx_skcipher_recvmsg+0x10/0x10
[ 1663.653314][T31715]  sock_recvmsg+0x196/0x1e0
[ 1663.653344][T31715]  ____sys_recvmsg+0x1e6/0x4a0
[ 1663.653374][T31715]  ? __pfx_____sys_recvmsg+0x10/0x10
[ 1663.653412][T31715]  ? import_iovec+0x73/0xa0
[ 1663.653436][T31715]  ___sys_recvmsg+0x213/0x5a0
[ 1663.653464][T31715]  ? __pfx____sys_recvmsg+0x10/0x10
[ 1663.653492][T31715]  ? __fget_files+0x2a/0x420
[ 1663.653529][T31715]  ? __fget_files+0x3a2/0x420
[ 1663.653558][T31715]  __x64_sys_recvmsg+0x1ae/0x290
[ 1663.653591][T31715]  ? __pfx___x64_sys_recvmsg+0x10/0x10
[ 1663.653632][T31715]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1663.653654][T31715]  do_syscall_64+0x174/0x580
[ 1663.653673][T31715]  ? trace_irq_disable+0x3b/0x140
[ 1663.653692][T31715]  ? clear_bhb_loop+0x40/0x90
[ 1663.653716][T31715]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1663.653735][T31715] RIP: 0033:0x7f444759ce59
[ 1663.653753][T31715] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1663.653769][T31715] RSP: 002b:00007f444837f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
[ 1663.653790][T31715] RAX: ffffffffffffffda RBX: 00007f4447815fa0 RCX: 00007f444759ce59
[ 1663.653804][T31715] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004
[ 1663.653816][T31715] RBP: 00007f444837f090 R08: 0000000000000000 R09: 0000000000000000
[ 1663.653828][T31715] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1663.653840][T31715] R13: 00007f4447816038 R14: 00007f4447815fa0 R15: 00007f444793fa48
[ 1663.653871][T31715]  </TASK>
[ 1664.072940][T13548] usb 2-1: new high-speed USB device number 46 using dummy_hcd
[ 1664.180192][T31719] netlink: 'syz.4.8146': attribute type 1 has an invalid length.
[ 1664.270441][T31719] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8146'.
[ 1664.297430][T31719] 8021q: adding VLAN 0 to HW filter on device bond8
[ 1664.330000][T31719] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8146'.
[ 1664.432341][T13548] usb 2-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75
[ 1664.441519][T13548] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1664.490375][T13548] usb 2-1: config 0 descriptor??
[ 1664.831361][T30159] usb 6-1: new high-speed USB device number 119 using dummy_hcd
[ 1664.971500][T13535] usb 5-1: new high-speed USB device number 43 using dummy_hcd
[ 1664.983524][T30159] usb 6-1: Using ep0 maxpacket: 16
[ 1664.995936][T30159] usb 6-1: unable to get BOS descriptor or descriptor too short
[ 1665.022727][T30159] usb 6-1: config 3 has an invalid interface number: 74 but max is 0
[ 1665.040490][T30159] usb 6-1: config 3 has no interface number 0
[ 1665.068733][T30159] usb 6-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1665.099889][T30159] usb 6-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1665.118452][T30159] usb 6-1: config 3 interface 74 has no altsetting 0
[ 1665.140218][T13535] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[ 1665.154086][T13535] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1665.172834][T30159] usb 6-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1665.187579][T30159] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1665.199336][T13535] usb 5-1: Product: syz
[ 1665.204398][T13535] usb 5-1: Manufacturer: syz
[ 1665.214297][T30159] usb 6-1: Product: syz
[ 1665.219534][T13535] usb 5-1: SerialNumber: syz
[ 1665.227439][T30159] usb 6-1: Manufacturer: syz
[ 1665.239592][T30159] usb 6-1: SerialNumber: syz
[ 1665.264547][T31736] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22
[ 1665.581051][T31736] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[ 1665.669886][T13535] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE
[ 1665.704834][T13535] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE
[ 1665.803685][T30159] ipaq 6-1:3.74: PocketPC PDA converter detected
[ 1665.814538][T30159] usb 6-1: active config #3 != 1 ??
[ 1665.836354][T30159] usb 6-1: USB disconnect, device number 119
[ 1666.133717][T30159] usb 2-1: USB disconnect, device number 46
[ 1666.454354][T31765] FAULT_FLAG_ALLOW_RETRY missing 801
[ 1666.476137][T31765] CPU: 1 UID: 0 PID: 31765 Comm: syz.5.8160 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1666.476170][T31765] Tainted: [L]=SOFTLOCKUP
[ 1666.476177][T31765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1666.476188][T31765] Call Trace:
[ 1666.476197][T31765]  <TASK>
[ 1666.476205][T31765]  dump_stack_lvl+0xe8/0x150
[ 1666.476245][T31765]  handle_userfault+0x15ff/0x18c0
[ 1666.476286][T31765]  ? __pfx_handle_userfault+0x10/0x10
[ 1666.476340][T31765]  handle_mm_fault+0x1b36/0x3080
[ 1666.476380][T31765]  ? handle_mm_fault+0xec/0x3080
[ 1666.476413][T31765]  ? __pfx_handle_mm_fault+0x10/0x10
[ 1666.476439][T31765]  ? follow_page_pte+0x6ce/0xe70
[ 1666.476473][T31765]  ? __pfx_follow_page_pte+0x10/0x10
[ 1666.476509][T31765]  __get_user_pages+0x1678/0x2720
[ 1666.476560][T31765]  populate_vma_page_range+0x2be/0x3c0
[ 1666.476586][T31765]  ? __pfx_populate_vma_page_range+0x10/0x10
[ 1666.476604][T31765]  ? irqentry_exit+0x218/0x8f0
[ 1666.476622][T31765]  ? vma_wants_writenotify+0xb2/0x340
[ 1666.476648][T31765]  ? vma_set_page_prot+0xc3/0x100
[ 1666.476672][T31765]  mprotect_fixup+0x9a3/0xb10
[ 1666.476696][T31765]  ? __pfx_mprotect_fixup+0x10/0x10
[ 1666.476713][T31765]  ? mas_next_slot+0xc91/0xd70
[ 1666.476746][T31765]  ? apparmor_file_mprotect+0x1d0/0x400
[ 1666.476765][T31765]  ? security_file_mprotect+0x1a/0x290
[ 1666.476804][T31765]  do_mprotect_pkey+0x9d3/0xcd0
[ 1666.476837][T31765]  ? __pfx_do_mprotect_pkey+0x10/0x10
[ 1666.476880][T31765]  ? rcu_is_watching+0x15/0xb0
[ 1666.476909][T31765]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1666.476928][T31765]  __x64_sys_mprotect+0x80/0x90
[ 1666.476947][T31765]  do_syscall_64+0x174/0x580
[ 1666.476964][T31765]  ? trace_irq_disable+0x3b/0x140
[ 1666.476981][T31765]  ? clear_bhb_loop+0x40/0x90
[ 1666.477002][T31765]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1666.477020][T31765] RIP: 0033:0x7f16a859ce59
[ 1666.477038][T31765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1666.477053][T31765] RSP: 002b:00007f16a67f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a
[ 1666.477073][T31765] RAX: ffffffffffffffda RBX: 00007f16a8816090 RCX: 00007f16a859ce59
[ 1666.477087][T31765] RDX: 000000000000000f RSI: 0000000000004000 RDI: 0000200000ffc000
[ 1666.477098][T31765] RBP: 00007f16a8632e6f R08: 0000000000000000 R09: 0000000000000000
[ 1666.477108][T31765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 1666.477119][T31765] R13: 00007f16a8816128 R14: 00007f16a8816090 R15: 00007f16a893fa48
[ 1666.477145][T31765]  </TASK>
[ 1666.880338][T13535] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO
[ 1666.961609][T31772] netlink: 40 bytes leftover after parsing attributes in process `syz.5.8162'.
[ 1666.975341][T13535] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED....
[ 1667.019400][T13535] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED
[ 1667.048718][T13535] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71
[ 1667.096235][T31775] netlink: 56 bytes leftover after parsing attributes in process `syz.5.8163'.
[ 1667.106197][T13535] usb 5-1: USB disconnect, device number 43
[ 1667.382458][T31783] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[ 1667.581446][T30161] usb 2-1: new high-speed USB device number 47 using dummy_hcd
[ 1667.736456][T30161] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[ 1667.764925][T30161] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1667.787481][T30161] usb 2-1: Product: syz
[ 1667.799052][T30161] usb 2-1: Manufacturer: syz
[ 1667.814842][T30161] usb 2-1: SerialNumber: syz
[ 1668.092526][T13720] usb 6-1: new full-speed USB device number 121 using dummy_hcd
[ 1668.258599][T13720] usb 6-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 512, setting to 64
[ 1668.271757][T30161] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE
[ 1668.271765][T13720] usb 6-1: config 1 interface 0 has no altsetting 0
[ 1668.275131][T13720] usb 6-1: string descriptor 0 read error: -22
[ 1668.291321][T30161] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE
[ 1668.298235][T13720] usb 6-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.40
[ 1668.317977][T13720] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1668.333989][T31796] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22
[ 1668.863154][ T1315] ieee802154 phy0 wpan0: encryption failed: -22
[ 1668.869868][ T1315] ieee802154 phy1 wpan1: encryption failed: -22
[ 1669.233807][T30161] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO
[ 1669.256077][T30161] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED....
[ 1669.266895][T30161] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED
[ 1669.280325][T30161] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71
[ 1669.298154][T30161] usb 2-1: USB disconnect, device number 47
[ 1670.958818][T13720] usbhid 6-1:1.0: can't add hid device: -71
[ 1671.025585][T13720] usbhid 6-1:1.0: probe with driver usbhid failed with error -71
[ 1671.053429][T31816] netlink: 56 bytes leftover after parsing attributes in process `syz.5.8174'.
[ 1671.079064][T13720] usb 6-1: USB disconnect, device number 121
[ 1671.303698][T31818] blktrace: Concurrent blktraces are not allowed on loop1
[ 1671.801290][T13720] usb 5-1: new high-speed USB device number 44 using dummy_hcd
[ 1671.985540][T13720] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[ 1672.026255][T13720] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1672.060951][T13720] usb 5-1: Product: syz
[ 1672.076651][T13720] usb 5-1: Manufacturer: syz
[ 1672.089547][T13720] usb 5-1: SerialNumber: syz
[ 1672.551637][T30161] usb 2-1: new high-speed USB device number 48 using dummy_hcd
[ 1672.661734][T13548] usb 6-1: new high-speed USB device number 122 using dummy_hcd
[ 1672.706416][T30161] usb 2-1: Using ep0 maxpacket: 32
[ 1672.713714][T30161] usb 2-1: unable to get BOS descriptor or descriptor too short
[ 1672.722510][T30161] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1672.732822][T30161] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[ 1672.743707][T13720] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE
[ 1672.744928][T30161] usb 2-1: string descriptor 0 read error: -22
[ 1672.757812][T13720] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED....
[ 1672.763548][T30161] usb 2-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40
[ 1672.780664][T30161] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1672.789540][T13720] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED
[ 1672.801970][T13720] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -32
[ 1672.825498][T13548] usb 6-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36
[ 1672.834887][T13548] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1672.843394][T13548] usb 6-1: Product: syz
[ 1672.847597][T13548] usb 6-1: Manufacturer: syz
[ 1672.852334][T13548] usb 6-1: SerialNumber: syz
[ 1672.859092][T13548] usb 6-1: config 0 descriptor??
[ 1672.867224][T13548] ch341 6-1:0.0: ch341-uart converter detected
[ 1673.007195][T30161] usb 2-1: cannot find UAC_HEADER
[ 1673.062807][T30161] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22
[ 1673.075866][T13548] usb 6-1: failed to receive control message: -121
[ 1673.083838][T13548] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -121
[ 1673.256274][T31838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1673.265611][T31838] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1673.278025][T31838] random: crng reseeded on system resumption
[ 1673.299235][T31838] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8182'.
[ 1673.315526][T13548] usb 2-1: USB disconnect, device number 48
[ 1674.545878][T13720] usb 5-1: USB disconnect, device number 44
[ 1674.644599][T31852] netlink: 20 bytes leftover after parsing attributes in process `syz.6.8186'.
[ 1674.655221][T31852] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8186'.
[ 1674.666024][T31852] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8186'.
[ 1674.691710][T31846] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[ 1674.697795][T31846] Bluetooth: hci5: Error when powering off device on rfkill (-4)
[ 1674.723515][T31846] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[ 1674.729481][T31846] Bluetooth: hci0: Error when powering off device on rfkill (-4)
[ 1674.765664][T31846] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[ 1674.774671][T31846] Bluetooth: hci2: Error when powering off device on rfkill (-4)
[ 1674.814495][T31846] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[ 1674.826834][T31846] Bluetooth: hci1: Error when powering off device on rfkill (-4)
[ 1674.845186][T31861] blktrace: Concurrent blktraces are not allowed on loop1
[ 1674.894407][T31846] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[ 1674.907983][T31846] Bluetooth: hci3: Error when powering off device on rfkill (-4)
[ 1674.931361][T13720] usb 5-1: new high-speed USB device number 45 using dummy_hcd
[ 1675.073184][T31846] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[ 1675.082920][T31846] Bluetooth: hci6: Error when powering off device on rfkill (-4)
[ 1675.091838][T13720] usb 5-1: Using ep0 maxpacket: 16
[ 1675.107885][T13720] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 1675.127424][T13720] usb 5-1: config 3 has an invalid interface number: 74 but max is 0
[ 1675.152203][T13720] usb 5-1: config 3 has no interface number 0
[ 1675.164739][T13720] usb 5-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1675.191334][T13720] usb 5-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1675.201145][T13720] usb 5-1: config 3 interface 74 has no altsetting 0
[ 1675.215876][T13720] usb 5-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1675.228754][T13720] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1675.243436][T13720] usb 5-1: Product: syz
[ 1675.249709][T13720] usb 5-1: Manufacturer: syz
[ 1675.260700][T13720] usb 5-1: SerialNumber: syz
[ 1675.280284][T31850] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[ 1675.710426][T31878] binder: 31874:31878 ioctl c0306201 0 returned -14
[ 1675.765850][T31850] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check.
[ 1675.846125][T13720] ipaq 5-1:3.74: PocketPC PDA converter detected
[ 1675.875945][T13720] usb 5-1: active config #3 != 1 ??
[ 1675.923750][T13720] usb 5-1: USB disconnect, device number 45
[ 1676.006085][T13548] usb 6-1: USB disconnect, device number 122
[ 1676.032631][T13548] ch341 6-1:0.0: device disconnected
[ 1676.120097][T31882] netlink: 36 bytes leftover after parsing attributes in process `syz.5.8192'.
[ 1676.811372][T13535] usb 5-1: new high-speed USB device number 46 using dummy_hcd
[ 1676.821930][T31895] netlink: 20 bytes leftover after parsing attributes in process `syz.7.8197'.
[ 1676.842618][T31895] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8197'.
[ 1676.879879][T31895] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8197'.
[ 1676.988216][T13535] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08
[ 1677.032976][T13535] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1677.077527][T13535] usb 5-1: config 0 descriptor??
[ 1677.108239][T13535] gspca_main: cpia1-2.14.0 probing 0813:0001
[ 1677.525522][T31892] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1677.554367][T13535] gspca_cpia1: usb_control_msg 03, error -71
[ 1677.577911][T13535] gspca_cpia1: usb_control_msg 01, error -71
[ 1677.598346][T13535] cpia1 5-1:0.0: only firmware version 1 is supported (got: 0)
[ 1677.612419][T17984] usb 6-1: new high-speed USB device number 123 using dummy_hcd
[ 1677.640687][T13535] usb 5-1: USB disconnect, device number 46
[ 1677.796838][T31920] blktrace: Concurrent blktraces are not allowed on loop1
[ 1677.813552][T17984] usb 6-1: Using ep0 maxpacket: 8
[ 1677.825364][T17984] usb 6-1: config 0 has an invalid interface number: 55 but max is 0
[ 1677.839286][T17984] usb 6-1: config 0 has no interface number 0
[ 1677.850496][T17984] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[ 1677.868608][T17984] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B
[ 1677.892674][T17984] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[ 1677.920717][T17984] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[ 1677.947368][T17984] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[ 1677.959640][T17984] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1677.971081][T13720] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1677.983828][T13720] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1677.993565][T13720] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1677.994858][T17984] usb 6-1: config 0 descriptor??
[ 1678.002629][T13720] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1678.024792][T17984] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0
[ 1678.029390][T13720] rtc rtc0: __rtc_set_alarm: err=-22
[ 1678.167835][T31923] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8204'.
[ 1678.321776][T13720] usb 6-1: USB disconnect, device number 123
[ 1678.321841][    C0] ldusb 6-1:0.55: usb_submit_urb failed (-19)
[ 1678.373177][T13720] ldusb 6-1:0.55: LD USB Device #0 now disconnected
[ 1678.379991][T31903] ldusb: No device or device unplugged -19
[ 1678.571394][T13535] usb 5-1: new high-speed USB device number 47 using dummy_hcd
[ 1678.711518][T13535] usb 5-1: device descriptor read/64, error -71
[ 1678.801381][T13720] usb 6-1: new high-speed USB device number 124 using dummy_hcd
[ 1678.961363][T13535] usb 5-1: new high-speed USB device number 48 using dummy_hcd
[ 1678.969068][T13720] usb 6-1: Using ep0 maxpacket: 16
[ 1678.977006][T13720] usb 6-1: unable to get BOS descriptor or descriptor too short
[ 1678.998339][T13720] usb 6-1: config 3 has an invalid interface number: 74 but max is 0
[ 1679.016151][T13720] usb 6-1: config 3 has no interface number 0
[ 1679.028779][T13720] usb 6-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1679.054477][T13720] usb 6-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1679.070958][T13720] usb 6-1: config 3 interface 74 has no altsetting 0
[ 1679.089243][T13720] usb 6-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1679.111295][T13535] usb 5-1: device descriptor read/64, error -71
[ 1679.120726][T13720] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1679.141870][T13720] usb 6-1: Product: syz
[ 1679.149900][T13720] usb 6-1: Manufacturer: syz
[ 1679.159671][T13720] usb 6-1: SerialNumber: syz
[ 1679.177453][T31929] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22
[ 1679.231457][T13535] usb usb5-port1: attempt power cycle
[ 1679.544178][T31929] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[ 1679.571317][T13535] usb 5-1: new high-speed USB device number 49 using dummy_hcd
[ 1679.612275][T13535] usb 5-1: device descriptor read/8, error -71
[ 1679.851412][T13535] usb 5-1: new high-speed USB device number 50 using dummy_hcd
[ 1679.872954][T13535] usb 5-1: device descriptor read/8, error -71
[ 1679.982282][T13535] usb usb5-port1: unable to enumerate USB device
[ 1680.119689][T13720] ipaq 6-1:3.74: PocketPC PDA converter detected
[ 1680.137699][T13720] usb 6-1: active config #3 != 1 ??
[ 1680.168117][T13720] usb 6-1: USB disconnect, device number 124
[ 1681.521305][T17984] usb 2-1: new high-speed USB device number 49 using dummy_hcd
[ 1681.711422][T17984] usb 2-1: Using ep0 maxpacket: 8
[ 1681.724667][T17984] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9
[ 1681.745633][T17984] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[ 1681.767472][T17984] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[ 1681.788946][T17984] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024
[ 1681.810761][T17984] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024
[ 1681.839846][T17984] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58
[ 1681.870418][T17984] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1681.905984][T17984] usb 2-1: config 0 descriptor??
[ 1681.932170][T30161] usb 6-1: new high-speed USB device number 125 using dummy_hcd
[ 1681.944759][T31953] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[ 1682.159979][T30161] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08
[ 1682.205788][T30161] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1682.286355][T30161] usb 6-1: config 0 descriptor??
[ 1682.345346][T30161] gspca_main: cpia1-2.14.0 probing 0813:0001
[ 1682.406198][ T5630] Bluetooth: hci4: Opcode 0x0c03 failed: -71
[ 1682.423477][T13548] usb 5-1: new high-speed USB device number 51 using dummy_hcd
[ 1682.492964][T17984] usb 2-1: USB disconnect, device number 49
[ 1682.646480][T13548] usb 5-1: Using ep0 maxpacket: 8
[ 1682.670428][T13548] usb 5-1: config 0 has an invalid interface number: 55 but max is 0
[ 1682.686287][T13548] usb 5-1: config 0 has no interface number 0
[ 1682.693882][T13548] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[ 1682.736041][T13548] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B
[ 1682.752451][T13548] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[ 1682.768543][T13548] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[ 1682.782304][T30161] gspca_cpia1: usb_control_msg 03, error -71
[ 1682.791683][T13548] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[ 1682.800952][T30161] gspca_cpia1: usb_control_msg 01, error -71
[ 1682.807488][T30161] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0)
[ 1682.824244][T30161] usb 6-1: USB disconnect, device number 125
[ 1682.843398][T13548] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1682.873012][T13548] usb 5-1: config 0 descriptor??
[ 1682.900174][T13548] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0
[ 1683.096963][T13548] usb 5-1: USB disconnect, device number 51
[ 1683.124500][T13548] ldusb 5-1:0.55: LD USB Device #0 now disconnected
[ 1685.059078][T32006] input: syz0 as /devices/virtual/input/input62
[ 1685.571055][T32020] binder: 32015:32020 ioctl c0306201 200000000000 returned -14
[ 1686.209863][T32029] netlink: 'syz.1.8237': attribute type 1 has an invalid length.
[ 1686.246577][T32029] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8237'.
[ 1686.257371][T32029] 8021q: adding VLAN 0 to HW filter on device bond10
[ 1686.559561][T32040] blktrace: Concurrent blktraces are not allowed on loop1
[ 1687.680330][T32061] fuse: Bad value for 'fd'
[ 1687.741708][T30161] usb 2-1: new high-speed USB device number 50 using dummy_hcd
[ 1687.799265][T32066] netlink: 'syz.5.8248': attribute type 29 has an invalid length.
[ 1687.822289][T32066] syzkaller0: entered promiscuous mode
[ 1687.827818][T32066] syzkaller0: entered allmulticast mode
[ 1687.861499][T13535] usb 5-1: new high-speed USB device number 52 using dummy_hcd
[ 1687.921304][T30161] usb 2-1: Using ep0 maxpacket: 32
[ 1687.931754][T30161] usb 2-1: config index 0 descriptor too short (expected 156, got 27)
[ 1687.950673][T30161] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30
[ 1687.964223][T30161] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7
[ 1687.975912][T30161] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid wMaxPacketSize 0
[ 1687.986574][T30161] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144
[ 1688.000324][T30161] usb 2-1: config 0 interface 0 has no altsetting 0
[ 1688.009911][T30161] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66
[ 1688.011405][T13535] usb 5-1: Using ep0 maxpacket: 32
[ 1688.029233][T30161] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172
[ 1688.030842][T13535] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[ 1688.050380][T30161] usb 2-1: Product: syz
[ 1688.052424][T13535] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[ 1688.054795][T30161] usb 2-1: Manufacturer: syz
[ 1688.064901][T13535] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[ 1688.068609][T30161] usb 2-1: SerialNumber: syz
[ 1688.082192][T13535] usb 5-1: Product: syz
[ 1688.086758][T13535] usb 5-1: Manufacturer: syz
[ 1688.093229][T13535] usb 5-1: SerialNumber: syz
[ 1688.093737][T30161] usb 2-1: config 0 descriptor??
[ 1688.100450][T13535] usb 5-1: config 0 descriptor??
[ 1688.114357][T30161] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead)
[ 1688.115938][T32063] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22
[ 1688.132502][T30161] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0
[ 1688.133587][T13535] hub 5-1:0.0: bad descriptor, ignoring hub
[ 1688.148225][T13535] hub 5-1:0.0: probe with driver hub failed with error -5
[ 1688.342832][T32058] ldusb 2-1:0.0: Couldn't submit interrupt_in_urb -90
[ 1688.367839][T30161] usb 2-1: USB disconnect, device number 50
[ 1688.383295][T32059] ldusb 2-1:0.0: Couldn't submit interrupt_in_urb -19
[ 1688.407900][T30161] ldusb 2-1:0.0: LD USB Device #0 now disconnected
[ 1688.453364][T32071] FAULT_INJECTION: forcing a failure.
[ 1688.453364][T32071] name failslab, interval 1, probability 0, space 0, times 0
[ 1688.468777][T32071] CPU: 1 UID: 0 PID: 32071 Comm: syz.6.8250 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1688.468809][T32071] Tainted: [L]=SOFTLOCKUP
[ 1688.468816][T32071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1688.468827][T32071] Call Trace:
[ 1688.468835][T32071]  <TASK>
[ 1688.468843][T32071]  dump_stack_lvl+0xe8/0x150
[ 1688.468872][T32071]  should_fail_ex+0x40c/0x560
[ 1688.468905][T32071]  should_failslab+0xa8/0x100
[ 1688.468929][T32071]  __kmalloc_cache_noprof+0xa8/0x660
[ 1688.468959][T32071]  ? nft_pernet+0x23/0x240
[ 1688.468979][T32071]  ? nf_tables_newtable+0x43e/0x1950
[ 1688.469006][T32071]  ? nf_tables_newtable+0x43e/0x1950
[ 1688.469041][T32071]  nf_tables_newtable+0x43e/0x1950
[ 1688.469091][T32071]  nfnetlink_rcv+0x1288/0x28c0
[ 1688.469146][T32071]  ? __pfx_nfnetlink_rcv+0x10/0x10
[ 1688.469179][T32071]  ? ref_tracker_free+0x689/0x830
[ 1688.469229][T32071]  ? skb_clone+0x246/0x3a0
[ 1688.469253][T32071]  ? __netlink_deliver_tap+0x811/0x860
[ 1688.469283][T32071]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1688.469305][T32071]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1688.469333][T32071]  netlink_unicast+0x7bb/0x940
[ 1688.469371][T32071]  netlink_sendmsg+0x813/0xb40
[ 1688.469404][T32071]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1688.469431][T32071]  ? aa_sock_msg_perm+0xf1/0x1b0
[ 1688.469461][T32071]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1688.469483][T32071]  sock_sendmsg_nosec+0x13a/0x180
[ 1688.469512][T32071]  ____sys_sendmsg+0x54e/0x850
[ 1688.469540][T32071]  ? __pfx_____sys_sendmsg+0x10/0x10
[ 1688.469571][T32071]  ? import_iovec+0x73/0xa0
[ 1688.469596][T32071]  ___sys_sendmsg+0x2a5/0x360
[ 1688.469617][T32071]  ? __lock_acquire+0x683/0x2cf0
[ 1688.469642][T32071]  ? __pfx____sys_sendmsg+0x10/0x10
[ 1688.469699][T32071]  ? __fget_files+0x2a/0x420
[ 1688.469718][T32071]  ? __fget_files+0x3a2/0x420
[ 1688.469747][T32071]  __x64_sys_sendmsg+0x1b1/0x290
[ 1688.469773][T32071]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 1688.469814][T32071]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1688.469835][T32071]  do_syscall_64+0x174/0x580
[ 1688.469857][T32071]  ? clear_bhb_loop+0x40/0x90
[ 1688.469881][T32071]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1688.469901][T32071] RIP: 0033:0x7f337e59ce59
[ 1688.469925][T32071] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1688.469943][T32071] RSP: 002b:00007f337c7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1688.469963][T32071] RAX: ffffffffffffffda RBX: 00007f337e815fa0 RCX: 00007f337e59ce59
[ 1688.469978][T32071] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003
[ 1688.469991][T32071] RBP: 00007f337c7f6090 R08: 0000000000000000 R09: 0000000000000000
[ 1688.470003][T32071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1688.470016][T32071] R13: 00007f337e816038 R14: 00007f337e815fa0 R15: 00007f337e93fa48
[ 1688.470047][T32071]  </TASK>
[ 1688.761410][T13535] usb 5-1: USB disconnect, device number 52
[ 1689.021815][T13535] usb 5-1: new high-speed USB device number 53 using dummy_hcd
[ 1689.049071][   T29] audit: type=1326 audit(1782516883.510:15355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.090893][   T29] audit: type=1326 audit(1782516883.510:15356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.130204][   T29] audit: type=1326 audit(1782516883.540:15357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=288 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.157875][   T29] audit: type=1326 audit(1782516883.540:15358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.201342][T13535] usb 5-1: Using ep0 maxpacket: 32
[ 1689.208472][T13535] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[ 1689.220167][   T29] audit: type=1326 audit(1782516883.540:15359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.250655][T13535] usb 5-1: string descriptor 0 read error: -22
[ 1689.257857][T13535] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[ 1689.267523][   T29] audit: type=1326 audit(1782516883.540:15360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.292316][T13535] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[ 1689.305502][T13535] usb 5-1: config 0 descriptor??
[ 1689.311837][   T29] audit: type=1326 audit(1782516883.540:15361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.337239][T32062] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[ 1689.349421][T13535] hub 5-1:0.0: bad descriptor, ignoring hub
[ 1689.359135][T13535] hub 5-1:0.0: probe with driver hub failed with error -5
[ 1689.366854][   T29] audit: type=1326 audit(1782516883.540:15362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.396078][   T29] audit: type=1326 audit(1782516883.540:15363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.423816][   T29] audit: type=1326 audit(1782516883.550:15364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32077 comm="syz.5.8253" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16a859ce59 code=0x7ffc0000
[ 1689.661845][T24465] usb 5-1: USB disconnect, device number 53
[ 1689.845935][T32096] input: syz1 as /devices/virtual/input/input63
[ 1689.858485][T32097] blktrace: Concurrent blktraces are not allowed on loop1
[ 1689.948033][T32100] bridge0: port 1(syz_tun) entered blocking state
[ 1689.957339][T32100] bridge0: port 1(syz_tun) entered disabled state
[ 1689.966209][T32100] syz_tun: entered promiscuous mode
[ 1689.976589][T32100] bridge0: port 1(syz_tun) entered blocking state
[ 1689.985602][T32100] bridge0: port 1(syz_tun) entered forwarding state
[ 1690.341322][T30161] usb 2-1: new high-speed USB device number 51 using dummy_hcd
[ 1690.361321][T13720] usb 6-1: new high-speed USB device number 126 using dummy_hcd
[ 1690.491417][T30161] usb 2-1: Using ep0 maxpacket: 32
[ 1690.503708][T30161] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1690.511298][T13720] usb 6-1: Using ep0 maxpacket: 8
[ 1690.517845][T30161] usb 2-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00
[ 1690.527105][T13720] usb 6-1: config 0 has an invalid interface number: 55 but max is 0
[ 1690.537052][T30161] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1690.540656][T13720] usb 6-1: config 0 has no interface number 0
[ 1690.555689][T13720] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[ 1690.562651][T30161] usb 2-1: config 0 descriptor??
[ 1690.566843][T13720] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B
[ 1690.584020][T13720] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[ 1690.596216][T13720] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[ 1690.609847][T13720] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[ 1690.620335][T13720] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1690.636870][T13720] usb 6-1: config 0 descriptor??
[ 1690.648531][T13720] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0
[ 1690.840599][T30161] usbhid 2-1:0.0: can't add hid device: -71
[ 1690.858350][T30161] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[ 1690.862208][T13720] usb 6-1: USB disconnect, device number 126
[ 1690.878797][T30161] usb 2-1: USB disconnect, device number 51
[ 1690.926095][T13720] ldusb 6-1:0.55: LD USB Device #0 now disconnected
[ 1691.898253][T32140] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8267'.
[ 1692.180902][T32148] netdevsim netdevsim4 netdevsim0: left promiscuous mode
[ 1692.242531][T32151] netlink: 192 bytes leftover after parsing attributes in process `syz.1.8270'.
[ 1692.384165][T32164] blktrace: Concurrent blktraces are not allowed on loop1
[ 1692.458739][T32151] bridge_slave_1: default FDB implementation only supports local addresses
[ 1692.743219][T30161] usb 5-1: new high-speed USB device number 54 using dummy_hcd
[ 1692.913561][T30161] usb 5-1: Using ep0 maxpacket: 32
[ 1692.929408][T30161] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 1692.954801][T30161] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1693.019303][T30161] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[ 1693.067082][T30161] usb 5-1: string descriptor 0 read error: -22
[ 1693.078001][T30161] usb 5-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40
[ 1693.142358][T30161] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1693.381139][T30161] usb 5-1: cannot find UAC_HEADER
[ 1693.550708][T30161] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22
[ 1693.601856][T32168] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1693.629428][T32168] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1693.653289][T32168] random: crng reseeded on system resumption
[ 1693.717850][T32181] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8274'.
[ 1693.844481][T30161] usb 5-1: USB disconnect, device number 54
[ 1694.256692][T32189] netlink: 'syz.6.8279': attribute type 1 has an invalid length.
[ 1694.431563][T32189] netlink: 28 bytes leftover after parsing attributes in process `syz.6.8279'.
[ 1694.493491][T32189] 8021q: adding VLAN 0 to HW filter on device bond4
[ 1694.791522][T13548] usb 6-1: new high-speed USB device number 127 using dummy_hcd
[ 1694.952993][T13548] usb 6-1: Using ep0 maxpacket: 32
[ 1694.963945][T13548] usb 6-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7
[ 1694.981365][T13548] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1695.006964][T13548] usb 6-1: config 0 descriptor??
[ 1695.031292][T13548] gspca_main: sq930x-2.14.0 probing 041e:403c
[ 1695.239675][T32196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1695.280667][T32196] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1695.825761][T32223] syzkaller0: entered promiscuous mode
[ 1695.848455][T32223] syzkaller0: entered allmulticast mode
[ 1696.554964][T13548] gspca_sq930x: reg_w 0105 bf00 failed -110
[ 1696.590105][T32246] netlink: 192 bytes leftover after parsing attributes in process `syz.1.8298'.
[ 1696.634935][T13548] sq930x 6-1:0.0: probe with driver sq930x failed with error -110
[ 1696.737942][T32246] bridge_slave_1: default FDB implementation only supports local addresses
[ 1697.181583][T30159] usb 5-1: new high-speed USB device number 55 using dummy_hcd
[ 1697.346637][T30159] usb 5-1: Using ep0 maxpacket: 16
[ 1697.359451][T30159] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 1697.373590][T30159] usb 5-1: config 3 has an invalid interface number: 74 but max is 0
[ 1697.386294][T30159] usb 5-1: config 3 has no interface number 0
[ 1697.398629][T30159] usb 5-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1697.426789][T30159] usb 5-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1697.449054][T30159] usb 5-1: config 3 interface 74 has no altsetting 0
[ 1697.472887][T30159] usb 5-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1697.496200][T30159] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1697.531346][T30159] usb 5-1: Product: syz
[ 1697.541958][T30159] usb 5-1: Manufacturer: syz
[ 1697.546676][T30159] usb 5-1: SerialNumber: syz
[ 1697.575546][T32253] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22
[ 1697.648451][T13548] usb 6-1: USB disconnect, device number 127
[ 1697.950602][T32253] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check.
[ 1698.139394][T30159] ipaq 5-1:3.74: PocketPC PDA converter detected
[ 1698.183625][T32260] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8301'.
[ 1698.193794][T30159] usb 5-1: active config #3 != 1 ??
[ 1698.216240][T30159] usb 5-1: USB disconnect, device number 55
[ 1698.264660][   T29] kauditd_printk_skb: 6 callbacks suppressed
[ 1698.264676][   T29] audit: type=1800 audit(1782516892.720:15371): pid=32255 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.8300" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0
[ 1698.529575][T32260] netlink: 'syz.7.8301': attribute type 1 has an invalid length.
[ 1698.543991][T32260] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8301'.
[ 1698.872069][T24465] usb 2-1: new high-speed USB device number 52 using dummy_hcd
[ 1699.061534][T24465] usb 2-1: Using ep0 maxpacket: 32
[ 1699.079360][T24465] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[ 1699.114547][T24465] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[ 1699.143507][T24465] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[ 1699.173139][T24465] usb 2-1: Product: syz
[ 1699.193829][T24465] usb 2-1: Manufacturer: syz
[ 1699.219243][T24465] usb 2-1: SerialNumber: syz
[ 1699.269449][T24465] usb 2-1: config 0 descriptor??
[ 1699.308139][T32271] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[ 1699.328834][T32282] input: syz1 as /devices/virtual/input/input64
[ 1699.348490][T24465] hub 2-1:0.0: bad descriptor, ignoring hub
[ 1699.368646][T24465] hub 2-1:0.0: probe with driver hub failed with error -5
[ 1699.621418][T13720] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[ 1699.654128][T13548] usb 2-1: USB disconnect, device number 52
[ 1699.709704][T32286] netlink: 28 bytes leftover after parsing attributes in process `syz.7.8309'.
[ 1699.731395][T30159] usb 5-1: new high-speed USB device number 56 using dummy_hcd
[ 1699.781437][T13720] usb 6-1: Using ep0 maxpacket: 32
[ 1699.789946][T13720] usb 6-1: config 0 has too many interfaces: 193, using maximum allowed: 32
[ 1699.804905][T13720] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 193
[ 1699.818998][T13720] usb 6-1: config 0 has no interface number 0
[ 1699.834850][T13720] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 1699.848737][T13720] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 1699.878802][T13720] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b34, bcdDevice= 0.00
[ 1699.894519][T30159] usb 5-1: Using ep0 maxpacket: 8
[ 1699.906900][T30159] usb 5-1: config 0 has an invalid interface number: 55 but max is 0
[ 1699.915796][T13720] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1699.929854][T30159] usb 5-1: config 0 has no interface number 0
[ 1699.943191][T13720] usb 6-1: config 0 descriptor??
[ 1699.948567][T30159] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[ 1699.974512][T30159] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B
[ 1700.002210][T13548] usb 2-1: new high-speed USB device number 53 using dummy_hcd
[ 1700.007714][T30159] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[ 1700.036090][T30159] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[ 1700.072805][T30159] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[ 1700.107365][T30159] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1700.147415][T30159] usb 5-1: config 0 descriptor??
[ 1700.164828][T30159] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0
[ 1700.233879][T13548] usb 2-1: Using ep0 maxpacket: 32
[ 1700.247214][T13548] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[ 1700.276742][T13548] usb 2-1: string descriptor 0 read error: -22
[ 1700.295271][T13548] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[ 1700.317394][T13548] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[ 1700.346619][T13548] usb 2-1: config 0 descriptor??
[ 1700.376948][T32268] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[ 1700.389082][T32282] netlink: 32 bytes leftover after parsing attributes in process `syz.5.8307'.
[ 1700.409022][T13548] hub 2-1:0.0: bad descriptor, ignoring hub
[ 1700.427264][T13548] hub 2-1:0.0: probe with driver hub failed with error -5
[ 1700.451957][T32292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1700.501375][T32292] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1700.536985][T30159] usb 5-1: USB disconnect, device number 56
[ 1700.543852][    C0] ldusb 5-1:0.55: usb_submit_urb failed (-19)
[ 1700.609966][T30159] ldusb 5-1:0.55: LD USB Device #0 now disconnected
[ 1700.618203][T32284] ldusb: No device or device unplugged -19
[ 1700.741688][T13548] usb 2-1: USB disconnect, device number 53
[ 1700.885000][T32299] netlink: 192 bytes leftover after parsing attributes in process `syz.4.8312'.
[ 1701.017856][T32299] bridge_slave_1: default FDB implementation only supports local addresses
[ 1701.053705][T13720] usbhid 6-1:0.1: can't add hid device: -71
[ 1701.063595][T13720] usbhid 6-1:0.1: probe with driver usbhid failed with error -71
[ 1701.075214][T13720] usb 6-1: USB disconnect, device number 2
[ 1701.293926][T32308] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1701.614181][T32314] misc userio: No port type given on /dev/userio
[ 1701.631496][T13720] usb 2-1: new high-speed USB device number 54 using dummy_hcd
[ 1701.671381][T13535] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[ 1701.784054][T13720] usb 2-1: unable to get BOS descriptor or descriptor too short
[ 1701.793128][T13720] usb 2-1: config 189 has 0 interfaces, different from the descriptor's value: 1
[ 1701.805315][T13720] usb 2-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=61.9f
[ 1701.816848][T13720] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1701.825769][T13720] usb 2-1: Product: syz
[ 1701.830005][T13720] usb 2-1: Manufacturer: syz
[ 1701.835121][T13720] usb 2-1: SerialNumber: syz
[ 1701.840601][T13535] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1701.852244][T13535] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 3
[ 1701.865492][T13535] usb 6-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00
[ 1701.875481][T13535] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1701.885504][T13535] usb 6-1: config 0 descriptor??
[ 1701.959693][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1701.967764][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1701.976229][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1701.984437][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1701.992492][T30159] rtc rtc0: __rtc_set_alarm: err=-22
[ 1702.087166][T32307] netlink: 'syz.1.8315': attribute type 4 has an invalid length.
[ 1702.106896][T30159] usb 2-1: USB disconnect, device number 54
[ 1702.310499][T32312] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0)
[ 1702.339931][T13535] Bluetooth: Can't get state to change to load configuration err
[ 1702.348891][T13535] Bluetooth: Loading sysconfig file failed
[ 1702.355962][T13535] ath3k 6-1:0.0: probe with driver ath3k failed with error -16
[ 1702.365643][T13535] usb 6-1: USB disconnect, device number 3
[ 1702.504854][T32320] netlink: 28 bytes leftover after parsing attributes in process `syz.6.8320'.
[ 1703.601272][T13548] usb 6-1: new high-speed USB device number 4 using dummy_hcd
[ 1703.771323][T13548] usb 6-1: Using ep0 maxpacket: 32
[ 1703.783288][T13548] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 1703.794138][T13548] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2
[ 1703.809090][T13548] usb 6-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22
[ 1703.818980][T13548] usb 6-1: New USB device strings: Mfr=229, Product=129, SerialNumber=131
[ 1703.828890][T13548] usb 6-1: Product: syz
[ 1703.833849][T13548] usb 6-1: Manufacturer: syz
[ 1703.838581][T13548] usb 6-1: SerialNumber: syz
[ 1703.848779][T13548] appletouch 6-1:1.0: Could not find int-in endpoint
[ 1703.855652][T13548] appletouch 6-1:1.0: probe with driver appletouch failed with error -5
[ 1703.864827][T13548] usbhid 6-1:1.0: couldn't find an input interrupt endpoint
[ 1704.059624][T13548] usb 6-1: USB disconnect, device number 4
[ 1704.311997][T32356] netlink: 28 bytes leftover after parsing attributes in process `syz.7.8333'.
[ 1704.690907][T32372] netlink: 192 bytes leftover after parsing attributes in process `syz.5.8338'.
[ 1704.840365][T32372] bridge_slave_1: default FDB implementation only supports local addresses
[ 1705.010701][T32379] syzkaller0: entered promiscuous mode
[ 1705.016574][T32379] syzkaller0: entered allmulticast mode
[ 1705.026418][T32381] netlink: 40 bytes leftover after parsing attributes in process `syz.7.8341'.
[ 1705.031896][T30161] usb 5-1: new high-speed USB device number 57 using dummy_hcd
[ 1705.256554][T30161] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[ 1705.329888][T30161] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41
[ 1705.354633][T30161] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11
[ 1705.364760][T30161] usb 5-1: Product: syz
[ 1705.376115][T30161] usb 5-1: Manufacturer: syz
[ 1705.380931][T30161] usb 5-1: SerialNumber: syz
[ 1705.541350][T30159] usb 2-1: new high-speed USB device number 55 using dummy_hcd
[ 1705.612050][T30161] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 57 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[ 1705.701741][T30159] usb 2-1: Using ep0 maxpacket: 16
[ 1705.717107][T30159] usb 2-1: unable to get BOS descriptor or descriptor too short
[ 1705.734526][T30159] usb 2-1: config 3 has an invalid interface number: 74 but max is 0
[ 1705.758014][T30159] usb 2-1: config 3 has no interface number 0
[ 1705.773293][T30159] usb 2-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1705.804145][T30159] usb 2-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1705.824719][T30159] usb 2-1: config 3 interface 74 has no altsetting 0
[ 1705.843842][T30159] usb 2-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1705.856758][T30159] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1705.871745][T30159] usb 2-1: Product: syz
[ 1705.876240][T30159] usb 2-1: Manufacturer: syz
[ 1705.885756][T30159] usb 2-1: SerialNumber: syz
[ 1705.899613][T32387] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[ 1706.315422][T32387] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check.
[ 1706.455354][T30159] ipaq 2-1:3.74: PocketPC PDA converter detected
[ 1706.467160][T30159] usb 2-1: active config #3 != 1 ??
[ 1706.496552][T30159] usb 2-1: USB disconnect, device number 55
[ 1707.130292][T32407] netlink: 28 bytes leftover after parsing attributes in process `syz.6.8351'.
[ 1707.215949][T32410] netlink: 136 bytes leftover after parsing attributes in process `syz.1.8352'.
[ 1707.248906][T32411] syzkaller0: entered promiscuous mode
[ 1707.259874][T32411] syzkaller0: entered allmulticast mode
[ 1707.891639][T13720] usb 2-1: new high-speed USB device number 56 using dummy_hcd
[ 1708.051351][T13720] usb 2-1: device descriptor read/64, error -71
[ 1708.111313][T24465] usb 6-1: new high-speed USB device number 5 using dummy_hcd
[ 1708.248955][T30159] usb 5-1: USB disconnect, device number 57
[ 1708.263950][T24465] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08
[ 1708.275385][T24465] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1708.299801][T13720] usb 2-1: new high-speed USB device number 57 using dummy_hcd
[ 1708.329934][T24465] usb 6-1: config 0 descriptor??
[ 1708.362506][T24465] gspca_main: cpia1-2.14.0 probing 0813:0001
[ 1708.441287][T13720] usb 2-1: device descriptor read/64, error -71
[ 1708.563476][T13720] usb usb2-port1: attempt power cycle
[ 1708.775996][T32433] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1708.802422][T24465] gspca_cpia1: usb_control_msg 03, error -71
[ 1708.825096][T24465] gspca_cpia1: usb_control_msg 01, error -71
[ 1708.840995][T24465] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0)
[ 1708.874782][T24465] usb 6-1: USB disconnect, device number 5
[ 1708.922142][T13720] usb 2-1: new high-speed USB device number 58 using dummy_hcd
[ 1708.959139][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1708.976445][T13720] usb 2-1: device descriptor read/8, error -71
[ 1708.986445][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1709.007015][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1709.018261][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1709.030219][T30159] rtc rtc0: __rtc_set_alarm: err=-22
[ 1709.231993][T13720] usb 2-1: new high-speed USB device number 59 using dummy_hcd
[ 1709.257079][T32453] syzkaller0: entered promiscuous mode
[ 1709.264599][T32453] syzkaller0: entered allmulticast mode
[ 1709.274960][T13720] usb 2-1: device descriptor read/8, error -71
[ 1709.402701][T13720] usb usb2-port1: unable to enumerate USB device
[ 1709.453760][T32456] bridge1: entered promiscuous mode
[ 1709.468508][T32456] bridge1: entered allmulticast mode
[ 1709.493036][T32456] team0: Port device bridge1 added
[ 1709.647663][T32463] netlink: 192 bytes leftover after parsing attributes in process `syz.7.8368'.
[ 1709.799256][T32463] bridge_slave_1: default FDB implementation only supports local addresses
[ 1710.347063][T32418] usblp0: removed
[ 1710.626587][T32481] netlink: 'syz.1.8372': attribute type 8 has an invalid length.
[ 1710.651350][T32481] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8372'.
[ 1710.872493][T32487] netlink: 'syz.1.8374': attribute type 1 has an invalid length.
[ 1710.988500][T32487] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8374'.
[ 1711.034130][T32487] 8021q: adding VLAN 0 to HW filter on device bond11
[ 1711.089352][T32495] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8376'.
[ 1711.234317][T32500] syzkaller0: entered promiscuous mode
[ 1711.240061][T32500] syzkaller0: entered allmulticast mode
[ 1711.425396][T13720] usb 2-1: new full-speed USB device number 60 using dummy_hcd
[ 1711.585196][T13720] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[ 1711.605255][T13720] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10
[ 1711.627698][T13720] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64
[ 1711.659203][T13720] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e
[ 1711.683715][T13720] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1711.705838][T13720] usb 2-1: Product: syz
[ 1711.717980][T13720] usb 2-1: Manufacturer: syz
[ 1711.730263][T13720] usb 2-1: SerialNumber: syz
[ 1711.746867][T13720] usb 2-1: config 0 descriptor??
[ 1711.762522][T32498] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[ 1711.841252][T13720] rc_core: IR keymap rc-streamzap not found
[ 1711.858512][T13720] Registered IR keymap rc-empty
[ 1711.878956][T13720] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0
[ 1711.908909][T13720] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input65
[ 1712.736044][T13548] usb 2-1: USB disconnect, device number 60
[ 1713.041388][T24456] usb 5-1: new high-speed USB device number 58 using dummy_hcd
[ 1713.151377][T13720] usb 6-1: new high-speed USB device number 6 using dummy_hcd
[ 1713.203935][T24456] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[ 1713.235508][T24456] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41
[ 1713.245309][T24456] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11
[ 1713.253743][T24456] usb 5-1: Product: syz
[ 1713.258465][T24456] usb 5-1: Manufacturer: syz
[ 1713.264191][T24456] usb 5-1: SerialNumber: syz
[ 1713.291414][T13720] usb 6-1: device descriptor read/64, error -71
[ 1713.487049][T24456] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 58 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[ 1713.531353][T13720] usb 6-1: new high-speed USB device number 7 using dummy_hcd
[ 1713.662644][T13720] usb 6-1: device descriptor read/64, error -71
[ 1713.781788][T13720] usb usb6-port1: attempt power cycle
[ 1714.131390][T13720] usb 6-1: new high-speed USB device number 8 using dummy_hcd
[ 1714.162455][T13720] usb 6-1: device descriptor read/8, error -71
[ 1714.401462][T13720] usb 6-1: new high-speed USB device number 9 using dummy_hcd
[ 1714.422126][T13720] usb 6-1: device descriptor read/8, error -71
[ 1714.531538][T13720] usb usb6-port1: unable to enumerate USB device
[ 1715.311746][T13720] usb 2-1: new high-speed USB device number 61 using dummy_hcd
[ 1715.433690][T24465] usb 5-1: USB disconnect, device number 58
[ 1715.459326][T24465] usblp0: removed
[ 1715.474316][T13720] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[ 1715.485263][T13720] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1715.494103][T13720] usb 2-1: Product: syz
[ 1715.527081][T13720] usb 2-1: Manufacturer: syz
[ 1715.537520][T13720] usb 2-1: SerialNumber: syz
[ 1715.700184][T32547] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8392'.
[ 1715.880008][T32554] netlink: 192 bytes leftover after parsing attributes in process `syz.5.8394'.
[ 1716.015468][T32554] bridge_slave_1: default FDB implementation only supports local addresses
[ 1716.165648][T13720] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE
[ 1716.259196][T13720] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED....
[ 1716.288703][T13720] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED
[ 1716.322408][T13720] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -32
[ 1716.481476][T30161] usb 6-1: new high-speed USB device number 10 using dummy_hcd
[ 1716.655616][T30161] usb 6-1: Using ep0 maxpacket: 16
[ 1716.679065][T30161] usb 6-1: unable to get BOS descriptor or descriptor too short
[ 1716.695325][T30161] usb 6-1: config 3 has an invalid interface number: 74 but max is 0
[ 1716.709784][T30161] usb 6-1: config 3 has no interface number 0
[ 1716.724824][T30161] usb 6-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1716.749522][T30161] usb 6-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1716.777662][T30161] usb 6-1: config 3 interface 74 has no altsetting 0
[ 1716.797017][T30161] usb 6-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1716.807109][T30161] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1716.815516][T30161] usb 6-1: Product: syz
[ 1716.821036][T30161] usb 6-1: Manufacturer: syz
[ 1716.828590][T30161] usb 6-1: SerialNumber: syz
[ 1716.840641][T32559] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[ 1716.981335][T13720] usb 5-1: new high-speed USB device number 59 using dummy_hcd
[ 1717.134719][T13720] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config
[ 1717.156489][T13720] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[ 1717.178306][T32559] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[ 1717.195119][T13720] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[ 1717.216889][T13720] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
[ 1717.227007][T13720] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1717.243889][T13720] usb 5-1: Quirk or no altset; falling back to MIDI 1.0
[ 1717.252188][T13720] usb 5-1: invalid MIDI out EP 0
[ 1717.318474][T30161] ipaq 6-1:3.74: PocketPC PDA converter detected
[ 1717.338851][T30161] usb 6-1: active config #3 != 1 ??
[ 1717.366414][T30161] usb 6-1: USB disconnect, device number 10
[ 1717.457726][T13720] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -22
[ 1717.532885][T13720] usb 5-1: USB disconnect, device number 59
[ 1718.127662][T13720] usb 2-1: USB disconnect, device number 61
[ 1718.227860][T32586] hsr0: entered allmulticast mode
[ 1718.238046][T32586] hsr_slave_0: entered allmulticast mode
[ 1718.249253][T32586] hsr_slave_1: entered allmulticast mode
[ 1718.261691][T32586] binder: 32583:32586 ioctl c0306201 200000000640 returned -22
[ 1718.270230][T32586] binder: 32583:32586 ioctl 8004af80 200000000140 returned -22
[ 1718.281110][T32586] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8404'.
[ 1718.292161][T32586] hsr_slave_0: left promiscuous mode
[ 1718.303227][T32586] hsr_slave_1: left promiscuous mode
[ 1718.325654][T32586] hsr0 (unregistering): left allmulticast mode
[ 1718.671426][T13548] usb 5-1: new full-speed USB device number 60 using dummy_hcd
[ 1718.824098][T13548] usb 5-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 512, setting to 64
[ 1718.831435][T24456] usb 2-1: new high-speed USB device number 62 using dummy_hcd
[ 1718.835761][T13548] usb 5-1: config 1 interface 0 has no altsetting 0
[ 1718.853482][T13548] usb 5-1: string descriptor 0 read error: -22
[ 1718.859905][T13548] usb 5-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.40
[ 1718.870103][T13548] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1718.881611][T32592] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[ 1718.973784][T24456] usb 2-1: device descriptor read/64, error -71
[ 1719.211673][T24456] usb 2-1: new high-speed USB device number 63 using dummy_hcd
[ 1719.361369][T24456] usb 2-1: device descriptor read/64, error -71
[ 1719.481697][T24456] usb usb2-port1: attempt power cycle
[ 1719.777225][T32604] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8408'.
[ 1719.831401][T24456] usb 2-1: new high-speed USB device number 64 using dummy_hcd
[ 1719.856182][T13548] usbhid 5-1:1.0: can't add hid device: -71
[ 1719.857460][T24456] usb 2-1: device descriptor read/8, error -71
[ 1719.866369][T13548] usbhid 5-1:1.0: probe with driver usbhid failed with error -71
[ 1719.905161][T13548] usb 5-1: USB disconnect, device number 60
[ 1720.121480][T24456] usb 2-1: new high-speed USB device number 65 using dummy_hcd
[ 1720.161989][T24456] usb 2-1: device descriptor read/8, error -71
[ 1720.271704][T24456] usb usb2-port1: unable to enumerate USB device
[ 1721.051664][T24465] usb 5-1: new high-speed USB device number 61 using dummy_hcd
[ 1721.241767][T24465] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[ 1721.258826][T24465] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1721.270882][T24465] usb 5-1: Product: syz
[ 1721.276451][T24465] usb 5-1: Manufacturer: syz
[ 1721.287221][T24465] usb 5-1: SerialNumber: syz
[ 1721.324927][T32638] blktrace: Concurrent blktraces are not allowed on loop1
[ 1721.948207][T24465] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE
[ 1721.975791][T24465] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED....
[ 1721.997925][T24465] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED
[ 1722.023898][T24465] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -32
[ 1722.387651][T32657] netlink: 'syz.6.8421': attribute type 1 has an invalid length.
[ 1722.558432][T32657] netlink: 28 bytes leftover after parsing attributes in process `syz.6.8421'.
[ 1722.615275][T32657] 8021q: adding VLAN 0 to HW filter on device bond5
[ 1722.689636][T32657] netlink: 36 bytes leftover after parsing attributes in process `syz.6.8421'.
[ 1723.411385][T24456] usb 2-1: new high-speed USB device number 66 using dummy_hcd
[ 1723.552593][T32679] misc userio: No port type given on /dev/userio
[ 1723.563697][T24456] usb 2-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08
[ 1723.580024][T24456] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1723.607772][T24456] usb 2-1: config 0 descriptor??
[ 1723.627011][T24456] gspca_main: cpia1-2.14.0 probing 0813:0001
[ 1723.835791][T30161] usb 5-1: USB disconnect, device number 61
[ 1724.039655][T32671] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1724.066660][T24456] gspca_cpia1: usb_control_msg 03, error -71
[ 1724.088803][T24456] gspca_cpia1: usb_control_msg 01, error -71
[ 1724.099017][T24456] cpia1 2-1:0.0: only firmware version 1 is supported (got: 0)
[ 1724.112889][T24456] usb 2-1: USB disconnect, device number 66
[ 1724.241409][T30161] usb 5-1: new high-speed USB device number 62 using dummy_hcd
[ 1724.401298][T30161] usb 5-1: Using ep0 maxpacket: 16
[ 1724.416081][T30161] usb 5-1: unable to get BOS descriptor or descriptor too short
[ 1724.417610][T32703] FAULT_INJECTION: forcing a failure.
[ 1724.417610][T32703] name failslab, interval 1, probability 0, space 0, times 0
[ 1724.427420][T30161] usb 5-1: config 3 has an invalid interface number: 74 but max is 0
[ 1724.440962][T32703] CPU: 0 UID: 0 PID: 32703 Comm: syz.5.8438 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1724.440991][T32703] Tainted: [L]=SOFTLOCKUP
[ 1724.441005][T32703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1724.441017][T32703] Call Trace:
[ 1724.441025][T32703]  <TASK>
[ 1724.441034][T32703]  dump_stack_lvl+0xe8/0x150
[ 1724.441063][T32703]  should_fail_ex+0x40c/0x560
[ 1724.441094][T32703]  should_failslab+0xa8/0x100
[ 1724.441118][T32703]  kmem_cache_alloc_node_noprof+0xb3/0x610
[ 1724.441144][T32703]  ? local_lock_release+0x9c/0x160
[ 1724.441168][T32703]  ? __alloc_skb+0x1d7/0x7a0
[ 1724.441184][T32703]  ? __alloc_skb+0x1d7/0x7a0
[ 1724.441208][T32703]  __alloc_skb+0x1d7/0x7a0
[ 1724.441230][T32703]  netlink_dump+0x1e7/0xee0
[ 1724.441263][T32703]  ? __pfx_netlink_dump+0x10/0x10
[ 1724.441294][T32703]  ? __asan_memcpy+0x40/0x70
[ 1724.441320][T32703]  ? kmemdup_noprof+0x55/0x70
[ 1724.441345][T32703]  __netlink_dump_start+0x589/0x7b0
[ 1724.441370][T32703]  ? nft_netlink_dump_start_rcu+0xb6/0x1a0
[ 1724.441392][T32703]  nft_netlink_dump_start_rcu+0xdb/0x1a0
[ 1724.441416][T32703]  nf_tables_getsetelem+0x33f/0x1160
[ 1724.441435][T32703]  ? __skb_flow_dissect+0x3fe/0x6d50
[ 1724.441461][T32703]  ? __skb_flow_dissect+0x652a/0x6d50
[ 1724.441484][T32703]  ? __pfx_nf_tables_getsetelem+0x10/0x10
[ 1724.441506][T32703]  ? __nla_validate_parse+0x2429/0x2d50
[ 1724.441542][T32703]  ? __pfx___nla_validate_parse+0x10/0x10
[ 1724.441559][T32703]  ? lock_acquire+0x106/0x350
[ 1724.441584][T32703]  ? is_bpf_text_address+0x26/0x2b0
[ 1724.441604][T32703]  ? lock_acquire+0x106/0x350
[ 1724.441628][T32703]  ? nfnl_pernet+0x23/0x240
[ 1724.441647][T32703]  ? __pfx_nf_tables_dump_set_start+0x10/0x10
[ 1724.441670][T32703]  ? __pfx_nf_tables_dump_set+0x10/0x10
[ 1724.441691][T32703]  ? __pfx_nf_tables_dump_set_done+0x10/0x10
[ 1724.441719][T32703]  ? __nla_parse+0x40/0x60
[ 1724.441737][T32703]  ? __pfx_nf_tables_getsetelem+0x10/0x10
[ 1724.441757][T32703]  nfnetlink_rcv_msg+0x8a9/0x12b0
[ 1724.441776][T32703]  ? unwind_get_return_address+0x4d/0x90
[ 1724.441800][T32703]  ? nfnetlink_rcv_msg+0x228/0x12b0
[ 1724.441837][T32703]  ? __pfx_nfnetlink_rcv_msg+0x10/0x10
[ 1724.441900][T32703]  netlink_rcv_skb+0x226/0x4a0
[ 1724.441922][T32703]  ? __pfx_nfnetlink_rcv_msg+0x10/0x10
[ 1724.441943][T32703]  ? __pfx_netlink_rcv_skb+0x10/0x10
[ 1724.441975][T32703]  ? bpf_lsm_capable+0x9/0x20
[ 1724.441992][T32703]  ? security_capable+0x7e/0x2c0
[ 1724.442027][T32703]  nfnetlink_rcv+0x2b9/0x28c0
[ 1724.442050][T32703]  ? __dev_queue_xmit+0x29b/0x37f0
[ 1724.442076][T32703]  ? __local_bh_enable_ip+0xd0/0x130
[ 1724.442103][T32703]  ? lockdep_hardirqs_on+0x7a/0x110
[ 1724.442120][T32703]  ? __dev_queue_xmit+0x29b/0x37f0
[ 1724.442141][T32703]  ? __local_bh_enable_ip+0xd0/0x130
[ 1724.442165][T32703]  ? __dev_queue_xmit+0x29b/0x37f0
[ 1724.442186][T32703]  ? __dev_queue_xmit+0x1ed7/0x37f0
[ 1724.442207][T32703]  ? do_syscall_64+0x174/0x580
[ 1724.442224][T32703]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1724.442254][T32703]  ? __dev_queue_xmit+0x29b/0x37f0
[ 1724.442277][T32703]  ? __pfx_nfnetlink_rcv+0x10/0x10
[ 1724.442302][T32703]  ? __pfx___dev_queue_xmit+0x10/0x10
[ 1724.442331][T32703]  ? ref_tracker_free+0x689/0x830
[ 1724.442360][T32703]  ? __pfx_ref_tracker_free+0x10/0x10
[ 1724.442386][T32703]  ? __asan_memcpy+0x40/0x70
[ 1724.442409][T32703]  ? __skb_clone+0x5c/0x6c0
[ 1724.442434][T32703]  ? __skb_clone+0x449/0x6c0
[ 1724.442461][T32703]  ? skb_clone+0x246/0x3a0
[ 1724.442485][T32703]  ? __netlink_deliver_tap+0x811/0x860
[ 1724.442505][T32703]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1724.442532][T32703]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1724.442553][T32703]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1724.442579][T32703]  netlink_unicast+0x7bb/0x940
[ 1724.442609][T32703]  netlink_sendmsg+0x813/0xb40
[ 1724.442639][T32703]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1724.442665][T32703]  ? aa_sock_msg_perm+0xf1/0x1b0
[ 1724.442693][T32703]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1724.442714][T32703]  sock_sendmsg_nosec+0x13a/0x180
[ 1724.442742][T32703]  ____sys_sendmsg+0x54e/0x850
[ 1724.442768][T32703]  ? __pfx_____sys_sendmsg+0x10/0x10
[ 1724.442797][T32703]  ? import_iovec+0x73/0xa0
[ 1724.442821][T32703]  ___sys_sendmsg+0x2a5/0x360
[ 1724.442841][T32703]  ? __lock_acquire+0x683/0x2cf0
[ 1724.442863][T32703]  ? __pfx____sys_sendmsg+0x10/0x10
[ 1724.442917][T32703]  ? __fget_files+0x2a/0x420
[ 1724.442935][T32703]  ? __fget_files+0x3a2/0x420
[ 1724.442961][T32703]  __x64_sys_sendmsg+0x1b1/0x290
[ 1724.442985][T32703]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 1724.443028][T32703]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1724.443048][T32703]  do_syscall_64+0x174/0x580
[ 1724.443065][T32703]  ? trace_irq_disable+0x3b/0x140
[ 1724.443083][T32703]  ? clear_bhb_loop+0x40/0x90
[ 1724.443106][T32703]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1724.443125][T32703] RIP: 0033:0x7f16a859ce59
[ 1724.443144][T32703] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1724.443161][T32703] RSP: 002b:00007f16a9384028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1724.443181][T32703] RAX: ffffffffffffffda RBX: 00007f16a8815fa0 RCX: 00007f16a859ce59
[ 1724.443195][T32703] RDX: 0000000000008000 RSI: 00002000000002c0 RDI: 0000000000000005
[ 1724.443207][T32703] RBP: 00007f16a9384090 R08: 0000000000000000 R09: 0000000000000000
[ 1724.443220][T32703] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1724.443231][T32703] R13: 00007f16a8816038 R14: 00007f16a8815fa0 R15: 00007f16a893fa48
[ 1724.443260][T32703]  </TASK>
[ 1724.957704][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1724.968125][T30161] usb 5-1: config 3 has no interface number 0
[ 1724.996450][T30161] usb 5-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1725.008122][T30161] usb 5-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1725.010510][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1725.018272][T30161] usb 5-1: config 3 interface 74 has no altsetting 0
[ 1725.020344][T30161] usb 5-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1725.042240][T30161] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1725.050281][T30161] usb 5-1: Product: syz
[ 1725.054503][T30161] usb 5-1: Manufacturer: syz
[ 1725.059104][T30161] usb 5-1: SerialNumber: syz
[ 1725.068692][T32691] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[ 1725.106593][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1725.142142][T30159] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future
[ 1725.172805][T30159] rtc rtc0: __rtc_set_alarm: err=-22
[ 1725.308500][T32719] batadv_slave_1: entered promiscuous mode
[ 1725.376447][T32720] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[ 1725.460544][T32691] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check.
[ 1725.482187][T32716] batadv_slave_1: left promiscuous mode
[ 1725.537142][T30161] ipaq 5-1:3.74: PocketPC PDA converter detected
[ 1725.564271][T30161] usb 5-1: active config #3 != 1 ??
[ 1725.605553][T30161] usb 5-1: USB disconnect, device number 62
[ 1725.841415][T30159] usb 2-1: new full-speed USB device number 67 using dummy_hcd
[ 1725.954089][   T29] audit: type=1326 audit(1782516920.420:15372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1725.980166][   T29] audit: type=1326 audit(1782516920.420:15373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.003365][T30159] usb 2-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 512, setting to 64
[ 1726.014405][   T29] audit: type=1326 audit(1782516920.440:15374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=283 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.023584][T30159] usb 2-1: config 1 interface 0 has no altsetting 0
[ 1726.042924][   T29] audit: type=1326 audit(1782516920.440:15375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.078690][T30159] usb 2-1: string descriptor 0 read error: -22
[ 1726.086629][T30159] usb 2-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.40
[ 1726.094825][   T29] audit: type=1326 audit(1782516920.440:15376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.111423][T30159] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1726.123392][   T29] audit: type=1326 audit(1782516920.490:15377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=286 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.162770][T32725] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[ 1726.238056][   T29] audit: type=1326 audit(1782516920.490:15378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.271869][   T29] audit: type=1326 audit(1782516920.490:15379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.327240][   T29] audit: type=1326 audit(1782516920.520:15380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.355677][   T29] audit: type=1326 audit(1782516920.520:15381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32733 comm="syz.6.8448" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f337e59ce59 code=0x7ffc0000
[ 1726.469737][T32742] binder: 32739:32742 ioctl c0306201 200000000000 returned -14
[ 1726.491317][T24465] usb 5-1: new high-speed USB device number 63 using dummy_hcd
[ 1726.641758][T30161] usb 6-1: new high-speed USB device number 11 using dummy_hcd
[ 1726.649499][T24465] usb 5-1: Using ep0 maxpacket: 16
[ 1726.659235][T24465] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[ 1726.683294][T24465] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[ 1726.704487][T24465] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d
[ 1726.722051][T24465] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1726.730359][T24465] usb 5-1: Product: syz
[ 1726.735297][T24465] usb 5-1: Manufacturer: syz
[ 1726.739941][T24465] usb 5-1: SerialNumber: syz
[ 1726.752654][T24465] usb 5-1: config 0 descriptor??
[ 1726.801283][T30161] usb 6-1: Using ep0 maxpacket: 16
[ 1726.808105][T30161] usb 6-1: config 0 has an invalid interface number: 11 but max is 0
[ 1726.818447][T30161] usb 6-1: config 0 has no interface number 0
[ 1726.826621][T30161] usb 6-1: too many endpoints for config 0 interface 11 altsetting 255: 255, using maximum allowed: 30
[ 1726.838333][T30161] usb 6-1: config 0 interface 11 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255
[ 1726.856323][T30161] usb 6-1: config 0 interface 11 has no altsetting 0
[ 1726.866581][T30161] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice=d2.7b
[ 1726.876266][T30161] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1726.887144][T30161] usb 6-1: Product: syz
[ 1726.892188][T30159] usbhid 2-1:1.0: can't add hid device: -71
[ 1726.894178][T30161] usb 6-1: Manufacturer: syz
[ 1726.905479][T30159] usbhid 2-1:1.0: probe with driver usbhid failed with error -71
[ 1726.908726][T30161] usb 6-1: SerialNumber: syz
[ 1726.922633][T30161] usb 6-1: config 0 descriptor??
[ 1726.925743][T30159] usb 2-1: USB disconnect, device number 67
[ 1727.164540][T32737] syzkaller0: entered promiscuous mode
[ 1727.170049][T32737] syzkaller0: entered allmulticast mode
[ 1727.180498][T32737] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[ 1727.194744][T32736] tipc: Resetting bearer <eth:syzkaller0>
[ 1727.240776][T32736] tipc: Disabling bearer <eth:syzkaller0>
[ 1727.258991][T30161] usb 6-1: Expected 3 endpoints, found: 0
[ 1727.286489][T30161] usb 6-1: USB disconnect, device number 11
[ 1728.311382][T30159] usb 6-1: new high-speed USB device number 12 using dummy_hcd
[ 1728.466300][T30159] usb 6-1: config 220 has too many interfaces: 184, using maximum allowed: 32
[ 1728.476171][T30159] usb 6-1: config 220 has 1 interface, different from the descriptor's value: 184
[ 1728.485829][T30159] usb 6-1: New USB device found, idVendor=0c45, idProduct=8008, bcdDevice=e1.85
[ 1728.495263][T30159] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1728.509330][T30159] gspca_main: sn9c2028-2.14.0 probing 0c45:8008
[ 1728.691484][T24456] usb 2-1: new high-speed USB device number 68 using dummy_hcd
[ 1728.732632][T30159] gspca_sn9c2028: read1 error -71
[ 1728.743916][T30159] gspca_sn9c2028: read1 error -71
[ 1728.752046][T30159] gspca_sn9c2028: read1 error -71
[ 1728.757309][T30159] sn9c2028 6-1:220.0: probe with driver sn9c2028 failed with error -71
[ 1728.774086][T30159] usb 6-1: USB disconnect, device number 12
[ 1728.843144][T24456] usb 2-1: config 0 has an invalid interface number: 50 but max is 0
[ 1728.854427][T24456] usb 2-1: config 0 has no interface number 0
[ 1728.861083][T24456] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 200, changing to 11
[ 1728.873850][T24456] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid maxpacket 58111, setting to 1024
[ 1728.898152][T24456] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc
[ 1728.909083][T24456] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1728.918858][T24456] usb 2-1: Product: syz
[ 1728.923603][T24456] usb 2-1: Manufacturer: syz
[ 1728.928323][T24456] usb 2-1: SerialNumber: syz
[ 1728.942539][T24456] usb 2-1: config 0 descriptor??
[ 1728.964550][T24456] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0
[ 1729.226763][T24465] usb 5-1: USB disconnect, device number 63
[ 1729.305207][  T305] fuse: Bad value for 'fd'
[ 1729.663177][T24456] usb 5-1: new full-speed USB device number 64 using dummy_hcd
[ 1729.822576][T24456] usb 5-1: not running at top speed; connect to a high speed hub
[ 1729.831655][T24456] usb 5-1: config 2 has an invalid interface number: 85 but max is 0
[ 1729.839943][T24456] usb 5-1: config 2 has no interface number 0
[ 1729.846750][T24456] usb 5-1: config 2 interface 85 has no altsetting 0
[ 1729.855381][T24456] usb 5-1: New USB device found, idVendor=0572, idProduct=0041, bcdDevice=a7.d5
[ 1729.865032][T24456] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1729.873324][T24456] usb 5-1: Product: syz
[ 1729.877529][T24456] usb 5-1: Manufacturer: syz
[ 1729.882332][T24456] usb 5-1: SerialNumber: syz
[ 1730.114917][T24456] gspca_main: conex-2.14.0 probing 0572:0041
[ 1730.197297][T24456] usb 5-1: USB disconnect, device number 64
[ 1730.304634][ T1315] ieee802154 phy0 wpan0: encryption failed: -22
[ 1730.311574][ T1315] ieee802154 phy1 wpan1: encryption failed: -22
[ 1730.903152][  T332] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8472'.
[ 1731.185552][    C0] usb 2-1: yurex_control_callback - control failed: -2
[ 1731.203728][T24465] usb 2-1: USB disconnect, device number 68
[ 1731.220863][T24465] yurex 2-1:0.50: USB YUREX #0 now disconnected
[ 1731.445986][  T338] fuse: Invalid rootmode
[ 1731.568698][  T343] FAULT_INJECTION: forcing a failure.
[ 1731.568698][  T343] name failslab, interval 1, probability 0, space 0, times 0
[ 1731.583580][  T343] CPU: 0 UID: 0 PID: 343 Comm: syz.6.8475 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1731.583598][  T343] Tainted: [L]=SOFTLOCKUP
[ 1731.583602][  T343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1731.583609][  T343] Call Trace:
[ 1731.583614][  T343]  <TASK>
[ 1731.583620][  T343]  dump_stack_lvl+0xe8/0x150
[ 1731.583638][  T343]  should_fail_ex+0x40c/0x560
[ 1731.583655][  T343]  ? xfrm_policy_inexact_alloc_bin+0x147/0x1b50
[ 1731.583670][  T343]  should_failslab+0xa8/0x100
[ 1731.583684][  T343]  __kmalloc_cache_noprof+0xa8/0x660
[ 1731.583701][  T343]  ? xfrm_policy_inexact_alloc_bin+0x993/0x1b50
[ 1731.583713][  T343]  ? xfrm_policy_inexact_alloc_bin+0x993/0x1b50
[ 1731.583727][  T343]  ? xfrm_policy_inexact_alloc_bin+0x147/0x1b50
[ 1731.583740][  T343]  xfrm_policy_inexact_alloc_bin+0x993/0x1b50
[ 1731.583753][  T343]  ? xfrm_policy_inexact_alloc_bin+0x147/0x1b50
[ 1731.583766][  T343]  ? do_raw_spin_lock+0x12b/0x2f0
[ 1731.583781][  T343]  ? xfrm_policy_insert+0x9f/0x960
[ 1731.583800][  T343]  ? policy_hash_bysel+0x1c7/0x920
[ 1731.583817][  T343]  xfrm_policy_inexact_insert+0x1e/0x180
[ 1731.583834][  T343]  xfrm_policy_insert+0x113/0x960
[ 1731.583854][  T343]  xfrm_add_policy+0x2ea/0x690
[ 1731.583936][  T343]  ? __pfx_xfrm_add_policy+0x10/0x10
[ 1731.583946][  T343]  ? apparmor_capable+0x126/0x170
[ 1731.583966][  T343]  ? __nla_parse+0x40/0x60
[ 1731.583978][  T343]  xfrm_user_rcv_msg+0x7a8/0xf30
[ 1731.583992][  T343]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[ 1731.584017][  T343]  ? __mutex_trylock_common+0x15f/0x270
[ 1731.584032][  T343]  ? __pfx___mutex_trylock_common+0x10/0x10
[ 1731.584047][  T343]  ? rcu_is_watching+0x15/0xb0
[ 1731.584067][  T343]  ? trace_contention_end+0x3d/0x140
[ 1731.584084][  T343]  netlink_rcv_skb+0x226/0x4a0
[ 1731.584098][  T343]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[ 1731.584110][  T343]  ? __pfx_netlink_rcv_skb+0x10/0x10
[ 1731.584129][  T343]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1731.584141][  T343]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1731.584154][  T343]  xfrm_netlink_rcv+0x79/0x90
[ 1731.584165][  T343]  netlink_unicast+0x7bb/0x940
[ 1731.584180][  T343]  netlink_sendmsg+0x813/0xb40
[ 1731.584198][  T343]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1731.584212][  T343]  ? aa_sock_msg_perm+0xf1/0x1b0
[ 1731.584228][  T343]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1731.584239][  T343]  sock_sendmsg_nosec+0x13a/0x180
[ 1731.584257][  T343]  ____sys_sendmsg+0x54e/0x850
[ 1731.584271][  T343]  ? __pfx_____sys_sendmsg+0x10/0x10
[ 1731.584287][  T343]  ? import_iovec+0x73/0xa0
[ 1731.584300][  T343]  ___sys_sendmsg+0x2a5/0x360
[ 1731.584312][  T343]  ? __lock_acquire+0x683/0x2cf0
[ 1731.584325][  T343]  ? __pfx____sys_sendmsg+0x10/0x10
[ 1731.584353][  T343]  ? __fget_files+0x2a/0x420
[ 1731.584362][  T343]  ? __fget_files+0x3a2/0x420
[ 1731.584377][  T343]  __x64_sys_sendmsg+0x1b1/0x290
[ 1731.584390][  T343]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 1731.584410][  T343]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1731.584421][  T343]  do_syscall_64+0x174/0x580
[ 1731.584433][  T343]  ? trace_irq_disable+0x3b/0x140
[ 1731.584443][  T343]  ? clear_bhb_loop+0x40/0x90
[ 1731.584456][  T343]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1731.584466][  T343] RIP: 0033:0x7f337e59ce59
[ 1731.584478][  T343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1731.584487][  T343] RSP: 002b:00007f337c7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1731.584498][  T343] RAX: ffffffffffffffda RBX: 00007f337e815fa0 RCX: 00007f337e59ce59
[ 1731.584506][  T343] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003
[ 1731.584513][  T343] RBP: 00007f337c7f6090 R08: 0000000000000000 R09: 0000000000000000
[ 1731.584519][  T343] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1731.584525][  T343] R13: 00007f337e816038 R14: 00007f337e815fa0 R15: 00007f337e93fa48
[ 1731.584541][  T343]  </TASK>
[ 1732.559667][  T362] netlink: 'syz.4.8482': attribute type 1 has an invalid length.
[ 1732.684393][  T362] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8482'.
[ 1732.719265][  T366] FAULT_INJECTION: forcing a failure.
[ 1732.719265][  T366] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 1732.734786][  T366] CPU: 0 UID: 0 PID: 366 Comm: syz.7.8483 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1732.734825][  T366] Tainted: [L]=SOFTLOCKUP
[ 1732.734833][  T366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1732.734844][  T366] Call Trace:
[ 1732.734852][  T366]  <TASK>
[ 1732.734860][  T366]  dump_stack_lvl+0xe8/0x150
[ 1732.734888][  T366]  should_fail_ex+0x40c/0x560
[ 1732.734918][  T366]  _copy_from_user+0x2d/0xb0
[ 1732.734940][  T366]  ___sys_recvmsg+0x173/0x5a0
[ 1732.734968][  T366]  ? __pfx____sys_recvmsg+0x10/0x10
[ 1732.734991][  T366]  ? __fget_files+0x2a/0x420
[ 1732.735027][  T366]  ? __fget_files+0x3a2/0x420
[ 1732.735055][  T366]  do_recvmmsg+0x31a/0x7f0
[ 1732.735085][  T366]  ? __pfx_do_recvmmsg+0x10/0x10
[ 1732.735117][  T366]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 1732.735140][  T366]  ? __fget_files+0x3a2/0x420
[ 1732.735167][  T366]  __x64_sys_recvmmsg+0x198/0x250
[ 1732.735192][  T366]  ? __pfx___x64_sys_recvmmsg+0x10/0x10
[ 1732.735226][  T366]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1732.735246][  T366]  do_syscall_64+0x174/0x580
[ 1732.735263][  T366]  ? trace_irq_disable+0x3b/0x140
[ 1732.735281][  T366]  ? clear_bhb_loop+0x40/0x90
[ 1732.735301][  T366]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1732.735319][  T366] RIP: 0033:0x7f444759ce59
[ 1732.735337][  T366] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1732.735354][  T366] RSP: 002b:00007f444837f028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
[ 1732.735375][  T366] RAX: ffffffffffffffda RBX: 00007f4447815fa0 RCX: 00007f444759ce59
[ 1732.735388][  T366] RDX: 0400000000000054 RSI: 0000200000000780 RDI: 0000000000000003
[ 1732.735401][  T366] RBP: 00007f444837f090 R08: 0000000000000000 R09: 0000000000000000
[ 1732.735414][  T366] R10: 0000000040012100 R11: 0000000000000246 R12: 0000000000000001
[ 1732.735424][  T366] R13: 00007f4447816038 R14: 00007f4447815fa0 R15: 00007f444793fa48
[ 1732.735454][  T366]  </TASK>
[ 1732.749657][  T364] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8482'.
[ 1732.791740][  T362] 8021q: adding VLAN 0 to HW filter on device bond9
[ 1733.003637][  T374] fuse: Invalid rootmode
[ 1733.154185][  T380] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8486'.
[ 1733.271022][  T385] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8488'.
[ 1733.901862][T30159] usb 2-1: new high-speed USB device number 69 using dummy_hcd
[ 1734.065346][T30159] usb 2-1: Using ep0 maxpacket: 32
[ 1734.089898][T30159] usb 2-1: config 0 has an invalid interface number: 89 but max is 0
[ 1734.128460][T30159] usb 2-1: config 0 has no interface number 0
[ 1734.155051][T30159] usb 2-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0
[ 1734.183779][T30159] usb 2-1: config 0 interface 89 has no altsetting 0
[ 1734.207953][T30159] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a
[ 1734.241809][T30159] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1734.263128][T30159] usb 2-1: Product: syz
[ 1734.275577][T30159] usb 2-1: Manufacturer: syz
[ 1734.289003][T30159] usb 2-1: SerialNumber: syz
[ 1734.332167][T30159] usb 2-1: config 0 descriptor??
[ 1734.355027][   T29] kauditd_printk_skb: 24 callbacks suppressed
[ 1734.355043][   T29] audit: type=1326 audit(1782516928.820:15406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.355170][T30159] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 1734.370927][   T29] audit: type=1326 audit(1782516928.820:15407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.477137][   T29] audit: type=1326 audit(1782516928.830:15408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=283 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.503244][   T29] audit: type=1326 audit(1782516928.830:15409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.525496][T30159] em28xx 2-1:0.89: Video interface 89 found:
[ 1734.529272][   T29] audit: type=1326 audit(1782516928.830:15410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=286 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.560115][   T29] audit: type=1326 audit(1782516928.830:15411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.588876][   T29] audit: type=1326 audit(1782516928.830:15412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.614940][   T29] audit: type=1326 audit(1782516928.830:15413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.640335][   T29] audit: type=1326 audit(1782516928.830:15414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.649175][  T398] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8494'.
[ 1734.665768][   T29] audit: type=1326 audit(1782516928.830:15415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=395 comm="syz.4.8493" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74adf9ce59 code=0x7ffc0000
[ 1734.683990][  T398] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8494'.
[ 1734.785640][  T387] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 1734.795721][  T387] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 1735.007602][T30159] em28xx 2-1:0.89: unknown em28xx chip ID (0)
[ 1735.122850][  T406] ±ÿ: renamed from lo (while UP)
[ 1735.247638][  T408] netlink: 'syz.6.8496': attribute type 1 has an invalid length.
[ 1735.334674][  T408] netlink: 28 bytes leftover after parsing attributes in process `syz.6.8496'.
[ 1735.363576][  T408] 8021q: adding VLAN 0 to HW filter on device bond6
[ 1735.391532][  T412] fuse: Invalid rootmode
[ 1735.400035][  T410] netlink: 36 bytes leftover after parsing attributes in process `syz.6.8496'.
[ 1735.459972][  T415] netlink: 27 bytes leftover after parsing attributes in process `syz.4.8498'.
[ 1735.497510][  T415] FAULT_INJECTION: forcing a failure.
[ 1735.497510][  T415] name failslab, interval 1, probability 0, space 0, times 0
[ 1735.527335][  T415] CPU: 0 UID: 0 PID: 415 Comm: syz.4.8498 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1735.527366][  T415] Tainted: [L]=SOFTLOCKUP
[ 1735.527373][  T415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1735.527384][  T415] Call Trace:
[ 1735.527393][  T415]  <TASK>
[ 1735.527401][  T415]  dump_stack_lvl+0xe8/0x150
[ 1735.527433][  T415]  should_fail_ex+0x40c/0x560
[ 1735.527465][  T415]  should_failslab+0xa8/0x100
[ 1735.527500][  T415]  kmem_cache_alloc_noprof+0xa6/0x5f0
[ 1735.527528][  T415]  ? skb_clone+0x212/0x3a0
[ 1735.527550][  T415]  ? skb_clone+0x212/0x3a0
[ 1735.527578][  T415]  skb_clone+0x212/0x3a0
[ 1735.527603][  T415]  __netlink_deliver_tap+0x413/0x860
[ 1735.527635][  T415]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1735.527659][  T415]  netlink_deliver_tap+0x19c/0x1b0
[ 1735.527682][  T415]  netlink_sendskb+0x68/0x140
[ 1735.527704][  T415]  netlink_rcv_skb+0x2a4/0x4a0
[ 1735.527728][  T415]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 1735.527751][  T415]  ? __pfx_netlink_rcv_skb+0x10/0x10
[ 1735.527785][  T415]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1735.527806][  T415]  ? netlink_deliver_tap+0x2e/0x1b0
[ 1735.527834][  T415]  netlink_unicast+0x7bb/0x940
[ 1735.527865][  T415]  netlink_sendmsg+0x813/0xb40
[ 1735.527886][  T415]  ? __fget_files+0x2a/0x420
[ 1735.527911][  T415]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1735.527937][  T415]  ? aa_sock_msg_perm+0xf1/0x1b0
[ 1735.527963][  T415]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1735.527984][  T415]  sock_sendmsg_nosec+0x13a/0x180
[ 1735.528011][  T415]  __sys_sendto+0x408/0x5a0
[ 1735.528029][  T415]  ? ksys_write+0x1e6/0x270
[ 1735.528054][  T415]  ? __pfx___sys_sendto+0x10/0x10
[ 1735.528070][  T415]  ? __mutex_unlock_slowpath+0x731/0x900
[ 1735.528114][  T415]  ? __pfx_ksys_write+0x10/0x10
[ 1735.528142][  T415]  __x64_sys_sendto+0xde/0x100
[ 1735.528162][  T415]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1735.528181][  T415]  do_syscall_64+0x174/0x580
[ 1735.528199][  T415]  ? trace_irq_disable+0x3b/0x140
[ 1735.528216][  T415]  ? clear_bhb_loop+0x40/0x90
[ 1735.528239][  T415]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1735.528258][  T415] RIP: 0033:0x7f74adf9ce59
[ 1735.528276][  T415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1735.528292][  T415] RSP: 002b:00007f74aee83028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 1735.528311][  T415] RAX: ffffffffffffffda RBX: 00007f74ae215fa0 RCX: 00007f74adf9ce59
[ 1735.528323][  T415] RDX: 0000000000010a73 RSI: 0000200000000000 RDI: 0000000000000003
[ 1735.528335][  T415] RBP: 00007f74aee83090 R08: 0000000000000000 R09: 4b6ae4f95a5de35b
[ 1735.528348][  T415] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001
[ 1735.528359][  T415] R13: 00007f74ae216038 R14: 00007f74ae215fa0 R15: 00007f74ae33fa48
[ 1735.528389][  T415]  </TASK>
[ 1735.840765][T30161] usb 6-1: new high-speed USB device number 13 using dummy_hcd
[ 1735.997327][  T427] FAULT_INJECTION: forcing a failure.
[ 1735.997327][  T427] name failslab, interval 1, probability 0, space 0, times 0
[ 1736.010565][  T427] CPU: 0 UID: 0 PID: 427 Comm: syz.4.8503 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1736.010595][  T427] Tainted: [L]=SOFTLOCKUP
[ 1736.010603][  T427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1736.010614][  T427] Call Trace:
[ 1736.010621][  T427]  <TASK>
[ 1736.010628][  T427]  dump_stack_lvl+0xe8/0x150
[ 1736.010658][  T427]  should_fail_ex+0x40c/0x560
[ 1736.010687][  T427]  should_failslab+0xa8/0x100
[ 1736.010708][  T427]  kmem_cache_alloc_node_noprof+0xb3/0x610
[ 1736.010734][  T427]  ? local_lock_release+0x9c/0x160
[ 1736.010754][  T427]  ? __alloc_skb+0x1d7/0x7a0
[ 1736.010769][  T427]  ? __alloc_skb+0x1d7/0x7a0
[ 1736.010789][  T427]  __alloc_skb+0x1d7/0x7a0
[ 1736.010810][  T427]  netlink_sendmsg+0x5d4/0xb40
[ 1736.010838][  T427]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1736.010861][  T427]  ? aa_sock_msg_perm+0xf1/0x1b0
[ 1736.010888][  T427]  ? __pfx_netlink_sendmsg+0x10/0x10
[ 1736.010907][  T427]  sock_sendmsg_nosec+0x13a/0x180
[ 1736.010935][  T427]  ____sys_sendmsg+0x54e/0x850
[ 1736.010960][  T427]  ? __pfx_____sys_sendmsg+0x10/0x10
[ 1736.010988][  T427]  ? import_iovec+0x73/0xa0
[ 1736.011013][  T427]  ___sys_sendmsg+0x2a5/0x360
[ 1736.011033][  T427]  ? __lock_acquire+0x683/0x2cf0
[ 1736.011066][  T427]  ? __pfx____sys_sendmsg+0x10/0x10
[ 1736.011115][  T427]  ? __fget_files+0x2a/0x420
[ 1736.011134][  T427]  ? __fget_files+0x3a2/0x420
[ 1736.011161][  T427]  __x64_sys_sendmsg+0x1b1/0x290
[ 1736.011183][  T427]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 1736.011219][  T427]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1736.011238][  T427]  do_syscall_64+0x174/0x580
[ 1736.011255][  T427]  ? trace_irq_disable+0x3b/0x140
[ 1736.011272][  T427]  ? clear_bhb_loop+0x40/0x90
[ 1736.011294][  T427]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1736.011313][  T427] RIP: 0033:0x7f74adf9ce59
[ 1736.011331][  T427] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 1736.011348][  T427] RSP: 002b:00007f74aee83028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1736.011368][  T427] RAX: ffffffffffffffda RBX: 00007f74ae215fa0 RCX: 00007f74adf9ce59
[ 1736.011382][  T427] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004
[ 1736.011395][  T427] RBP: 00007f74aee83090 R08: 0000000000000000 R09: 0000000000000000
[ 1736.011406][  T427] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1736.011418][  T427] R13: 00007f74ae216038 R14: 00007f74ae215fa0 R15: 00007f74ae33fa48
[ 1736.011447][  T427]  </TASK>
[ 1736.073229][T30161] usb 6-1: Using ep0 maxpacket: 16
[ 1736.139108][T30159] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[ 1736.223373][T30161] usb 6-1: unable to get BOS descriptor or descriptor too short
[ 1736.236172][T30159] em28xx 2-1:0.89: board has no eeprom
[ 1736.239571][T30161] usb 6-1: config 3 has an invalid interface number: 74 but max is 0
[ 1736.301504][T30159] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67)
[ 1736.315427][T30161] usb 6-1: config 3 has no interface number 0
[ 1736.322850][T30161] usb 6-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83
[ 1736.324335][T30159] em28xx 2-1:0.89: analog set to bulk mode.
[ 1736.334640][T30161] usb 6-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8
[ 1736.334672][T30161] usb 6-1: config 3 interface 74 has no altsetting 0
[ 1736.336722][T30161] usb 6-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c
[ 1736.346359][T24456] em28xx 2-1:0.89: Registering V4L2 extension
[ 1736.363463][  T430] misc userio: No port type given on /dev/userio
[ 1736.399176][T30161] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1736.408412][T30161] usb 6-1: Product: syz
[ 1736.415318][T30161] usb 6-1: Manufacturer: syz
[ 1736.422704][T30161] usb 6-1: SerialNumber: syz
[ 1736.458621][  T419] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22
[ 1736.520017][T24456] em28xx 2-1:0.89: reading from i2c device at 0x4a failed (error=-5)
[ 1736.531566][T24456] em28xx 2-1:0.89: reading from i2c device at 0x48 failed (error=-5)
[ 1736.547334][T24456] em28xx 2-1:0.89: reading from i2c device at 0x42 failed (error=-5)
[ 1736.556592][T24456] em28xx 2-1:0.89: reading from i2c device at 0x40 failed (error=-5)
[ 1736.571649][T24456] em28xx 2-1:0.89: Config register raw data: 0xfffffffb
[ 1736.584603][T24456] em28xx 2-1:0.89: AC97 chip type couldn't be determined
[ 1736.592305][T24456] em28xx 2-1:0.89: No AC97 audio processor
[ 1736.710413][T24456] usb 2-1: Decoder not found
[ 1736.719819][T17984] usb 2-1: USB disconnect, device number 69
[ 1736.725703][T24456] em28xx 2-1:0.89: failed to create media graph
[ 1736.730040][T17984] em28xx 2-1:0.89: Disconnecting em28xx
[ 1736.753359][T24456] em28xx 2-1:0.89: V4L2 device video103 deregistered
[ 1736.763578][  T419] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[ 1736.816564][  T433] ==================================================================
[ 1736.824707][  T433] BUG: KASAN: slab-use-after-free in v4l2_open+0x397/0x3a0
[ 1736.832016][  T433] Read of size 4 at addr ffff888064b30860 by task v4l_id/433
[ 1736.839471][  T433] 
[ 1736.841887][  T433] CPU: 0 UID: 0 PID: 433 Comm: v4l_id Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1736.841941][  T433] Tainted: [L]=SOFTLOCKUP
[ 1736.841949][  T433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1736.841961][  T433] Call Trace:
[ 1736.841970][  T433]  <TASK>
[ 1736.841979][  T433]  dump_stack_lvl+0xe8/0x150
[ 1736.842014][  T433]  print_address_description+0x55/0x1e0
[ 1736.842037][  T433]  ? v4l2_open+0x397/0x3a0
[ 1736.842060][  T433]  print_report+0x58/0x70
[ 1736.842077][  T433]  kasan_report+0x117/0x150
[ 1736.842100][  T433]  ? v4l2_open+0x397/0x3a0
[ 1736.842123][  T433]  v4l2_open+0x397/0x3a0
[ 1736.842144][  T433]  chrdev_open+0x4d9/0x600
[ 1736.842169][  T433]  ? __pfx_chrdev_open+0x10/0x10
[ 1736.842191][  T433]  ? fsnotify_open_perm_and_set_mode+0x135/0x6b0
[ 1736.842216][  T433]  ? __pfx_chrdev_open+0x10/0x10
[ 1736.842238][  T433]  do_dentry_open+0x816/0x1380
[ 1736.842271][  T433]  vfs_open+0x3b/0x340
[ 1736.842295][  T433]  ? path_openat+0x2e2d/0x3830
[ 1736.842317][  T433]  path_openat+0x2e44/0x3830
[ 1736.842339][  T433]  ? kasan_save_track+0x3e/0x80
[ 1736.842357][  T433]  ? do_sys_openat2+0xcc/0x200
[ 1736.842373][  T433]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1736.842400][  T433]  do_file_open+0x23e/0x4a0
[ 1736.842422][  T433]  ? __pfx_do_file_open+0x10/0x10
[ 1736.842450][  T433]  ? _raw_spin_unlock+0x28/0x50
[ 1736.842476][  T433]  ? alloc_fd+0x651/0x6c0
[ 1736.842507][  T433]  do_sys_openat2+0x115/0x200
[ 1736.842524][  T433]  ? __pfx_do_sys_openat2+0x10/0x10
[ 1736.842542][  T433]  ? exc_page_fault+0x6a/0xc0
[ 1736.842570][  T433]  ? do_user_addr_fault+0xc4a/0x1340
[ 1736.842594][  T433]  __x64_sys_openat+0x138/0x170
[ 1736.842614][  T433]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1736.842633][  T433]  do_syscall_64+0x174/0x580
[ 1736.842651][  T433]  ? trace_irq_disable+0x3b/0x140
[ 1736.842669][  T433]  ? clear_bhb_loop+0x40/0x90
[ 1736.842691][  T433]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1736.842710][  T433] RIP: 0033:0x7fc6472a7407
[ 1736.842728][  T433] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 1736.842743][  T433] RSP: 002b:00007fff4b720840 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[ 1736.842762][  T433] RAX: ffffffffffffffda RBX: 00007fc64795c880 RCX: 00007fc6472a7407
[ 1736.842776][  T433] RDX: 0000000000000000 RSI: 00007fff4b721f1b RDI: ffffffffffffff9c
[ 1736.842788][  T433] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[ 1736.842799][  T433] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[ 1736.842810][  T433] R13: 00007fff4b720a90 R14: 00007fc647a61000 R15: 0000555a988df4d8
[ 1736.842831][  T433]  </TASK>
[ 1736.842839][  T433] 
[ 1736.847489][  T419] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[ 1736.853265][  T433] Allocated by task 24456:
[ 1736.853281][  T433]  kasan_save_track+0x3e/0x80
[ 1736.853303][  T433]  __kasan_kmalloc+0x93/0xb0
[ 1736.853319][  T433]  __kmalloc_cache_noprof+0x32d/0x660
[ 1736.853343][  T433]  em28xx_v4l2_init+0x103/0x3300
[ 1737.145873][  T433]  em28xx_init_extension+0x120/0x1d0
[ 1737.151161][  T433]  process_scheduled_works+0xa8e/0x14e0
[ 1737.156705][  T433]  worker_thread+0xa47/0xfb0
[ 1737.161289][  T433]  kthread+0x388/0x470
[ 1737.165351][  T433]  ret_from_fork+0x514/0xb70
[ 1737.169924][  T433]  ret_from_fork_asm+0x1a/0x30
[ 1737.174674][  T433] 
[ 1737.176984][  T433] Freed by task 24456:
[ 1737.181043][  T433]  kasan_save_track+0x3e/0x80
[ 1737.185709][  T433]  kasan_save_free_info+0x40/0x50
[ 1737.190724][  T433]  __kasan_slab_free+0x5c/0x80
[ 1737.195472][  T433]  kfree+0x1c5/0x640
[ 1737.199360][  T433]  em28xx_v4l2_init+0x1919/0x3300
[ 1737.204466][  T433]  em28xx_init_extension+0x120/0x1d0
[ 1737.209742][  T433]  process_scheduled_works+0xa8e/0x14e0
[ 1737.215281][  T433]  worker_thread+0xa47/0xfb0
[ 1737.219873][  T433]  kthread+0x388/0x470
[ 1737.223933][  T433]  ret_from_fork+0x514/0xb70
[ 1737.228518][  T433]  ret_from_fork_asm+0x1a/0x30
[ 1737.233276][  T433] 
[ 1737.235589][  T433] The buggy address belongs to the object at ffff888064b30000
[ 1737.235589][  T433]  which belongs to the cache kmalloc-8k of size 8192
[ 1737.249693][  T433] The buggy address is located 2144 bytes inside of
[ 1737.249693][  T433]  freed 8192-byte region [ffff888064b30000, ffff888064b32000)
[ 1737.263653][  T433] 
[ 1737.265972][  T433] The buggy address belongs to the physical page:
[ 1737.272381][  T433] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64b30
[ 1737.281128][  T433] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 1737.289612][  T433] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 1737.297146][  T433] page_type: f5(slab)
[ 1737.301122][  T433] raw: 00fff00000000040 ffff88813fe27280 dead000000000122 0000000000000000
[ 1737.309688][  T433] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 1737.318258][  T433] head: 00fff00000000040 ffff88813fe27280 dead000000000122 0000000000000000
[ 1737.326922][  T433] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 1737.335590][  T433] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 1737.344339][  T433] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 1737.352997][  T433] page dumped because: kasan: bad access detected
[ 1737.359404][  T433] page_owner tracks the page as allocated
[ 1737.365159][  T433] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 398, tgid 397 (syz.4.8494), ts 1734765973324, free_ts 1734762886671
[ 1737.386505][  T433]  post_alloc_hook+0x1f9/0x250
[ 1737.391269][  T433]  get_page_from_freelist+0x21fa/0x2270
[ 1737.396809][  T433]  __alloc_frozen_pages_noprof+0x18d/0x380
[ 1737.402601][  T433]  allocate_slab+0x79/0x5e0
[ 1737.407094][  T433]  refill_objects+0x2d5/0x350
[ 1737.411761][  T433]  __pcs_replace_empty_main+0x2bf/0x6b0
[ 1737.417293][  T433]  __kmalloc_cache_noprof+0x3a7/0x660
[ 1737.422656][  T433]  audit_log_d_path+0xb8/0x1a0
[ 1737.427413][  T433]  audit_log_d_path_exe+0x42/0x70
[ 1737.432428][  T433]  audit_log_task+0x2c3/0x3d0
[ 1737.437090][  T433]  audit_seccomp+0x85/0x190
[ 1737.441577][  T433]  __secure_computing+0x205/0x2b0
[ 1737.446593][  T433]  do_syscall_64+0x10e/0x580
[ 1737.451171][  T433]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1737.457053][  T433] page last free pid 398 tgid 397 stack trace:
[ 1737.463187][  T433]  __free_frozen_pages+0xc1e/0xd10
[ 1737.468303][  T433]  __slab_free+0x274/0x2c0
[ 1737.472706][  T433]  qlist_free_all+0x99/0x100
[ 1737.477288][  T433]  kasan_quarantine_reduce+0x148/0x160
[ 1737.482739][  T433]  __kasan_slab_alloc+0x22/0x80
[ 1737.487573][  T433]  kmem_cache_alloc_node_noprof+0x355/0x610
[ 1737.493461][  T433]  __alloc_skb+0x1d7/0x7a0
[ 1737.497863][  T433]  netlink_ack+0x136/0xb30
[ 1737.502265][  T433]  netlink_rcv_skb+0x2a4/0x4a0
[ 1737.507051][  T433]  netlink_unicast+0x7bb/0x940
[ 1737.511801][  T433]  netlink_sendmsg+0x813/0xb40
[ 1737.516552][  T433]  sock_sendmsg_nosec+0x13a/0x180
[ 1737.521567][  T433]  ____sys_sendmsg+0x54e/0x850
[ 1737.526322][  T433]  ___sys_sendmsg+0x2a5/0x360
[ 1737.530984][  T433]  __x64_sys_sendmsg+0x1b1/0x290
[ 1737.535907][  T433]  do_syscall_64+0x174/0x580
[ 1737.540492][  T433] 
[ 1737.542805][  T433] Memory state around the buggy address:
[ 1737.548418][  T433]  ffff888064b30700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1737.556465][  T433]  ffff888064b30780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1737.564511][  T433] >ffff888064b30800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1737.572562][  T433]                                                        ^
[ 1737.579756][  T433]  ffff888064b30880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1737.587812][  T433]  ffff888064b30900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1737.595856][  T433] ==================================================================
[ 1737.615583][T24456] em28xx 2-1:0.89: Registering snapshot button...
[ 1737.632834][T24456] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input66
[ 1737.707495][T24456] em28xx 2-1:0.89: Remote control support is not available for this card.
[ 1737.716949][T17984] em28xx 2-1:0.89: Closing input extension
[ 1737.726694][T17984] em28xx 2-1:0.89: Deregistering snapshot button
[ 1737.803159][T30161] ipaq 6-1:3.74: PocketPC PDA converter detected
[ 1737.829862][  T433] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 1737.837106][  T433] CPU: 0 UID: 0 PID: 433 Comm: v4l_id Tainted: G             L      syzkaller #0 PREEMPT(full) 
[ 1737.847536][  T433] Tainted: [L]=SOFTLOCKUP
[ 1737.851865][  T433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 1737.861928][  T433] Call Trace:
[ 1737.865221][  T433]  <TASK>
[ 1737.868157][  T433]  vpanic+0x56c/0xa60
[ 1737.872158][  T433]  ? __pfx_vpanic+0x10/0x10
[ 1737.876682][  T433]  panic+0xc5/0xd0
[ 1737.880412][  T433]  ? __pfx_panic+0x10/0x10
[ 1737.884841][  T433]  ? preempt_schedule_thunk+0x16/0x40
[ 1737.890237][  T433]  ? preempt_schedule_thunk+0x16/0x40
[ 1737.895632][  T433]  ? v4l2_open+0x397/0x3a0
[ 1737.900063][  T433]  check_panic_on_warn+0x89/0xb0
[ 1737.905010][  T433]  ? v4l2_open+0x397/0x3a0
[ 1737.909533][  T433]  end_report+0x73/0x170
[ 1737.913795][  T433]  ? v4l2_open+0x397/0x3a0
[ 1737.918219][  T433]  kasan_report+0x128/0x150
[ 1737.922728][  T433]  ? v4l2_open+0x397/0x3a0
[ 1737.927165][  T433]  v4l2_open+0x397/0x3a0
[ 1737.931426][  T433]  chrdev_open+0x4d9/0x600
[ 1737.935861][  T433]  ? __pfx_chrdev_open+0x10/0x10
[ 1737.940816][  T433]  ? fsnotify_open_perm_and_set_mode+0x135/0x6b0
[ 1737.947157][  T433]  ? __pfx_chrdev_open+0x10/0x10
[ 1737.952117][  T433]  do_dentry_open+0x816/0x1380
[ 1737.956909][  T433]  vfs_open+0x3b/0x340
[ 1737.960993][  T433]  ? path_openat+0x2e2d/0x3830
[ 1737.965793][  T433]  path_openat+0x2e44/0x3830
[ 1737.970401][  T433]  ? kasan_save_track+0x3e/0x80
[ 1737.975270][  T433]  ? do_sys_openat2+0xcc/0x200
[ 1737.980055][  T433]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1737.986131][  T433]  do_file_open+0x23e/0x4a0
[ 1737.990626][  T433]  ? __pfx_do_file_open+0x10/0x10
[ 1737.995641][  T433]  ? _raw_spin_unlock+0x28/0x50
[ 1738.000484][  T433]  ? alloc_fd+0x651/0x6c0
[ 1738.004810][  T433]  do_sys_openat2+0x115/0x200
[ 1738.009479][  T433]  ? __pfx_do_sys_openat2+0x10/0x10
[ 1738.014670][  T433]  ? exc_page_fault+0x6a/0xc0
[ 1738.019343][  T433]  ? do_user_addr_fault+0xc4a/0x1340
[ 1738.024619][  T433]  __x64_sys_openat+0x138/0x170
[ 1738.029468][  T433]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1738.035521][  T433]  do_syscall_64+0x174/0x580
[ 1738.040098][  T433]  ? trace_irq_disable+0x3b/0x140
[ 1738.045122][  T433]  ? clear_bhb_loop+0x40/0x90
[ 1738.049791][  T433]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1738.055670][  T433] RIP: 0033:0x7fc6472a7407
[ 1738.060072][  T433] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 1738.079663][  T433] RSP: 002b:00007fff4b720840 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[ 1738.088068][  T433] RAX: ffffffffffffffda RBX: 00007fc64795c880 RCX: 00007fc6472a7407
[ 1738.096028][  T433] RDX: 0000000000000000 RSI: 00007fff4b721f1b RDI: ffffffffffffff9c
[ 1738.103986][  T433] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[ 1738.111942][  T433] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[ 1738.119897][  T433] R13: 00007fff4b720a90 R14: 00007fc647a61000 R15: 0000555a988df4d8
[ 1738.127865][  T433]  </TASK>
[ 1738.131042][  T433] Kernel Offset: disabled
[ 1738.135349][  T433] Rebooting in 86400 seconds..