last executing test programs: 12m18.958288911s ago: executing program 2 (id=5940): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000007280)=[{{0x0, 0x0, 0x0}, 0xe9}, {{0x0, 0x0, 0x0}, 0x20e8bd}], 0x2, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r2, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x70bd29, 0x25dfdbf7, {0x0, 0x0, 0x0, 0x0, 0x2202e}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048050}, 0x40014) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) openat$mice(0xffffff9c, &(0x7f0000000180), 0x2080) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0xff70, 0x0, 0x3, 0xfffffffc}]}) syz_usb_disconnect(r1) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80, 0x80) renameat2(r8, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x7) close_range(r0, 0xffffffffffffffff, 0x0) 12m16.047818371s ago: executing program 2 (id=5947): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff"], 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000007280)=[{{0x0, 0x0, 0x0}, 0xe9}, {{0x0, 0x0, 0x0}, 0x20e8bd}], 0x2, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r2, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff", 0x15) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x70bd29, 0x25dfdbf7, {0x0, 0x0, 0x0, 0x0, 0x2202e}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048050}, 0x40014) openat$mice(0xffffff9c, &(0x7f0000000180), 0x2080) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f000000e0c0)="c6cfdab7e6f83fe5e44dd3a8d886a720a29cfb7e50ef99fcf38be6c3b9a9f8c9fdb7b1332c99b85247977ad2d66a577e6f0853366c7561476cb35cf07e6fc1c21d33853a21771a8835a50d941d35a4ccb511cb67ed64259c99811f0e6f176fba1e0fa45fefe030a588f0cf64895fb12a794fd0bd176a38440328d3c6c24c85f50e95c5190eb03fb04f1eb34cae287ed75c8ca8fab2c04dc1fafa14ef93e2a721a12238700dfdabd057e94e697534e1af81921756270313d22a185c146852a5e94300bc8de9904e8c6948d5d2aed05337b9572ee74b77209c6b4710e87fa6661b19283079a46f70a538d96f484b63171bdc3622fcbab6d9bafeaacd755923209c07b8c2f39c04ea713020bcd9e6f1120ea3fbc8dd0b55986c05aa0c0b13ad52f250e9505ba53a887ed7c857e0f56282d6dd5932930efe384bbb198c50aae4b9a65e6a6ccc2904a9121a28df865011c39a54fb0f890cc1f7ef5f5172754f1c2aa8e8acf8c754f22efa88ffea91f2a14133e0a7a8a06bc80d042ce1affa2ebc74b49b48169404b33c62915e54c554d10bc432ec988f7081a8690335d58d0a819d33296db1377af876d84fd557f9a2018ee91f7d39819fc72b0a9bbdd05d6efe6cc459cd42e16f955dcb1a6a2b8b2a71b3a7e1bfa82816abf8c7d3688d53decbc480eaa3821cef557290284d9c504a63768852e15b39841ef3648f14c7edab006a30c7bd518f300df6ff307c0740150dddfdab1e408edb96b2e6ed612b0bc2fca570fa1813d86160a766fe6c11cdbc7a67014fa7645b4b1d3aad378bcce27aa4725ecf7675b2682cc5a15673136e7181ed5ef122017dc72df65af147dcb9ac702f8a6a2eb3f6824ba7db3c32fa4bfbf63dcd45e42a49b6edee22856fc2a43aeb6a3eea91dbd53a231b559ca7b38564853be3bdee7f820966faa916ed4fd335159328f8b727ba068b0ade0e11c9f2c2af4d5244f5d49f9c9f94105a6fe4c71112bcacf9c3dd2861d06cb3fa6b2159bc2028e513298b594ca7da60f4ed30edd7b066c23ca7d9b7d9555b47e687b43b7b5ca3210d939e34dd3d176d8b3d3d2f32f28518aa8b5169362fee4a4ede7d3d218db0ecc3de14789344df20188d907093bbf621fe67ab2a1f29221b2ec334dadc15345fc829005f4f81fc13ad0f5590742295812a7f2108cbbbc37387a7d4174592bf4f94f272306942e6c44b23e96d92911ef416b4159e81b19f267aad20c2aabf7fd285330cbf4c1bb8ac86493e0ef84de88eb7953fcf833e6cc5ebdd50b706bcc148971d24e9d3736ed66e28f75e6a1e2c9a4e2abba887b27815d2f5739fe5f8afe7240841337bfe7a69308186180fed5736fe3cbc2892cb991d0f4400d66952459c54a16448f06fd49995aa65501631d5c42e2abd8f0d890a6bbe49b384bfe27599afd536493981be5f7dbb15bfbc198fcd8ebfca182c53156742e237df31c1dca495e40cf030623a8a081e3bec3b8e5109ba05c0830ef00ff98a4419bae14762d8e0a790c1d517f1f683bb1712a6a0951f024a46efb5c2122460495fa0f4ebaae86286b8a626be2052874f947f18b0c2860ce681a33d5f4217415363fe7a6f8fca125742f03433988d88a5b8e2bf4f3079eb990b6e1ff381b7199717fb885f4f37351bf18bedbeeca351b7bfca5b791b91be0dcf8d169914c449829669e0577d1ebc4fa783d57e0c695cafae201014831a16d8fec47f22d9b79c2acc820f4dba9d1a2986731681ed1f8dd1e83bc2d491302d2f769e6b0bc470404930cad6511492b3adadc6f5073220590d1ce89a520b6d51d6903dd54360cd7047aed76e0a6cd3c3625e67b7c1636fd627aa48f1ee6dd567730c6ec19d1634f62a77f70c64736532455f0d2ae85003e7bb32f06b480a9f7fba5e6917305fd77e38f6936e49c1a3b2a07e242ccc2f9d629d7992937a035574b3efefd515096e30058cb60cc89d8565205f15e71d805ba5d1c4f7b971918e32bd81611a574fc651bc8094f7f3aef8a3ebf95aef1c062ec66e288b1d1ee17ab75723bc46b031744a25cf055c1bc8b083313e38d0fd5d60e832ef28fbff4c93d2d2ed283575a486167c7158e08fe7094d23984bdf38cf6000db39c5d0f7db72325af909b18247d8fddd89eff8831c294d52194a11dae2339938a79ae903eb63bc6e5535796e1c0416cdad01e1493a3075930a0b3b50ad904ff760bec5c6406b10808bf13251df73b4d6fd149a378ac277ccbbfddd9536abdf5c7a8d29e128a290f0d56c9635540f4c9a3ff1d3e0e2b974b50497ebd690dc9393f8b3acfd1650627db8ab784233727f997dab536f1e993980a41f510fa0128d6bf2c8445ed1578b25a36e05f7170b9fbe8ca63e1b4a7235c27f56790c4dd38168ce26358d12b143e9dbae1d01406778250f1c77c80643016ffd4a7a6703b9c3dfa4e7b51fa1d59605d57c9712159eb34c306a988ac95eeb15c3225ccd022d2ccf5f31a81009d2a25891b83e60efe8f718d6c124202f108d23e5e6c89e269890bda8e5681315db361cdf30e4269f2cb530a188f26621a8b263f22bb385d779b3c4eebd16656451087457892e15074abb1c796f0b7f635b9496f3a17220716c449c11c0e82b67b8f1ee6a2709a20676f40f2751df3d74db503db6cb73c955ae1d6983da44de4d349004f3d9db4ba40124416a67bd18d1d9b3c1e4706ddbb2099a2ae16e99c144860d46ef66bc6844963c0563fe2cb8c4049dea32ce5656fbfec6d1aff7ef48bac92c932c9787d9e4cb0c78fc3d70f730c452c20d077b4d9ea304f1b8a2967b1e7af7f05fd35f84d633bf5095b1af53a506f6f61abc99186eba707843e9db2a18fc1c6c77dd79ab9353eaad6457245709acbe9cb381d4458eb5571fa4f4df069ae668b1df2c97f91271be5fc2040031c3980c7555af2d4186875ea4599c873ffaf47aa08c27a0580ceef6251dce4cfd6eb175a1bf36c1fd750826f4e14966e6f196b68da0a524baf86f49ce8c09430554b50a0b387c02ebd59fae9caa1054cba1304aa6732f3990ce6b7bca6b65237f0fc3c79a102e2989dcf3f884002f2efe83e25a3fb217c24c4f66e0973e7ca62483bb52c943ccfbf31324f2b7938de0555a54f47256c903ab65489906c382d7d1022f7f302b186d18b5775e042ba83b874793420a6d854aaec01e3c819d0b11b51558fb9c10b1e2ff96639fb119d90f80aa302c9a6420b4b1230d79fd1e8105259c4ebf9cc3f1eac67f15bcb9d49ae537084c96994ad08214ac07db663c1bbce6499b5665fb5a949ab3d65062467824a2065a9de2f1edc243e03ad38f0ef227519de50a3dc2e8f4a38538be5557c5de56d0110a0759fe96b0e66d20fcb6066995f77fba9c7468434a53ffffffff000000008bd2ea3b1da2a1178acf50249d77757353943cd126b511098230698782ca88d018381f233f4331d3980f72f30caf915a18794de1253734b89303f25826a80ddd75a9bdf14c6f01690833190872ca5431ab92ab3dca92595983b11de0076125059234720906641119dab9c96be9c10d60fb54267bda61fcb85a491df037cd563b229eea02cd192796d36803b04691d385471a5f68bb76afafe9df28f50dcabfefc8e2eb334bcace928b8eb8f6449116fb5a0fa4a0c51e21b8b1f99308d396db60418cb5385bdf6bce7227e514f6cbc9a9fc50b79e8b0530fd51b21679ea1c404dba52811b3c9487f670e622ac7b1ce8028eadbd882d4325663d8dc4f0960c047c5f3099c90c6256bc11e8eef6b325e0f1ed00279a695f2828762f28ecacdc726aedf42064727ec100ffa74d38d47f383946b9f856e53cb939f98df1bb5af2a12810a619f205e030a302628ffb9b2cfcc2e881e239f33844a118a4de2a5c3d6b857c5105db775a61c5d54d1d82048670e8cd2c44a032904005125eb9f999e845efba3a063e3e26b06298f28799975b51118eece2b7fec02d4b888bfb90919bec287aba71296c66dcf749efa3abcddfccee6ef80d03a1638045f18fb96131cbd9a93e657c29eb74de40f433969e1988ac335bdd9c671b5b75ce6e2440be247775f9d597b4d8523c283e774ed0987e10b88e0c5616720502149db329babc91b225359927f88e0b42f02d41a4c9e0ad7c55a0d2c52cf45da6152c0c742f661b562c3a8ecff1145cac3f63fc053e1a14fe7a57742ab709581604fabe54ff13172b5049434d12f6ed9623265af643f725efea21e2ac1b82365033b9cff4158318f40c8894d2bcffdc954fcf7068c97ca2d2b1bf19b9232b918864e3f63fd59f4c8c578821ec5083e46363d9158451c5a92b425e68081b2c7572df44658a4aae41a439c6bb4bdd2f26ff2a357fa2946e5be5cd97ba25f73bbcc6c05fa966d0aa0cf2e45f22e0021468b37d5afebbfba3233e2cd4fd64e1578be72c38891224cd6c70c4cfd146df6a8142f1493772d48650f8fcbd1435ff704e02ec121e9f43de623eff8070f88a623cd395a02b6b1ffe4ea7ae7f443dc8bdac2cfaa126d4ac9d7788dc972c88fd87d3c8758853f1882532e4ff298b466e7d198daa9015127f2937544b34aaf545f39ee00d74e0e1017a30ff2edff701d53f3a13fc61b31fe7d9032a6c4a517c7527e48c0c44a2beebc9a9f9e6f989bc6c255e05bec5ff99547658143d9eb43a1d96aa5288638b4477aa1f84c59d41194335c09d9d5d660640acb84b53520482fb200ca616e1a6f486e6da3e6721479e85d0676ba142d95ecdf1acc76a49e9bf016f951d8b95adc7e8d4317ddbb28b678135a4a9b98fb8b8b5948b682ee70e04a31f7e3c49c52a11acbb29bd8152bbb4fedd2aae8e7ad5330365213d207677855e6cd72bf93502c14b11bd2f2d6e797efc2cc5bc198730e5cc51c92751ece5c167b3328a6deed4bd73c62623bb3874c9ef18e24997e3ac93b0ad9ca7ddd4c0401ec1b942cb21dfe6abfd3aefe2588ac1684bf6b37dc09d9b9d932d5534c707ef8fe0812a403e057d00955559ca3e0f7e70d3cdfab918b8d125061fd53374c97bd0c9d19e68bacb3db46974d36cb1c96b4475acaf4d46b88a578ed570ce09eb540f30cce4c3f853a9fd669ca36c36ff1f0432713f60e6d6bc789fdae7c7fcf4049e6166b63a12aaa3da6fc35d8783020ceb92f7f90082d4826735618905fc9fdbeb65990882ce130a7e5ebfcdc796ef293019925e80af5074bfed5f62833d9d98e324dd54e30e1d69a15e4beed5da9c6ec01a32978aa29cd26c5703a28e504e7c9264e0421718422b88ef90f6fb4e51c619f29b5fc2f600f88be036eaf28d7f5433715bd493ce55811901a59964f20ac0b06dc3a555eac123c40d3b397053501523a51e8b53a92bbd99ec3bdcd57904cfac3c0d7bcc6613b11a771d32f0f6c60c05449b42820c0a41f757ea1efebebb37f8ea567b2f7dcc4a67ebbdc00716a70f5fe255b9232e27ba05888e034fc50ac0934a43c84577183b83019008edbeb27546e8be7d8402a4c1852198c0e050b96129fd66247c39abff19338300fc3cbe20a395e5805d8bc64c2d87ba27264716e211ab023765e8d454b637aa1320cb18eb4a3dbfa94027a4d75a9a2cc784cbdc22694a8f7e97bd6cea5a4e26b538be9a9dde5637be2d386a85a79ed4df541ab7d0b1370d99d2cfd1f7bf1458bedd0a53f5e6972ee424ed08acb4b49db83cae427d315d1fea4e680258e73b3fc50fdb77692c8798bcda57ac0c34823d69a8ead14c41e9613813838ef80f63138cc9ba3a6b83dfc77b6aa1248678409bd96b64c0b625e88e33262fa0bbee94fec8f3bffedaf8b12d229d0f637848a1dba01892d80f5a5596d37ac1c9c54d32dec3ca56b49aa1157583074af418d0d95a5a46fc3c234814e377963dd4c9c8a5f7cc35aacc892afb9bcede477760688e06f0b2c5a702954f4532c715151eda02f78830129b2612de8fc62fb992d1ba52da164920eb1d1dbc7d1f8f16e31c763581f4c478cf7a84cf01ca904160475a1eabae393bcb852fd550374002bad1ba0827dadcf3f6a2354a3f8f67e6da4f567fe21f55cc34840e79f6af947561c79a141721f6da4625a20fb203f96bd1a3b7322a14a0ab4a38835e1f235f772a18643824cbb9f76664b1212c785055ae17e89f590fdb1b81535e1e3e8a726a9aaf67ae2a8e67eab8f32781bc21027cb1babd932d63bafe7faf48bc57820c5e32288583db4cf369a7fbb479e1e97ca67f63b1880fb33ccf2661d7af9041ea1afc0e90ee0b4b510d094268e4576584a17fcb21b3c3f68bf1e1c4748177cb4cab92df4c254e0d0759d507e5eb096861efcf1aa66805474e3bd32f7055a7d53d47f416d24a5ac7d5fc953206db3a012234d8693e0ff662457ddaf9407a7ade1fa8eaf85b6e1b1456aec3064ee858742f4e22f2d6084e3881a4783b3a9086009202eb6eb77fc1ce2236d6384cbc62c7db9cecd2fdb06f328d49c066562cf1dee863d33b48288fbb1d4d5bcafcd1b6391879e670c7189bbebafe48214d6e2b405e36192e1067eb8d0363777a174e630467673ca968ea51476b0b8a04d598f6fc593d3f3267ab37e17831dab86a67aac3ec8336c5b6e9e416b1f46d0a9e8ec6c515d86e773baa409e2afae30ea1744f2bc777af11c42f2bf6177e95245c6d601f7cb7b589ccda76a2a314dab023da8128c667a0df682f5c7bbf842a2bb51d4d842cd09d02d67444e5d8ae1f3260c4ef2da5a1c4121fdd47e953d03ff6fea10e35db2c0c110704f513b9d1c57c9da80881ced16d92faf1be60471dc4d82529ea50fd6060be18e8e6deffb15e0a0df4e36117dc22d78bd43b3fedb24cba54c2f2e3bba015bc4c817f70fc1e8b21adb04a9d8c229e9ec178fee0f35d4f169bb7dadd14f46ddc13fc62da4e21e42270a4ed0d60b4034db31ee1e13c97d8d941b2627b255d4283cf0af9044a65765ba88dcb2010fae98a6aeb0a5605d8a904d1cfa0cf8fa67a9d29670a108f014a1b21862e20d4f0f3f0cb99c97f289c657dbd08237aba2f616804ebb0e71819fa46df1a018d8336b534391596cd24b0720dd8a95e5c74b9d047da1da93d653b2aa98e67a65c3868a0c464ad24d427c3c81b41f0b2fb78f6aecd5487c29f4fd871bec21f54d22b661eeed67c866cdf057d585beace568ed52a4399dfdcc8c9a80c94f3cb92f0974b9b33ed893e8db33cf95220e03f3d28edd8b80991b0754010e7252392d1e846011defb6c46c73ee015bcb9b288f6945771af90ddd8c548eb6649efff32b0a2b36e743e46135e47fc65d1eb3f7a580104c22bbcc75ec041813cf2496a4793d17112f40333e3c874e0bcbcd889a6bb484e43632b2f9a628a461a2a5d58808b848751642b5c426c50fd82398894dc78c56ed1f0358b626cde2a0167dcb210c8ae2f6d9c95356331cf2a21ed0dfd5165bcac2681ce070f60ffffe69dd75836c4be0aa7f8630bf345a32d246c838552cbb35a6dfdb6ea54c4ecf0ad16990901b7a72280872fc807eda1de4fdce2c223fd089e0f0eac84c1e2980b9b5a032dd1294bd2eb49372f55b9b4cf4d3c1b14050bec1344d71a8316e173bd36f5917100de4dfedfff896517a04468006e5c632c8ad15521324f3abd72545b47df874a4a95d3bb30915ebcc3ed371528f89c7e943286a8cf4ff2cca3f3496ded16b139658bd5d3323ae9007b4dab665cd24e7888735de2cce7bc1b3af39a6d92d787dd237f8d72283f7aab1d99985f3783e5cb0661cadb552293f189f75e7f3fa933c775a27415a3ad22239986364ba7a582f2d9c31e7247aa8d44d5a7e8169fec65daaf62756b34dd307ebc7fbe8a8023aac1553fbf15b48a8ee3bd0c35c7ced684f667500ab2997aa75382475eb35888e72b30ad5aad3910c5ead6797f4182adce92dafc2073f1529ff5f1a42daf3c78e499039864e8e768fb11b33c0d7779e6128579d882761f9b21fcc0696da03eeb049c90b86da8dba548058f0caddb83ec9051a04f3133341e9a17a17b72ac20cd9e242fb383365f6a2f5c795087c7ee682555adadb7305bfe2886a57f3718f30f24b52d481aa35eb2c40417df5ea9d8af1b7b871ce37fb1c84402d269e3a01a5c9a00d3c7d6ff21c90d437066850ea92773288ba925294f9368b74fd1f3c4512800000006b73641507480f3db07634df10fca86bb4431664ade710d5a8894c368660c95f7a0b8ce5ffcdae136b5c8b4ed8c3b4cd9b71079dfd6d1501df9b7f1477b516f3cceecb2def619c05061502b253af7e3deccc839de56292c95a3912e809b100897a85705cf59af66e194143d13c12b6dc1a31cd15a74fe57666931e3fd6b75512d22f063c68576b1bd6a1ab6d7f4065447daee300b7d4fe330daeda866beb44eb8ed4041d0a36bfa49871e0623eb6f5d7b967e8f969985063e2fc4f4097c2a5189b10c1776713f78193c6e0e847025936b36eaa2e817ebb45c375f18350247f6586214a200f2f17536b52b8fa196d4a6a77317807075d130a77badf745a6076b1241e47942501cba893fd0db02545e49f559e9712a60ffce9f3154459c69984de49e11192266196497c81b7c5b45997c1369c8e8490b1a748985fd4c9ab8929d17a51c331dc160c8ae8d2961351ef103e3427299e4f28faff6ac1905be2814cb02511472c7232bd104ac438d846b4a727df2ed24364e061f157c2447e7d5265b1cd75797603e220a9d2e280868f3c2c56befbc6b1b1a07be1070b293adf324b3aee5140ef5f643c952726d9b770989b07f2cdea2e1d6951027e8b386faccff07b2547dd78aa85cc113b599ab168ef602e40fc097396341a8e5b97b59032110ddf114129feaed96e85237bb4bb886b287279b96234c18947ce7d2d5e92dd5c68829edd271bfccff21b87f6a061c9b43b51252add291c8f59be1a222d00fb7719664a8b89c452e78cf1d491a036107f0a521545fd96d2548735847e278065c196153028b91f59c7b70f9883f14cfb3343bb230f4af9bd51132cc62ee5459e34e77bb2983d30e65e65ab769fa0a0578bed01f33c76f4138208659a97fbbf380f1321336c14d21012f3cc4ee2101d42321f0123d51377e319e4ff4551f7f83ca62ff9448a28b6134da582f609be7dea5d70370772ef2552f12e97cf390ee2697022168d622ae0c813d86a43c25c758162ab0aadf25c84c790fb32a459997068be01325e473871cb024ff030070434d197558b8df442e1d2ad0c7b33fe021fa6cd57b7477dd76c6a802ddf405e909d48d23321e986d791b44d32d417d63638246fcdd661e6a1453d1411ec85fa0b750354aecdd4f4b90a420d2d4f67c514f15a8fe590735f660dc5eaa7f2873c7841edaf2c0d46a92fc07c6cd22fc978f74bac72e468d96ba370fb88f9a629d4de0a8a83d43c1949aae33fe24859c1bbf8663adc6936e305cf9c56aacc84e7515caf18d0d049bec2f0a484b75a8c2c23abbca66b039a52e606f08df0a3cdd2dc6449e84ce463206d2878de0e4d0f438764a0fe360e95494e9e61581001785b081254971197024460a68ec029052f2d8841dac7e714798027696067e739cd1525df28ac9514c02e25f8ea1146e356fc5941e4661cd244dccee4a1450e4334a20cb572b842d44a8431abf4d5bb82ac6b78ce3c6d394e5969c6fe8216805f6e2db2889f27849e0dd26a5a387958a36c833a8b3d861033c00ffef267e4b09350ca1b819d5c83025e4ad69328970db92520e6ce569d5632caeb6dc42c8f6f8759256ad9c1ffe8c30a92b795bf00544714c957d5d982a4e91ec7a30dfdcacbd41ceb61f208e5442f7f7ce19ba2f0dddf50020ed1c271afe5007277e2496c3bc7f3101d6fa7f0ea2627a99de0c441a11c6afbb721037dcfc897fc5d9e0ed644b9c3aee328bc2beb3801d2bf43b1e360759c1056c74a63aa33cb6e5933b7a0b4f654113ea5830de7e8374e939e4c794be77f1f0c1e1bcedc8f584a56db0c38b6c8da60bad62b41d754d9b6cbf3379374a6126db0ef1ee2da5862acaf117408ad26c66ec8ee4f9f1844fb4cc64bc61212b303c7c622f05d29b7fd540bdc253bc948d373886e5cd4dc9bc1b551dfc514f12cc64ecc3b276ab43a4adc2142fea9c5ecf983b0841729d1771b51c2ff787ac2439f305ca3fe31cdbe24f034fcd3d41141cc0ed5cdd82e3171be1381ad4f0bf81b3be200524c98cad5a3dee3ee618c97d0678c7b4fbf729dbc2baaa2385fb63e6b906b08681c19d55200924c0edb4c3b48463fd9c2ac86510ce1e0a641def11e9e7b7fa74a629895221b06a15c995cafe55dee6c06e01b34f4f18e5ffeb76ffb412277bdfa4cee10823a1e55832c3d1d19ba5b84560668b33fafc672cfba1a85c60c61c45bd562506d9d28542c4b4795ed011a8005862f7add9dc2533dd29d0ddd534eb0a3b537b391c423b527b3ae4ce0c829a6efcf8671e9e5224df6ed6c1f20452cb46cd578a620788f9af325d45825ced3043ef3693ffebf7b881518ba2c71587251edf150772ae1e24f4415f9d9307151b8fbcb83d0da908f4b6c762b777dc406991353e962f181bc06e892ff9e49e557639dafd09b291f79720b866e46bcf14d5bd1ed15a468a8996ecec8ce3d9890fb45c96804dddfe5b7280c0e30934f129e14b344506f70d484eea40baac63b89dc71b030a6c8149ffca2434c773bffe76bbf2e778f0034666970a96bf336ee5240e765ea3715382bd8fe19c5ce5a8814717d87d4d6304a3b0d6581a6fed44975ef8a8186c19a513f5c6c0610acbd31fd58e2cb683162464cf7f50ade879461ee91f433b09d1febe058c101a0ff96cbffd547c2beab15ca343cfe592ea435f980ff03e0aeadcc80d64383d287997a6a937fc22221cec2a1aa6e8dfc1dc6e0f2e02060a18c09957376a72e165728acddf73873a958f43bcd2e9c6c71a83f744bf14c75f5e8308523a7d39bcbfd832c6597b2928b07630ae50540bb71b44b5b4040a1d172fabe8dbfb96a99e7498b12dcc8ed9e43fb36c202d019b4fbe11f715f5de76bede175c22d8355323eb004c5021d892fbe48fa7b6bf382eb03d0e447a38c63bb7fa1154c2cdf08a1cf5fa95ec75a5aa9037ebf8916cb78e6da650016a0c7ed34290e25e2122be24e4373c49c4fc81c39ec1a1ce4b658e1b80562bf911a1f6a5fc2e69d2554d4abf5ad79d9c9b7d9ac8c4122c11f590a35dcee3fbe185027832b4e2a71ebc591a60bb874b36b415b455bd942fe1a69a92b70ce1a1c867c85138449529cab5f63feab609a2ba3344191c416d8409b59962bcee1c4a40874069e28432fcade20f07c9259dec75fb978a6b84b6e8f50fdb341c7c19f55a8fa389cf085f44661c9618d56d32be0bdb3b2928fc2c372e86ea109afaee022bb832e80e869c7cb1053921b862b27599d3665f7fabfd6436743ea893ec43e4e4daa598127df8ee3249be4668d717117a038f0e734a894457df4c64dd76a9d9d42efc29f2311085c9e6fcef385f40af94f283edca078797e96b79719875aed3900252c3acc6a92e23083b3fa24057d9ebf7886df99d652e7d18cbd445560a0afc81bf7c011777837f94b32094fa1bc99472cc2a40bff245abb27d3f628b1b649fd00", 0x2000, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0xff70, 0x0, 0x3, 0xfffffffc}]}) syz_usb_disconnect(r1) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80, 0x80) renameat2(r8, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x7) close_range(r0, 0xffffffffffffffff, 0x0) 12m12.583230596s ago: executing program 2 (id=5953): syz_usb_connect$hid(0x1, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000000000008700cb6f000000000000109022400010000000009040000010300020009210000000122070009058103"], 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x2100) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000300)={&(0x7f00000001c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_SETPLANE(r1, 0xc03064b7, &(0x7f0000000200)={r2, 0x0, 0x0, 0x0, 0x80000003, 0x80000003, 0x0, 0x0, 0x5, 0x6, 0xc, 0x31e}) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000180)={0x1}) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x800) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f0000000240)={[{0x2, 0x5, 0x9b, 0x1, 0x0, 0x5f, 0x7, 0x20, 0xa6, 0x1, 0x5, 0xd, 0xce}, {0xfffffff9, 0xfffa, 0x7f, 0x0, 0x0, 0x2, 0xc9, 0x0, 0x4, 0xff, 0x4, 0x0, 0x800000000000000}, {0xffffff01, 0x35, 0x0, 0x0, 0x4, 0x4, 0x7, 0xfe, 0x7, 0x8, 0x7e, 0x4, 0x1000000000000007}], 0xcc78}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffc, 0x5, 0x7fff, 0x1000200004, 0x101, 0x2, 0x0, 0x80], 0x8080000, 0x4}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 12m10.299119043s ago: executing program 2 (id=5956): unshare(0x20000400) flock(0xffffffffffffffff, 0x8) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x13f) r1 = epoll_create1(0x80000) r2 = syz_open_dev$dvb_demux(0x0, 0x0, 0x41) socket$packet(0x11, 0x2, 0x300) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000001a40)=[@in={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0x12}}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}}], 0x20) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f00000002c0), &(0x7f0000000040)=0xff56) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB="5c010000100c00e0000001000000000000000000000000fe8000000000000000000000000000aa000000000000000000000000000000001d726fdcd2b420e02fc8d2f0e288152623f6c1ff67b0175e4e21cdd9838c89bb8ef87f5ef2b5d821fe29cdb0d9d331", @ANYRESHEX=r0, @ANYRES32=0x0, @ANYRES16=r2], 0x15c}}, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) unshare(0x2a020400) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x4010, r5, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r5, 0x5008, 0x0) r6 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000040)={0xe}) ioctl$SNDCTL_DSP_GETOPTR(r5, 0x800c5012, &(0x7f0000000200)) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x401}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) r7 = socket$xdp(0x2c, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r8, &(0x7f0000000100)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb", 0x3f}], 0x1) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, &(0x7f0000000540)=ANY=[@ANYRESHEX=r7, @ANYBLOB="1933a927d1af76d06d0834a05e67099724c44428e4c1d7a7a455104449a501ace4465ce67f19edbe7a51419e5503e9d7a0b5ea9505b5419e8a0988683c06883110fb41648f003562a09ed4072877db5fe535d5cf657bce9168f881b02745244d9b7cabd66efd5d442cfbaf9ba22186a64f1ed0332e8f4b8689e229caa1fdce0c76cb2c816c87d9bdad602c94efd95b0c33ee94c3a2f81453390ea7cc7ec4f6e1ffc7db8a40eb5c5f6c3dc409aba0d174d397515bea2454e6579bbcd9309e6bf4a83a8947595952655b234e35f96fa49b389ec30bda9307c25bfa3b527464b54e91e529f726bb82922a0430c557c33070a2cf8585e5eb212d", @ANYRES8=r1, @ANYRES16=r7, @ANYRESDEC]) 12m9.54631784s ago: executing program 2 (id=5958): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20, @local}, 0x10) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socket$inet6_mptcp(0xa, 0x1, 0x106) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r2}, 0x38) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f00002bf000)='GPL\x00', 0x4, 0x436, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffc95}, 0x48) r5 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000180)={r0, r4}) sendmmsg$inet(r5, &(0x7f0000001500)=[{{0x0, 0x100000019, &(0x7f0000000b00)=[{&(0x7f00000002c0)="89", 0x34000}, {0x0}], 0x2, &(0x7f0000000e40)=ANY=[], 0xd0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x40) recvmmsg(r5, &(0x7f0000000940)=[{{0x0, 0x0, 0x0}, 0x6}], 0x31680, 0x40000000, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/ip_tables_names\x00') preadv(r6, &(0x7f0000000080)=[{&(0x7f0000000040)=""/5, 0x5}], 0x1, 0x9, 0x0) 12m8.518334102s ago: executing program 2 (id=5961): r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r0, 0xc0040d07, &(0x7f0000000040)=0x121) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) bind$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000040)=@assoc_value, 0x0) socket(0x2, 0x80805, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x2, 0x89, 0x8, 0xb319, 0x3}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x6000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x303}, "bc86299ab62e97b6", "2125e44cdf02000000000000003297f0", "8fc203e0", "c40330604dc13bd4"}, 0x28) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r5}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}}) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000200)={{0x84, @empty, 0x4e21, 0x3, 'lc\x00', 0xc, 0x9, 0x63}, {@private=0xa010102, 0x4623, 0x4, 0x100000cd, 0x12d5f, 0x3}}, 0x44) ioctl$int_in(r3, 0x5421, &(0x7f0000000140)=0xffff) writev(r3, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) mbind(&(0x7f00001ae000/0x1000)=nil, 0x1000, 0x4002, &(0x7f0000000200)=0x2001000000000004, 0x8000, 0x7) 11m53.229125329s ago: executing program 32 (id=5961): r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r0, 0xc0040d07, &(0x7f0000000040)=0x121) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)) bind$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000040)=@assoc_value, 0x0) socket(0x2, 0x80805, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x2, 0x89, 0x8, 0xb319, 0x3}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x6000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x303}, "bc86299ab62e97b6", "2125e44cdf02000000000000003297f0", "8fc203e0", "c40330604dc13bd4"}, 0x28) r4 = add_key$user(&(0x7f0000000380), &(0x7f0000000000), &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r4, r5, r5}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}}) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000200)={{0x84, @empty, 0x4e21, 0x3, 'lc\x00', 0xc, 0x9, 0x63}, {@private=0xa010102, 0x4623, 0x4, 0x100000cd, 0x12d5f, 0x3}}, 0x44) ioctl$int_in(r3, 0x5421, &(0x7f0000000140)=0xffff) writev(r3, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) mbind(&(0x7f00001ae000/0x1000)=nil, 0x1000, 0x4002, &(0x7f0000000200)=0x2001000000000004, 0x8000, 0x7) 4m44.807894809s ago: executing program 3 (id=7378): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffe71, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYRESOCT=r0, @ANYBLOB="dd9fa16509dae006e597b20c527a202a2bca009069a07c2c8819f70b1cff6c8601d57a6e23139ec4ea3d7ffeb81a150fde060b0926854541256abe7dad55d3781195573ca7dbfea604f824b320eb03125435faa1e140ec3a5a37b30784c73573f4ef78d914106d533cf090dc1697", @ANYBLOB="b88ad86966ae6095a1c0bf465ae73d46d7228e5e59c3e43faeafcfa55aa19b38c1b0d37f3d7c30e1a4ec21ab75d52977ab14dc3500a907efca3d6c61c5d9f5693e591e9dd0d0696231f4931d2c709768fcf675ee1e46572b27a7cac5212ac5360bdad444be472afbefe1048753c850f8c7b2e7e808590db9a492ec53d60496c1188374ea6ad1a710ffd2896c04ae61fe4681d4fe012db87f89bc49599ec7e78803853d574d9247f65a9f"], 0xa8}, 0x1, 0x0, 0x0, 0x850}, 0x4000000) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r2 = syz_open_dev$dvb_dvr(&(0x7f0000001040), 0x0, 0x100) r3 = fcntl$dupfd(r2, 0x0, r2) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r3, 0x40047211, &(0x7f0000000000)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) io_setup(0x23, &(0x7f0000000280)=0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) io_submit(r4, 0x1, &(0x7f0000000700)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r5, 0x0}]) ioctl$BINDER_WRITE_READ(r5, 0x40046208, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r6, 0x4008af13, &(0x7f0000000340)={0x1, 0xffff}) read$FUSE(r3, &(0x7f0000001340)={0x2020}, 0x2020) 4m43.783630267s ago: executing program 3 (id=7382): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0x42, 0x4, 0x370, 0xffffffff, 0x2d8, 0x1e0, 0x100, 0xffffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11, 0x0, 0x40}, 0x0, 0xd8, 0x100, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0xffffffff, 0x0, 0x3, 0x0, 0xa}}, @common=@unspec=@owner={{0x38}, {0x0, 0xffffffffffffffff, 0x0, 0xee00, 0x5, 0x6}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0xb8, 0xe0, 0x0, {}, [@common=@unspec=@ipvs={{0x48}, {@ipv6=@local, [0x101, 0xffffffff, 0x0, 0xff000000], 0x4e24, 0x5c, 0x7, 0x4e24, 0x10, 0x21}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="10797fcd6cd957d2b903c6bf46b4abf3629ff075475e4bd6e43be1712bf80e2fb5d2b3f56d18ba2c8b06e00435e4b4dc", 0x30) r2 = accept$alg(r1, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4000800}, 0x4048002) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x0, 0x0) getdents64(r3, 0x0, 0x0) getdents64(r3, &(0x7f0000000440)=""/231, 0xe7) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x70, r4, 0x8, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000}], 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) recvmsg(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000680)}, 0x21) syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ef960b40b113420003510102030109022400010000000009049300"], 0x0) 4m42.377217261s ago: executing program 3 (id=7384): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a85321, &(0x7f0000000700)={{0x17, 0x5}, 'port1\x00', 0x62, 0x10001, 0x23, 0x3, 0x9, 0xffffffff, 0x0, 0x0, 0x0, 0x40}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = eventfd2(0xfffffffd, 0x80800) fsetxattr$security_ima(r4, &(0x7f0000003980), 0x0, 0x0, 0x3) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x3, 0xa, 0x99, '\x00', 0xe}) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000840)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34cf2645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6424923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff0000f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) pwritev(r1, &(0x7f00000006c0)=[{&(0x7f0000000500)="7d1ab0f52447a81786e4f6c9fc11c710edfa8e83908a35cc993461e3671746e297cfd6610b5fdcf9aa1bc63037fa1104a83b57d5f0f91d455062a73ba6e18359f2172bed543b78fed43acb0c56ce30174325d9da815225d1abfaa884110c6563e36663e185f0f675c590f4e9dce62e04f2597ba75b3f7e1eb0edd57f82e6052ebb468c473f93af3f619a06a6cd3964a861288164fcb3dc255b364a684edc8c96d22bfa553aed32e5e430338baa6f92b46b90dee8d561d4d10cca4b98ff8fb826a4acfa9888ed10de5f137d789041d39916f38f3be04e70e8f4f3f12377bab815fa2210", 0xe3}, {&(0x7f0000000600)="d6fe8ec52bbc3aca8a17317c3d385622aaca42ac77a904e61277a5b8979971e6bea77948e1d69307c04af6932c350664926b978e3f4990299dce6550e3d1567061b736bb6863405c0119a2ae450361f7", 0x50}, {&(0x7f0000000680)="503a079da611", 0x6}], 0x3, 0x1000, 0x9) syz_usb_control_io(r0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r5, 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000340)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x380000b, 0x204031, 0xffffffffffffffff, 0x5e9b7000) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000000), 0x0, 0x0) ioctl$DVB_DVR_DMX_SET_BUFFER_SIZE(r6, 0x6f2d, 0x7fffffffffffffff) ioctl$DVB_DVR_DMX_SET_BUFFER_SIZE(r6, 0x6f2d, 0xcb) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$KVM_TRANSLATE(r3, 0xc018ae85, &(0x7f0000000040)={0xffff1000, 0x8000000, 0x32, 0x4, 0x4}) 4m39.060888955s ago: executing program 3 (id=7390): r0 = socket(0x2, 0xa, 0x300) r1 = semget(0x1, 0x4, 0x39c) semop(r1, &(0x7f0000000080)=[{0x1, 0x5b7a, 0x800}], 0x1) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) r2 = gettid() ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) futex(&(0x7f000000cffc)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@ipv6_newnexthop={0x1c, 0x68, 0x1, 0x70bd28, 0x25dfdbfc, {0xa, 0x0, 0x5, 0x0, 0x4}, [@NHA_FDB={0x4}]}, 0x1c}, 0x1, 0x20000, 0x0, 0x24044855}, 0x9080) semop(r1, &(0x7f0000000280)=[{0x1, 0xbbdd, 0x1000}, {0x2, 0x0, 0x800}], 0x2) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000500)=[0x31f, 0x9, 0x78, 0x4, 0xef8e, 0x8]) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x30, 0x5, 0x4, 0xfffff034}, {0x6, 0x1, 0xff, 0x6}]}, 0x10) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)}, {&(0x7f0000000480)}, {0x0}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff35", 0x26}], 0x4}}], 0x1, 0x20000044) r4 = socket$alg(0x26, 0x5, 0x0) ptrace$PTRACE_GETSIGMASK(0x420a, r2, 0x8, &(0x7f0000000300)) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46", 0xb5}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_SECCOMP(0x4e, 0x2, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000040)={0x14, 0x76, 0x31f, 0x0, 0x0, "", [@nested={0x4, 0xd}]}, 0x14}], 0x1}, 0x4000000) 4m37.9586211s ago: executing program 3 (id=7393): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff038}, {0xb1, 0x0, 0xfe, 0xfffff00c}, {0x6, 0x0, 0x1}]}, 0x10) sendmmsg(r0, &(0x7f0000000180), 0x4000190, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200201, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00'}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r4, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000000)={r7, 0x2}, 0xc) ioctl$KVM_X86_SET_MSR_FILTER(r3, 0x4188aec6, &(0x7f0000000bc0)={0x0, [{0x1, 0x0, 0x805, 0x0}, {0x2, 0x0, 0x81, 0x0}, {0x0, 0x0, 0x80, 0x0}, {0x2, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x7ff, 0x0}, {0x2, 0x0, 0xc, 0x0}, {0x3, 0x0, 0x7, 0x0}, {0x0, 0x0, 0x200, 0x0}, {0x0, 0x0, 0xb, 0x0}, {0x2, 0x0, 0xf, 0x0}, {0x3, 0x0, 0x3, 0x0}, {0x1, 0x0, 0x8000, 0x0}, {0x2, 0x0, 0x70a, 0x0}, {0x3, 0x0, 0x1cf9571d, 0x0}, {0x2, 0x0, 0xe16, 0x0}, {0x4, 0x0, 0x9, 0x0}]}) close(r3) syz_clone(0x623f, &(0x7f00000006c0), 0x0, 0x0, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c0000000706010800000000000000000000000005000100060000007dc9fcbd3b43e1"], 0x1c}}, 0x0) 4m36.92971734s ago: executing program 3 (id=7395): openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0x2, 0xa, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x0, 0x8, 0x0, 0xfff}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x36) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2642, 0x0) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000100)="93d90400", 0x4}, {0x0}], 0x2) read$rfkill(r3, &(0x7f0000000240), 0x8) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x100000) creat(0x0, 0xecf86c37d53049c4) socketpair$unix(0x1, 0x3, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x10f) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7a0af8ff7525757cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c80000040000000000b1a297cfddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1ae9f2cfe401dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd853eb3f12225bfcca581f04f317c8301b43267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4800b3c26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692f01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75b"], &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x600, 0x4000000}, 0x28) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, &(0x7f00000002c0)=""/251, &(0x7f0000000940), &(0x7f0000000200), 0xa7c, r4}, 0x38) close_range(r0, 0xffffffffffffffff, 0x0) 4m29.114147158s ago: executing program 1 (id=7414): r0 = syz_usb_connect(0x3, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = semget(0x1, 0x4, 0x69c) semop(r3, &(0x7f0000003640)=[{0x1, 0x8004, 0x1000}, {0x1, 0x5b7a}, {0x1, 0xa4c3, 0x1800}], 0x3) syz_usb_ep_write(r0, 0x5, 0x5b, &(0x7f0000000540)="b8b2cd9d4b0126c077a413676f9aaadc4f7480434a501e7802e0e001b1e78fc4a282a461c8430f21501de3a79ad9e3b8356231b1e469bcc81a3f0a4ef3108aac07dd6bbba3afc448f064d4979bc7269d2f7ef395cf7fdf25d227f9") semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000140)=[0x6, 0x7fff]) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000f40)=ANY=[@ANYBLOB="12010000dc3f6e4013080100083a000000010902120001000000000904"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$uac1(r5, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$rtl8150(r5, &(0x7f00000005c0)={0x14, &(0x7f0000000280)={0x40, 0x7, 0x2c, {0x2c, 0xc, "3ac617672f9314c62fc283558554a492a204e173c8da7a463d03edda9d8a89f00e985938aa8866a8860c"}}, &(0x7f00000002c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x43e}}}, &(0x7f0000000840)={0x2c, &(0x7f0000000600)={0x40, 0x5, 0x46, "ac45d4d61155be114f941566318606dc8ca9473227d1d222791eefc0e3d4ce7e5924903445e11a4797b8ff3c30b799df6384cdbe8429d7f131e06005aff273c7608786f600c6"}, &(0x7f0000000740)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000780)={0x0, 0x8, 0x1, 0x5}, &(0x7f00000007c0)={0xc0, 0x5, 0x6, "16db43f83f94"}, &(0x7f0000000800)={0x40, 0x5, 0x6, "513255db7064"}}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001740)=ANY=[@ANYBLOB="20000000020103000000000000000000020000080c00198008000280"], 0x20}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0xd, 0x1, 0x3, 0x8, 0x0, 0x1, 0x6}]}) socket$nl_generic(0x10, 0x3, 0x10) pipe2$9p(&(0x7f0000000000), 0x80000) open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x94) syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) 4m26.889531641s ago: executing program 1 (id=7420): ioctl$XFS_IOC_FSGEOMETRY_V4(0xffffffffffffffff, 0x8070587c, &(0x7f0000000140)) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_PEC(r0, 0x708, 0x6) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000080)={0x1, 0x6, 0x2, &(0x7f0000000040)={0xc, "810556c721393f4084c89ea7f77d040b00"}}) 4m26.202986538s ago: executing program 1 (id=7422): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) listen(0xffffffffffffffff, 0x8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) socket$netlink(0x10, 0x3, 0x13) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000200), 0xfffffd9d) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x3c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x1a, 0x3, "91abc12404cf378042f26c43f91f68d8a90767c0bc71"}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x9}], {0x14}}, 0x98}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f00009c0000/0x1000)=nil, 0x1000, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000280)={&(0x7f00000059c0), 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r4) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x4000004) unshare(0x1e000980) 4m24.138965128s ago: executing program 1 (id=7429): r0 = epoll_create(0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={&(0x7f0000000240), &(0x7f00000004c0)="4700f5bca90981bec46f235d2b94338d0b67f7b8edf6a8daf7bcdfc33d61c86da85ef6ab3a1814c353b29a1e8101001b3937cba52575c8a9381e2aa5d1e16ba94c4cfef9d6e1ea95257255b17bf726c6520b9ec2652d2843dd9d47e742d62d87beed8688fa4d60aefe31480adc067727a439c8db0881f3c6f463062dba2be916471ae7bd8a5707c29f0a623c5b5131c31ae6377b12aeeba163471dc4ec9cd9e85511cdafdd285c75c5ec3edbe89e6f364614be9d5c518d2e0d33b4677f4115c0a7bc422b85b63d37087c8bf589ad7c6eeec1b1762b48166da40ccdd56bf21efcdb6ec594ae83e0253bf7602e7b6307911ee3df378a"}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, &(0x7f0000000140), 0x0, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) recvfrom(r2, &(0x7f00000022c0)=""/4089, 0xff9, 0x3, 0x0, 0x0) sendto(r2, &(0x7f0000000380)="9e48ab8865f896d107e92a61856dee35f0f34ae91910a2ca1f620fb03aea81cc28872bcf0b56a02728c642262a310d41842a2f56f6991732eea3b4fe189df3e6d196910683f56c329d65d625c946dfffdf9466dd89c14588ad744d87f33f05e95dc6b08af178be974654c2f52e24b20f380b3ae1480da85a4ab367134f277b359aa5adafc61240d0", 0x88, 0x8001, 0x0, 0x0) r3 = syz_open_dev$vim2m(&(0x7f00000005c0), 0x5, 0x2) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f00000000c0)={0x10000009}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x25, 0x0, &(0x7f0000001300)="b461802305624431ed33730100010446b20aed0200000000000000d5fe00c6fc6ef8eef975", 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd}, 0x50) r4 = syz_open_dev$sg(&(0x7f0000000280), 0xdd4, 0x3b1042) ioctl$FIOCLEX(r4, 0x5451) r5 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r5, &(0x7f0000000080)={&(0x7f0000000140)={0xa, 0xb, 0x5, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="280000000000000029000000390000003a0202"], 0x28}, 0x922bac8576bdadce) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000600)={{{@in6=@local, @in6=@empty}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f00000002c0)=0xe8) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'gre0\x00', &(0x7f0000000440)={'gretap0\x00', 0x0, 0x8000, 0x8000, 0x4, 0x100, {{0xe, 0x4, 0x2, 0x8, 0x38, 0x67, 0x0, 0x3, 0x4, 0x0, @local, @loopback, {[@cipso={0x86, 0x6, 0x3}, @rr={0x7, 0x3, 0x68}, @timestamp={0x44, 0x18, 0x4c, 0x0, 0x9, [0x78f, 0x900, 0x20000002, 0xf, 0x4]}]}}}}}) clock_adjtime(0x4, &(0x7f0000000000)={0x1ff, 0x10000, 0xffffffffffffeffd, 0x0, 0x100000003, 0x3, 0x8000006, 0x8000000000000, 0x2000000000000c96, 0x3, 0x3, 0x7ffd, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x20000000000, 0x0, 0x0, 0x4, 0xffffffff, 0x0, 0x3, 0x6, 0x0, 0x1000}) r9 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8002) r10 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r10, &(0x7f0000000140), 0x10) sendmmsg$sock(r10, &(0x7f0000000c40)=[{{&(0x7f0000000180)=@hci={0x1d, 0x1, 0x2}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000480)="024468f75872dcc35c4a865167ce141180f86d6d2d2b667592a3c33936463143e7bb6e42171be6f3bb2c71676866c351e658a3e643566881df0577a462feffaafa974e3e86995e3ae7dbd8b6bc88af335ebe083ced9a2b1f3b847103b7af298aabf2f341cf7c9d27d81972b94be151e7a3c9487c087f8a25000000000000", 0x7e}, {&(0x7f0000000bc0)="da653e6368ca3086947a7cd9f675fec207fa0522eb427678a26306d4d58e3174157055bad9d94baf2b8a476ed0798d94173e4d6a8c03e3ad87f36f69e2d254f2fc17dc5260b177829e93e8de0efe7be1837255949efb5d662b4b", 0x5a}], 0x2}}], 0x1, 0x200000c1) ioctl$SCSI_IOCTL_GET_PCI(r9, 0x5393, &(0x7f0000000000)) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x400a044}, 0x20004090) 4m23.084290596s ago: executing program 1 (id=7432): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)='\\', 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000140)=0x1e) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r4, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x1fc}, 0x1c) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) close(0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000009c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x10}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x40003}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x9, 0x1dc, 0xf8f7, 0x1, 0x3, 0xfff}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {}, {0x4, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80000000, 0x7, 0x3, 0x7}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 4m22.266930014s ago: executing program 1 (id=7433): openat$binfmt_format(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0x2, 0xa, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x0, 0x8, 0x0, 0xfff}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x36) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2642, 0x0) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000100)="93d90400", 0x4}, {0x0}], 0x2) read$rfkill(r2, &(0x7f0000000240), 0x8) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x100000) creat(0x0, 0xecf86c37d53049c4) socketpair$unix(0x1, 0x3, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) ioctl$TUNSETLINK(r4, 0x400454cd, 0x10f) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7a0af8ff7525757cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c80000040000000000b1a297cfddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1ae9f2cfe401dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd853eb3f12225bfcca581f04f317c8301b43267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4800b3c26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692f01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f7e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c662003"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x600, 0x4000000}, 0x28) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, &(0x7f00000002c0)=""/251, &(0x7f0000000940), &(0x7f0000000200), 0xa7c, r3}, 0x38) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 4m21.542437288s ago: executing program 33 (id=7395): openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0x2, 0xa, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x0, 0x8, 0x0, 0xfff}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x36) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2642, 0x0) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000100)="93d90400", 0x4}, {0x0}], 0x2) read$rfkill(r3, &(0x7f0000000240), 0x8) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x100000) creat(0x0, 0xecf86c37d53049c4) socketpair$unix(0x1, 0x3, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x10f) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7a0af8ff7525757cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c80000040000000000b1a297cfddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1ae9f2cfe401dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd853eb3f12225bfcca581f04f317c8301b43267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4800b3c26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692f01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75b"], &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x600, 0x4000000}, 0x28) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, &(0x7f00000002c0)=""/251, &(0x7f0000000940), &(0x7f0000000200), 0xa7c, r4}, 0x38) close_range(r0, 0xffffffffffffffff, 0x0) 4m7.143100636s ago: executing program 34 (id=7433): openat$binfmt_format(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0x2, 0xa, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x0, 0x8, 0x0, 0xfff}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x36) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2642, 0x0) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000100)="93d90400", 0x4}, {0x0}], 0x2) read$rfkill(r2, &(0x7f0000000240), 0x8) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x100000) creat(0x0, 0xecf86c37d53049c4) socketpair$unix(0x1, 0x3, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) ioctl$TUNSETLINK(r4, 0x400454cd, 0x10f) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7a0af8ff7525757cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c80000040000000000b1a297cfddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1ae9f2cfe401dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd853eb3f12225bfcca581f04f317c8301b43267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4800b3c26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692f01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f7e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c662003"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x600, 0x4000000}, 0x28) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, &(0x7f00000002c0)=""/251, &(0x7f0000000940), &(0x7f0000000200), 0xa7c, r3}, 0x38) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2m33.72178849s ago: executing program 0 (id=7713): ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$mouse(&(0x7f0000000140), 0x5ca1, 0x101000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1}, 0x6e) socket$inet(0x2, 0xa83739fbd7f17ff0, 0xb) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f00000005c0), 0x0) futex(&(0x7f000000cffc)=0x1, 0xc, 0x1, &(0x7f0000000040), &(0x7f0000048000), 0x1) 2m32.665215804s ago: executing program 0 (id=7719): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) socket$netlink(0x10, 0x3, 0x13) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000200), 0xfffffd9d) 2m30.288713537s ago: executing program 0 (id=7722): socket$unix(0x1, 0x1, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x45, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x6, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x3, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0xfd71, 0x0, 0x8, 0x9, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2, 0xfffffffc, 0x5, 0x0, 0x0, 0x7, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x6, 0x7, 0x6, 0x400, 0x401, 0x6, 0x800, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x4e0, 0x4381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x47, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x2, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbb, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x200807ff, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x4, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x4184, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x10002, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000080)=0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r1 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000e00)="39000000140081ae00002c000500015601618575e285af01800000000d1300883795c04a31ba377a1b2cc37fffffffffffffffffffffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x2000c814) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r3, 0xc0884123, &(0x7f0000000280)={0x0, "728d0a484585ec93a59baeb6831baff110181595fe49b4c9c10b675a525115cc71983456358ceb7e1a6f926168ce0c3c2b0f3513a5f267418500", {0x6, 0x50000000008}}) 2m30.033356886s ago: executing program 0 (id=7724): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001f0000), 0x1020082, 0x0) r1 = dup(r0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f00003b6000/0x4000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000173000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1e64, &(0x7f0000000040)={0x0, 0xc899, 0xc000, 0x1, 0x65}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000880)=@raw={'raw\x00', 0x8, 0x3, 0x2b0, 0x0, 0xffffffff, 0xffffffff, 0xf8, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0={0xfc, 0x0, '\x00', 0x1}, [], [0x0, 0x0, 0x0, 0xff], 'batadv0\x00', 'wg1\x00', {}, {}, 0x6}, 0x0, 0xd0, 0xf8, 0x0, {0x0, 0x4c00}, [@common=@inet=@ecn={{0x28}, {0x20, 0x20, 0x1, 0x8}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x0, 0x0, 0x0, 0x3]}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff0}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0x1) 2m29.428111539s ago: executing program 0 (id=7725): socket$nl_generic(0x10, 0x3, 0x10) preadv2(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000001200)=""/4096, 0x1000}], 0x100000000000000d, 0x0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118db, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x5e}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, 0x1c) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x440c1) setsockopt$inet_udp_int(r2, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4) sendmmsg$inet(r2, &(0x7f00000006c0), 0x0, 0x48055) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000003c0)=[{0x0}], 0x1) socket$nl_rdma(0x10, 0x3, 0x14) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r7, 0x40045431, 0x0) r8 = add_key$keyring(&(0x7f0000000080), &(0x7f00000003c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000001580)='asymmetric\x00', 0x0, &(0x7f0000000400)="303e30000000000002d190c937dc6914243b0402d6dcb7154fe6727ae888746b024ee670a5882a0ad79716bb4e5704b7f62edac751478af9c62f000000ca321d", 0x40, r8) syz_open_pts(r7, 0x40) unshare(0x2040400) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r9, &(0x7f00000004c0)=[{&(0x7f0000000340)="a0", 0x1}], 0x2be, 0x4) 2m27.004563403s ago: executing program 0 (id=7735): socket$inet_udp(0x2, 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x0) sync() sync() sync() sync() sync() r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)={0x14, r2, 0x1, 0x0, 0x25dfdbfd, {0x54}}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x8000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6000400000280601fe880000000000000000000000000101fe8000000000000000000000000000aa4e244e2824a81205c9e666b1facb9c599178e6b74bbf9caa64df3f0952e763c88d8b6474932f99d7732cdc4e0682f2945ac33a77", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a0000002907800001312d4c466fb19f71e96642faa23000000000000"], 0x0) ioctl$TIOCGICOUNT(r0, 0x5409, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x3, 0x2}, 0x18, 0x0) landlock_restrict_self(r4, 0x9) socketpair(0x2a, 0x6, 0x7154e981, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r6, &(0x7f0000000080), 0x51) ioctl$USBDEVFS_CLEAR_HALT(r6, 0x80045515, &(0x7f0000000000)={0xa}) ioctl$sock_inet_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000000080)={'ipvlan0\x00', {0x2, 0x4e20, @local}}) 2m11.815453238s ago: executing program 35 (id=7735): socket$inet_udp(0x2, 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x0) sync() sync() sync() sync() sync() r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)={0x14, r2, 0x1, 0x0, 0x25dfdbfd, {0x54}}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x8000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6000400000280601fe880000000000000000000000000101fe8000000000000000000000000000aa4e244e2824a81205c9e666b1facb9c599178e6b74bbf9caa64df3f0952e763c88d8b6474932f99d7732cdc4e0682f2945ac33a77", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a0000002907800001312d4c466fb19f71e96642faa23000000000000"], 0x0) ioctl$TIOCGICOUNT(r0, 0x5409, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x3, 0x2}, 0x18, 0x0) landlock_restrict_self(r4, 0x9) socketpair(0x2a, 0x6, 0x7154e981, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r6, &(0x7f0000000080), 0x51) ioctl$USBDEVFS_CLEAR_HALT(r6, 0x80045515, &(0x7f0000000000)={0xa}) ioctl$sock_inet_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000000080)={'ipvlan0\x00', {0x2, 0x4e20, @local}}) 16.415198115s ago: executing program 5 (id=8100): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) socket$netlink(0x10, 0x3, 0x13) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000200), 0xfffffd9d) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x3c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x1a, 0x3, "91abc12404cf378042f26c43f91f68d8a90767c0bc71"}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x9}], {0x14}}, 0x98}}, 0x0) madvise(&(0x7f00009c0000/0x1000)=nil, 0x1000, 0xc) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000280)={&(0x7f00000059c0), 0x0, 0x0, 0x0}) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x4000004) unshare(0x1e000980) 11.897007765s ago: executing program 5 (id=8117): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00', 0x19}) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x4) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_DEV_DESTROY(r0, 0x5502) 9.689251312s ago: executing program 5 (id=8126): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="785865001000830404000000fedbdf2500007400", @ANYBLOB="0008000007500500580012800b0001006272696467650000480002"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) 8.57677876s ago: executing program 5 (id=8129): unshare(0x64000600) syz_usb_connect$lan78xx(0x0, 0x3f, &(0x7f0000000440)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x35, [{{0x9, 0x2, 0x2d}}]}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xfffffffffffffe00, &(0x7f0000000300)={&(0x7f0000000200)={0x28, r1, 0xacf5e67dd0b583a1, 0xffffffff, 0x0, {{0x5}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0xfff, 0x55}}}}}, 0x28}}, 0x4c044) (async) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xfffffffffffffe00, &(0x7f0000000300)={&(0x7f0000000200)={0x28, r1, 0xacf5e67dd0b583a1, 0xffffffff, 0x0, {{0x5}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0xfff, 0x55}}}}}, 0x28}}, 0x4c044) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r0) creat(&(0x7f0000000400)='./bus\x00', 0x0) (async) r3 = creat(&(0x7f0000000400)='./bus\x00', 0x0) r4 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000340)={r4}) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e3, &(0x7f0000000180)={r3, r3}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x88}}, 0x0) (async) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x88}}, 0x0) r7 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0xfffffffe, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000980)=@IORING_OP_SEND_ZC={0x2f, 0x0, 0x28, 0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x0}, 0x5, 0x4800}) (async) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000980)=@IORING_OP_SEND_ZC={0x2f, 0x0, 0x28, 0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x0}, 0x5, 0x4800}) syz_ublk_add_dev(r7, r8, r9, r10, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) set_mempolicy(0x8000, &(0x7f0000000000)=0x7, 0x9) 8.575319468s ago: executing program 6 (id=8130): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000680), 0x200202, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x9, 0x0, 0x7ffffdbd}]}) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000200)={0x80, 0x0, r1}) r4 = shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmdt(r4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f00000001c0)={0x1, 0x1, [0xf74, 0x4e0, 0xe4b, 0xa20]}) r5 = syz_io_uring_setup(0x617a, &(0x7f00000005c0)={0x0, 0x137c, 0x20000, 0x1, 0x15a, 0x0, r3}, &(0x7f0000000340), &(0x7f0000000380), &(0x7f0000000640)) io_uring_enter(r5, 0x542d, 0xeab9, 0x0, &(0x7f0000000400)={[0x1ff]}, 0x8) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() r6 = fsopen(&(0x7f00000000c0)='romfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0x0) io_submit(r0, 0x0, 0x0) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYRES64=r0, @ANYRES64=r0], 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000340)={0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="2006bf"], 0x0, 0x0}) 6.803969202s ago: executing program 5 (id=8138): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x4c, 0x0, 0x1, 0x1000, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x87}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24040000}, 0x4800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0xfffffffe}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42400, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x42000, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$cgroup_ro(r0, &(0x7f0000000200)='blkio.bfq.io_service_time_recursive\x00', 0x0, 0x0) write$UHID_INPUT(r4, &(0x7f00000011c0)={0x8, {"2301b42607f4e72cce88042bbbb37fca275cf8edea71739af501be505ccdcbb2265e84a3db48ce2124c440d007814228f8c32030941bc8330cc911f3f7f2966d539f8056d197c2665beb8f5a1f1b554a3f20c6627d8d69aa1e50042489c87d62665398c5c29f813451cb04ac6bcdd1d5f2a57856adde8652eb9ff15421333fe36321283a4b1c2fe2b5b8e42c8dfb2405ee5b3817190690a2cf79e8c8d93bc92a8c644908fa9c67935d97f45491c69774ca776b5a9100f45eef9d6f093bcaeb97355ef8f0ed4f2e1b979b8d2cce4d67283dfb723e2bd98e1c0d0509dc3fe9057f133edfd915664eeae34775e47ee9d59248d230196d0b06406af36bada48c7f041659b555321216029adef50e58a275f08220e21f0287260f836d1cffa327f0d047d59b83afa9d5d16905af753a829efb91da3885793fb4bedb651fc7de1d8eddf34d1db94e695bba05c3e3db73643bfb7c13d6327197e06eae5ba3807824756b66f0f68eae4ccc64babac66b966d4e0fde5b3ccb2d543ed0614774154586fdeefd8b1ab5f7b3ad4d923fb79cf9c334062972db4b50b8a57148f21c461f042a479953d6420c446b71d06687f5bcca7c72bdf45bd9aaa8830b68d5c7f02b61cd92d4dae7491c99902cb87f827ffcd49057db40dee72895b50d89530d31317211f1a4a09cc55aa27bf6e86ee2536884f25226fefbc898f5785350ec1e768f3c8ffc181f6b8c67b201b2cf6a89c3b9371bb61d7c79379e9a7400a1c59723f825b3d93b4002746d9675d34a3c68efe2bf88010a76c553803536b26ab9c6b4006d70554bfc79257a09e551b4177532319c61f2378f4eee4054343c3e284698129f205efc303add2758c3aef7b3865e33f8ef9cc85fdde10021e7c266790a2339621f756d63ff1813fc756294a1187c9687aef5b11dbcaed0bfe6b916a332af8e903188a5aac9ade3131e005dd74d3c62744e69685fb554cf75ef89c2d48b10bd3a2de3c655ba1e792bddd5d76d8232bdfd37bf374c319427a3ec7bccaad3a3b33cb8f378047a2a0358776bc56d7f9a2d5677ff4cdcb8b5cbea444a6fd136bb8e31ae7fb67006f5650088d5eb4441b03c27b05973847afc8d5c11f14f3e74c58ea5cf5014166c6786ccb60c9b2ff26671604ef0d4ad7e2e4dfbb283d95419a7d8e83f9b40e94fdabace1f1afadf9d459ed5ffb8277b16e731814950451fc51abeb1a1774cede580005756cf1b33379f3b8790a27fde4f3d654d68471c13b22a8624c8377263e38c8bd5f250c815ee44a5d75db14fa6e87957c7bb51c8b469f69a2564a143cfd60b182c79ec7cfa7fa613ca8bae9c7bdc3a45c381cd5c0058c661d7e0b55a5eee64a19cd9a9448940227e0c490c3f0321e773b7fc3e1c4b82c7b8bbeb344a51012847d4f07eba8446cc67e742e1655450cbe2a9c9bf5de1b49f9e579e1053231fc4fa375c14b1f6c6f2860ba46b73124ab09ee80bf0abb2356d1109b984345bcd97961d89c971d1be71991efcaa90f3fd95fd3cd93f5fa96123d88251f3917072d9d0c8f19af1bba7812bcb3a65993bb2e8d032216f0719552d812dd218d893087e99333319bacfe37e51d967bff3c524831b7557f894b3572fc5ee61cbe28253bdd3db21b283840295ea0e26d2ad37b763c1c2885d098ecaeeb1162da9adc9cc63823d196f693ee69a93fb179c3191bd175f4d68b715c3929146332988ded659049308727880e35f8cbe5073a8153740ef85885e3f224eac79849e81b76f3f1b35e4e91a90e034c7194e67b19d520700d2e72e8e0721ec33d55c9970e88b2f0233de00aa2697aa1e1614edc106700978ee3aeac11ee93d07842cb3ef6ac12d30c3dc7bbde25d2de4f36a48c8f1d165eff53a82985674447571ae521175af0b1d01ed74a79faddf438e7a50829ed049263ec41513606c277736b2d94af0d5a03017e858080cb448c992553287469d538f96dbab2483582f947124202a7cd5602dab50d182f328861ac88f13df357961b0a1b8855efb069c2cdb7d29aa66bcfd127232e1dc823da7d368c4b1cf5525c4b0fee4cc8d5f8f2e59a44c347264891612be6eb61d84eb4c62ce19d6d6a9672e13be52fb4f8e8c320de6b08687e50cf9c3ccc578d9265511925151e24fd15e58b873fd9f3ae345492a613eb309f46c281219fe611a0b01a093479fe8470c63686947f760cd0627f0717feef4a31b655f6d198a139305a7295f859076c02f6de215a37ad8bad92ddff59dae567d1342d38d36ca2b0053daba11dd59f03377c9ffd600abb7340581627ee2e61860d5c1ef0e20762029c557331afd425645be031f51cf00f449b4bee9b5da9b0eb7bba16aeb25b46475955416a12e8f20cbbb6fd2f52ae72a11e19d8aaaf24be10670a6ec3b816aa92050b6ae1d58a6b88f43a26ee6e2a55351e49b93d5559696caa7e82d42493118e6482e72adaa7eb4f4662aae9a2d33c6afb237437b27bc7aa2b82bbaebe79974aed3138fc8f8f4d759351dc45d858e4dd5e2b520ff44687e8bfd9a2abb3bb0160fa4212be4be5d554f3a862a40726667192fce9432d97bc97026e3bd6cfd4f69d94eea877c2fcf619cb852a54ef3a2e953b65354a3e424122e2f6f8817fa8c94699a0ef5f943045ff4cf1b43a57565583222400e906e76c9d8bfa6cb33b50055deccb09f7992cfa71ed1df39de480a383f13025fb746b132c106ec33e22d4abdd6a6e2a3dc202364008821906025a84dbbe9daca884f80a0967bc68dd4e39f8fc9bfc1e0182443cd7fd7bacd2aff967e0a8c782ee5d032f0a964e3d386ce3aae60052c64252a881edd67fb77c41df4569b3e77c3e4d1cba930c9c65759ebffb6bad839510c0b3b9cb01b1adc5ca46cf86fb5703f6a46229f3e16322f368f666bcf128a8989c4f537d3b1c14a29a0083d769fd27ad030f3d0b9d95198e8ae2883eb057b31624bb05172d855f77cbff89ff86580f76d2db65747a8b21672136b7b10a9c7e6a6f4c673e48c8727fb149ac778aee3395737f60e5460f82d5ca4d77f6433c3d3553056bed63c2810122a15ce5c06bc211e678672c284304d53685c9e3de63d61e548bc71612ee901d75d0605970486d7418b76a078425bafc72a51a8a096a4eca7e140b318607a9d8d7f9ad3944a213fc2fe3da3a341c6c9eda120c04362bf922b272677aeac8434a286c383621fefe23fc1393fda7ed2e69d78826aecf05519f173f29664a09cbc81401511975762e34457ed420d5607555ec64e8d4925638e9710feb1e2e0851911dce2b74f6ba65fde1f5bbfdfbbde03945ab8ee85a51180254ee4e736e387ecc61c74d8352249f7581fc5520a9d9340de1633a6730bf549f062040f8c646c0f9b0060415ec6c9c72a0e7252707fb74363ac2ba96c9adac7f7b48d4648db8b38a0c20bf1ae33c8f5add0f9c7e5b9fa950d6294ee1c468d3851eec9232b152a7f40f652b055913be045095aeba1d1b700fc64f2709fa5fa7f1b46eb6a70948501242c8383cbe0a4345a1eab1873be2cae528dd579a045ea9ad292a65c75827ba412f8d960d445c177d9dd59e77e9ae06762ed44992a44c2cc02632639c7fb0f320c45c53d53c6badd68711488112b2d709f20cfdfd059387b0887246c19c8233255f544581ac253485ec900a716c6b30be84c8a42bd7ccfcb89663e3826da33a32089b1542dfd68f551f0f714b0fd3be0d7c6d22eb06e74550393bb756e247aefe44b0fa25ce34a5f8f12014225bf93a39e026b3054e84f528c1f45460332cae0e46be9a2483e14aaf8eb84461f9a7373e6c846f6f72a642a415d226ba03ab0765406028d549d3efa65074510cbdd2c9c93ab7163591d77e1d50c7c3f7729f8b315962c6a1f83df51b612543fcb68c1e1a5fcace8b78eb4fa64b1dd81559bce3fd9685c317f5c670802590469e0a5d0cf0d6f97174711a7a6bf964ebb16679cb7c569f2dc9eb11c045779039f7b23aad75d5dee66d3f7b362bfa8252ce98cc9baef3af4642af198fb79462bc7ade09111d476b587bbda557f708540af539afb5692abd0ec62ad5f0f8dc2a618b7f9c1d01ba3f39d448216596944875cb54cb9bc21edd76a861252b8acf0d6c8cc767ad8b532d859c8bf72e16f8dc3e423aad8a58081babb9bfa472e72e7df2501e2355e3b9d5a6e475abe3af8dcd2bb2aa6863a905ba17c194022bc4a07b02c08337a8e8c87ad759849e72f5d6a16d27538ecc89cf3edd02923e5a1ef485fedbe2f6d5c5f413f9804f94bd60644589c1a56a161a4b0ee5b1b808461cb5d79c23a4f31dca16d5679780d95b8f6cb7c307e0a2510c5601feca882f2edaf1a81f08ccd68981cb7d992829831374a42e474330124cf03e0e1ba46782c0d816bc199ea153a1c48c5b394aa148c6b8d20a2a04a2984a40aadd68acd7c512e5cca6dbf4933025e43d645fb3125796172b4fc6d14c72bcd16e1e04764ff607fcb7dcc9887e2bd58ddf1cca7c3be8d5b40d05def91f0a9d0cdfa8bf21b1b08d0ab7034daabd6b6c0f10ac477386bc6d195b0200600348556e8ecf1886bb050102af0f182b866875d00628a51eb8d952650057d1f5182225fd99c290959e3a876415eac3c9209dc8aca082441b8787571c1358e621f880f51c848e388d719a343c18b8b77378eca882aeba6e5857faac5beedc819fcebc685e2a4fbab16b707fbbf3cdc480daba7b8bc37c3790a1f63c8f92c59f91985817e2e4822f81561eae8499e82afdcf5e3c9ccb0c89948fb7290bf5eec1734b9541384a4f733f0111d8fc4928983461af89213a2c41d9c742310c5ab868326e6ebc7c736b2e3ac4e29d0db76537890be9e882a0547b33e17612027f0a9b525519cac92d155f7995cb907a16b980bcf22027d46838247cc719b7956eb1f8875a62d486cc2f72625977b54943bc9d8ffc105a1f9dc89360b8209b954b14da6cf7122a84ad7cc10633d45421626ce4995cb5bd892b2f5f1c9cbc518040542d0e76bae5c0c85c4c03b00a6e759a15b904555e74bee22b72ae396539c209447b51ebdc95ae3cb67bf26a83cf4cc6e1ad14c7779530c8f1993f4fde66465d60f5180f97344aca907ed9cefc15210581a182886e2e0bf6ee127f16038f02ca23b9d067e578879ba0be419cd5c3dee392027666595f681db1d6f4085c9145b40c2088e6b2bbdf2338e6d9f8e62d32b469b13518f7f077fa1c8347cdd857313bfea8679b48ea2690cbf8e2b6b25e28be98994cb5f6de4714665ff0c26c74727430ce33454c70c2b1c0d50c41ea0f843c3aa69bb7705701fb1bd294b9ef9ed0890a8dda02b8e1b82d923ed356b01d537214ad4898cca0099177e90cff198851374165f3a3f9c28d31ea5110dd19c708938dfeda69e2ca067d0fdfc2c02d23b9879a85bc4cbabd037dfab22db33a77e8d1217ff1ca51bc9bc6e1d524cbcce8dfa498e6b546fd753ef359872779d7428c31212a15a5d843e4cd0ebc065116083889fbb39a038d7aa29a2f7b84095a4fa7cb719722bd00682731fa09063c4931b2bb7521c122ceb789a7c863427478188503788cfb33523e7f5b6ac988d02575b00843fb598d30dad4fa299dd9666c5cf12956fc77c5d7d5b5232a508899efce4417700be4e1f73f1896879561129b58bd9b0c652fe2ce6daaef03aa9c4e72e65a3c947d150a63fcda6d2956977746ed4645b08399c3eb4b921ca8d6205978c28c5e0d76f2625395dd1ef0f18ec88f83af1ab7fe5823cbce2ab55657282a84af25ba9c15594d4e698625ef62293a75666776152a71cca", 0x1000}}, 0x1006) ioctl$TUNGETVNETLE(r2, 0x4010744d, &(0x7f0000000180)) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io$hid(r5, &(0x7f00000001c0)={0x14, &(0x7f0000000dc0)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f00000008c0)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x1000, 0x20}}, &(0x7f0000000600)={0x40, 0x7, 0x2, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x5}, 0x0, 0x0, 0x0}) bpf$MAP_CREATE(0x0, 0x0, 0x50) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) lsetxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x1) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x40, 0x9, 0x6, 0x201, 0x0, 0xeff9, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYRESHEX=r7], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 6.383464956s ago: executing program 8 (id=8141): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) socket$inet_sctp(0x2, 0x1, 0x84) socket$unix(0x1, 0x1, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={@cgroup=r2, r1, 0x36}, 0x20) r3 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r3, &(0x7f0000000c80)={0x2, 0x4e21, @local}, 0x10) r4 = mq_open(&(0x7f000084dff0)='rmdF\x17\x16\xbc\xec', 0x6e93ebbbcc0884f2, 0x0, 0x0) ppoll(&(0x7f0000002280)=[{r4, 0x800}], 0x1, 0x0, 0x0, 0x0) mq_timedsend(r4, 0x0, 0x0, 0x4, 0x0) mq_timedreceive(r4, 0x0, 0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x40}, 0x1, 0x0, 0x0, 0x4004000}, 0xe7ac64796bd5e60e) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007003a00000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) sendmsg$IPSET_CMD_DESTROY(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="30000000030603000000000000000000010000030900020073797a31000000000500010007"], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x800) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) 5.686211908s ago: executing program 7 (id=8143): r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000fd3f00000000000009000000850000002e00000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="4c0200001200200025bd7000fddbdf25ff020000000000000000000000000001000004d50a003c002c001300ffffffff000000000000000000000000640101020000000000000000000000000000000002000000a7001b006362632874776f6669736829000000000000000000008c82000000000000000000000000000000000000000000000000000000000000000000000000000000000000f802000033f41996389c2c6fbc187a9371ea5ed7c220ace5d51d3205b79e598678352d28cb6be224c3fd4308c1e3baab7ed85fb934c56ffd2985df12522ec876783f72f725f6604af47257476d7ed01fe78e67de1af9ce8edaf8164b8a23f4a68130dc00050019006c0000004701140067686173682d636c6d756c6e69000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d8070000400000004e1b7c5bb31a715dc19a2a135a4e40d4e05c740e77c170cd8fc2e0b6c1126657b6fee30b43c81ec22464f9e5f2ffc9ca85004920bf347f39ed878c1829f9dfc796e983d7224d6bac945b13769a29b2d51c36827b0808835ac95831ff38a610e7b3e0ee75aa922f5373cc3b04d8692a7583e00880b4fdfbfa0d489b2a4ff5b1497078310b0d0e571a47c1317ace902dd03d5a322370643423723db52c16475ab03e5b570a5870044150e5b65dbce75ca5a1510aafc7cc63493efc7add6a2ff6904e63e298eb686bd0d3cb1b4087530c9adff208cc0a14ee6939bea772eb7732714c80a16e6cdaa559c03a9f5d4b9dca3efad62ea68aa965314063ae00b9a0a36ff0ed013a9819a89ec6317dea4b64824db4b70f852c27968a1f17a70193ffff3464e9ce8db2b3a5142ef4c38916fa87c1a8e76d44347ee1d552f333a11c7cca8bd02a4f2c41097cdf75c2fe5f7a33c2c437c336c12ea7f9728584fa24af29e653db53bcdc913c5f7e5c74743ad4dff6952bba6525ae9fa4a332a207e8fd69c976fada16cbdd91d2ab213ae9c92911783e6957ae13919b5f682e1ad01811278e36d8900041ec13cf6f47e6c1e1223426356cc6a76c265d8fb40b2bc6e058"], 0x24c}, 0x1, 0x0, 0x0, 0x8891}, 0x24000080) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x700) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r5, 0x6f2d, 0x0) bind$netlink(r4, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r3, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYRES32=r6, @ANYBLOB="01000000000000002400128009000100626f6e640000000014000280050001000637598fefa7a57408f0e4d304ba635b265add2edfe6321f8596ae6f5d4ba05e84b7ae535308eb9afb73eccc3f9bb0892c94372d0b49247bb760492cab4e237f970db31f4b49ca19212bb90f62f437d8f075175009e913ed2b3aba215efb06720318aff1f519673e3d044ebb2bff10775690cd59161db5bc4b4b4a4ca6339c832eccebbab16a76b1c975176bad1a4f3e4ab3d81b29c3545a64d0afd40b375ef78e661b25a605cabfebb0178abb356cbdf12370"], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e00)=ANY=[@ANYBLOB="44000000100001042abd70000000000000000000", @ANYRES32=r2, @ANYBLOB="0028000000000000140012800c0001006d6163766c616e00", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$BLKRESETZONE(r9, 0x40101288, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x404c080) 5.416538068s ago: executing program 8 (id=8145): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x24040030}, 0x20004080) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) shutdown(0xffffffffffffffff, 0x1) r1 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r1, 0xda8d) accept4$inet(r1, 0x0, 0x0, 0x800) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x3) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x1, 0x0, 0x10158}, &(0x7f0000000100)=0x0, 0x0, 0x0) syz_ublk_add_dev(r2, r3, 0x0, 0x0, 0x0, &(0x7f0000000300)) 5.306945316s ago: executing program 7 (id=8146): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000680), 0x200202, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x9, 0x0, 0x7ffffdbd}]}) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000200)={0x80, 0x0, r1}) r4 = shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmdt(r4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f00000001c0)={0x1, 0x1, [0xf74, 0x4e0, 0xe4b, 0xa20]}) r5 = syz_io_uring_setup(0x617a, &(0x7f00000005c0)={0x0, 0x137c, 0x20000, 0x1, 0x15a, 0x0, r3}, &(0x7f0000000340), &(0x7f0000000380), &(0x7f0000000640)) io_uring_enter(r5, 0x542d, 0xeab9, 0x0, &(0x7f0000000400)={[0x1ff]}, 0x8) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() r6 = fsopen(&(0x7f00000000c0)='romfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r4, 0x30c3f000) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001880)=@newtfilter={0x8c4, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x890, 0x2, [@TCA_U32_POLICE={0x868, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x4, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x803, 0x1000, 0xfff, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x1, 0x10001, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x7, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x4, 0x2, 0x6, 0x6, 0xaa, 0xffffffff, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0xebb, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x1, 0xab, 0x9, 0x7, 0x0, 0x80e, 0x10001, 0x8, 0xa, 0x6, 0x0, 0xa1, 0x4, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x10000, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74db, 0x400000, 0x401, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x7f, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x4, 0x5, 0x7, 0x4, 0x3, 0x400, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x5, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf6, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x82, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x4003, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x0, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf49d, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x806, 0xc4, 0x9, 0x0, 0xee2, 0x2, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x2, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0xa, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x7, 0x81eb, 0x400, 0xffff, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x3, 0x9, 0x200004, 0x3, 0x7, 0x0, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x42b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xadd1}, @TCA_POLICE_PEAKRATE64={0xffffffffffffff51, 0x9, 0x7fffffffffffffff}, @TCA_POLICE_RATE64={0xc, 0x8, 0xffffffffffffffff}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x8c4}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000280)={'syztnl0\x00', &(0x7f0000000200)={'ip6tnl0\x00', r2, 0x29, 0x0, 0x5, 0xffff, 0x22, @mcast1, @empty, 0x0, 0x1, 0xfc}}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x807, 0x83, 0x6, 0xfffa}, 0x2000001d, [0x8000, 0xc95a, 0x12, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x49, 0x39cc191b, 0x5f, 0x9, 0x2, 0xffff2d37, 0x3, 0x46, 0x4, 0x0, 0x4, 0x8, 0x2, 0x4, 0x3c5b, 0x90, 0x24, 0x9, 0xffffffff, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x6, 0xffff0001, 0x2, 0x4c74, 0x80000000, 0x242, 0x0, 0xe, 0x1000, 0x71, 0x7, 0x7, 0x1, 0x7, 0x0, 0x41, 0x3, 0x6, 0x6, 0xffffffff, 0x5, 0x0, 0x8, 0x0, 0x5, 0x0, 0x8000005, 0x6, 0xb, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x8000012d, 0x8000, 0x10, 0x0, 0x129432e6, 0xcd, 0x40c, 0x9, 0x2bf, 0x6c9, 0x1, 0xfffffffc, 0x3, 0x0, 0x7, 0xeb, 0x5573, 0xe, 0x312, 0x78, 0xea4, 0x10, 0xda7a, 0x4, 0x8000, 0x2009, 0x400, 0x401, 0x6, 0x7, 0x4, 0x7, 0x5, 0x5f2e, 0x4, 0x0, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0xfffffffc, 0x6, 0x7, 0x8000, 0x0, 0xfe000000, 0xffff, 0x4, 0x62de, 0x5, 0x3, 0x3, 0x9, 0x1, 0x7, 0x3, 0x9, 0x3, 0x42, 0x2], [0x7, 0x3, 0x0, 0x4, 0xfffffffe, 0x9, 0x8d2, 0x8, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x20004, 0x5, 0x5, 0x0, 0x9, 0x5, 0x8, 0x83, 0x4000003, 0x20000009, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x3, 0xd, 0x4, 0x8, 0x8005, 0x9, 0x800000, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x5, 0x5, 0x8, 0xac8, 0x7, 0x2, 0x3, 0x7ff, 0xfffffff9, 0x4, 0x1, 0xffff, 0x3, 0x6, 0x1c, 0x120000, 0x3, 0x8003, 0xa2ed, 0x404, 0x25], [0x4000009, 0xbb31, 0x296, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x53f53804, 0x0, 0x0, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x207fff, 0xffff, 0x2, 0x2, 0x5, 0x1, 0x6, 0x148, 0x60a7, 0x6, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xcc, 0x7, 0xfffff000, 0x10003, 0x3, 0x7e, 0x20100, 0x9602, 0xc63c, 0x20000002, 0x4, 0x6, 0x1, 0x50080, 0x5, 0x8, 0x1000, 0xa21, 0xc, 0x7, 0xce3, 0x6c1b, 0x3, 0x6, 0x5, 0xb1e, 0x1, 0x1fe, 0xffff3441, 0x7]}, 0x45c) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@cgroup, 0xffffffffffffffff, 0x18}, 0x20) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc0200"/48, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000000000000000000084010500ac14143b000000000000000000000000000000002b00000000000000ac141408000000000000000000000000000000000000ff00000000000000000000000000ffffffff00000000000000000000000000000000320000000000"], 0x23c}}, 0x0) 3.52567206s ago: executing program 7 (id=8149): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000180)={0x7a2a, 0x9, 0x5a}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) landlock_restrict_self(0xffffffffffffffff, 0x1223d9c75d984443) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xb, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x1}, 0x50) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) r4 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000440)={0x0, r0}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x1e, 0x9, 0x7, 0xfffffeff, 0x5a088, r1, 0x3, '\x00', 0x0, r2, 0x0, 0x4, 0x3, 0x2, @value=r3, @void, @value=r4}, 0x50) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x6, 0x209}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x9, 0x9}, 0x8) r5 = open(&(0x7f0000000040)='./file0\x00', 0x101040, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}, 0xffffffff}}}, &(0x7f00000000c0)=0x84) getsockopt$inet_sctp_SCTP_ASSOCINFO(r5, 0x84, 0x1, &(0x7f0000000240)={r6, 0x9, 0x3, 0x5, 0xfffffffe}, &(0x7f0000000280)=0x14) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a42, 0x0) r8 = dup(r7) mmap(&(0x7f0000535000/0x2000)=nil, 0x2000, 0xc, 0x28011, r8, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 3.50700732s ago: executing program 4 (id=8150): r0 = epoll_create(0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={&(0x7f0000000240), &(0x7f00000004c0)="4700f5bca90981bec46f235d2b94338d0b67f7b8edf6a8daf7bcdfc33d61c86da85ef6ab3a1814c353b29a1e8101001b3937cba52575c8a9381e2aa5d1e16ba94c4cfef9d6e1ea95257255b17bf726c6520b9ec2652d2843dd9d47e742d62d87beed8688fa4d60aefe31480adc067727a439c8db0881f3c6f463062dba2be916471ae7bd8a5707c29f0a623c5b5131c31ae6377b12aeeba163471dc4ec9cd9e85511cdafdd285c75c5ec3edbe89e6f364614be9d5c518d2e0d33b4677f4115c0a7bc422b85b63d37087c8bf589ad7c6eeec1b1762b48166da40ccdd56bf21efcdb6ec594ae83e0253bf7602e7b6307911ee3df378a"}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r2, &(0x7f0000000140), 0x0, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) recvfrom(r2, &(0x7f00000022c0)=""/4089, 0xff9, 0x3, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f00000000c0)={0x10000009}) syz_open_dev$sg(&(0x7f0000000280), 0xdd4, 0x3b1042) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0xa, 0xb, 0x5, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="280000000000000029000000390000003a0202"], 0x28}, 0x922bac8576bdadce) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000600)={{{@in6=@local, @in6=@empty}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f00000002c0)=0xe8) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'gre0\x00', &(0x7f0000000440)={'gretap0\x00', 0x0, 0x8000, 0x8000, 0x4, 0x100, {{0xe, 0x4, 0x2, 0x8, 0x38, 0x67, 0x0, 0x3, 0x4, 0x0, @local, @loopback, {[@cipso={0x86, 0x6, 0x3}, @rr={0x7, 0x3, 0x68}, @timestamp={0x44, 0x18, 0x4c, 0x0, 0x9, [0x78f, 0x900, 0x20000002, 0xf, 0x4]}]}}}}}) clock_adjtime(0x4, &(0x7f0000000000)={0x1ff, 0x10000, 0xffffffffffffeffd, 0x0, 0x100000003, 0x3, 0x8000006, 0x8000000000000, 0x2000000000000c96, 0x3, 0x3, 0x7ffd, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x20000000000, 0x0, 0x0, 0x4, 0xffffffff, 0x0, 0x3, 0x6, 0x0, 0x1000}) r6 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8002) r7 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r7, &(0x7f0000000140), 0x10) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x400a044}, 0x20004090) 3.348801355s ago: executing program 8 (id=8151): mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="66643d0c79d3846101009049ca56f0a2f705fb78526dce", @ANYRESDEC=0x0, @ANYBLOB=',grou']) syz_open_dev$sg(&(0x7f00000001c0), 0x508d48d4, 0x40902) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b", 0xe3}], 0x1, &(0x7f00000008c0)=ANY=[@ANYBLOB="b800000000d983fd49e32f4399000000a0000000bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4a0342bed8a3c79acd4bb1f9f46ef28a63b329e09a86c62f907539c9af6f1b0bc00510c"], 0xb8, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d4", 0x7a}, {&(0x7f0000000ac0)}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e3853e4a118a5a2bcc52eeea6b2dc4fc", 0x2a}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12", 0xa8}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b", 0x99}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823591b49c610995a895f214c473ef6e1d49051b9198877e4e9d920ff", 0xea}], 0x6, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$loop(&(0x7f0000000500), 0x6, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x12, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, @jmp={0x5, 0x1, 0x4, 0x0, 0x9, 0xfffffffffffffff8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x3}, 0x94) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r2, 0x0, 0x0, 0x800) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000340)={0x10000, 0x2, 0x8000000, 0x2000, &(0x7f0000001000/0x2000)=nil}) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.178721424s ago: executing program 7 (id=8152): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) socket(0x10, 0x3, 0x0) pipe2(&(0x7f0000000400)={0xffffffffffffffff}, 0x800) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(r3, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r3, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) fcntl$lock(r3, 0x25, &(0x7f0000000140)={0x1, 0x4, 0xffffffffffffffff, 0x80000000000}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x4b}) fcntl$lock(r3, 0x7, &(0x7f00000000c0)={0x1, 0x2, 0x8, 0x73e9}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040), 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_RECEIVE(0xffffffffffffffff, 0x7ac, 0x0) socket$inet_udp(0x2, 0x2, 0x0) fcntl$setstatus(r2, 0x4, 0x2200) r5 = socket(0x10, 0x3, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x8, 0xffffffffffffffff}, {0xffff, 0xfff3}, {0xffe0, 0xa}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x8, 0x7, 0x3}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0x3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r8 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r8, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="01010000000000008400000007000000ac1414aa0000000020000000000000008493985a5f000000200400"/56], 0x38, 0x4855}, 0x24004052) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000340)={{0x33, @dev={0xac, 0x14, 0x14, 0x39}, 0x4e22, 0x1, 'lblcr\x00', 0x30, 0x5, 0x66}, {@remote, 0x4e21, 0x4, 0x4, 0x87c, 0x6}}, 0x44) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) 2.651696842s ago: executing program 4 (id=8153): r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000080)=0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000180)=@dstopts={0x2c, 0x1a, '\x00', [@jumbo={0xc2, 0x4, 0x9}, @enc_lim={0x4, 0x1, 0x81}, @generic={0x38, 0xc1, "18db6e94ea94121c1828db2ee354e72ebd2749c5ff87687d6f871f6c4cec891bf2ab16d087451a8d900340038563a71d7a7c22f85861052a0ce274f8ed402aba729fa81bc8c4737fdc1b9657a3ae7a9ed9e58cad1fd5ba1a1b56bced851b48ed620475c73d2060b06287eb696c7ea76bb410c36c1da46ed690bd3099d346b6d2e818148165ceec450cef664dd8d7d16c4a21875749a437e06b1e5d835d85a2b61073a58a3f75979879d9075c2b501582dda8300a6b8d46a1192daf2be6df1730bb"}, @jumbo={0xc2, 0x4, 0x302}]}, 0xe0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="6c00000010001fff010000000000000000060000", @ANYRES32=0x0, @ANYBLOB="81ffffff00000000440012800b00010067656e6576650000340002800500090000000000050009000100000005000a000000000005000300f90000000500040040000000050004000800000008000a00", @ANYRES64=r1], 0x6c}}, 0x10) 2.634605573s ago: executing program 6 (id=8154): r0 = epoll_create(0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={&(0x7f0000000240), &(0x7f00000004c0)="4700f5bca90981bec46f235d2b94338d0b67f7b8edf6a8daf7bcdfc33d61c86da85ef6ab3a1814c353b29a1e8101001b3937cba52575c8a9381e2aa5d1e16ba94c4cfef9d6e1ea95257255b17bf726c6520b9ec2652d2843dd9d47e742d62d87beed8688fa4d60aefe31480adc067727a439c8db0881f3c6f463062dba2be916471ae7bd8a5707c29f0a623c5b5131c31ae6377b12aeeba163471dc4ec9cd9e85511cdafdd285c75c5ec3edbe89e6f364614be9d5c518d2e0d33b4677f4115c0a7bc422b85b63d37087c8bf589ad7c6eeec1b1762b48166da40ccdd56bf21efcdb6ec594ae83e0253bf7602e7b6307911ee3df378a"}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendto(r2, &(0x7f0000000380)="9e48ab8865f896d107e92a61856dee35f0f34ae91910a2ca1f620fb03aea81cc28872bcf0b56a02728c642262a310d41842a2f56f6991732eea3b4fe189df3e6d196910683f56c329d65d625c946dfffdf9466dd89c14588ad744d87f33f05e95dc6b08af178be974654c2f52e24b20f380b3ae1480da85a4ab367134f277b359aa5adafc61240d0", 0x88, 0x8001, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f00000000c0)={0x10000009}) syz_open_dev$sg(&(0x7f0000000280), 0xdd4, 0x3b1042) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0xa, 0xb, 0x5, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="280000000000000029000000390000003a0202"], 0x28}, 0x922bac8576bdadce) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000600)={{{@in6=@local, @in6=@empty}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f00000002c0)=0xe8) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'gre0\x00', &(0x7f0000000440)={'gretap0\x00', 0x0, 0x8000, 0x8000, 0x4, 0x100, {{0xe, 0x4, 0x2, 0x8, 0x38, 0x67, 0x0, 0x3, 0x4, 0x0, @local, @loopback, {[@cipso={0x86, 0x6, 0x3}, @rr={0x7, 0x3, 0x68}, @timestamp={0x44, 0x18, 0x4c, 0x0, 0x9, [0x78f, 0x900, 0x20000002, 0xf, 0x4]}]}}}}}) clock_adjtime(0x4, &(0x7f0000000000)={0x1ff, 0x10000, 0xffffffffffffeffd, 0x0, 0x100000003, 0x3, 0x8000006, 0x8000000000000, 0x2000000000000c96, 0x3, 0x3, 0x7ffd, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x20000000000, 0x0, 0x0, 0x4, 0xffffffff, 0x0, 0x3, 0x6, 0x0, 0x1000}) r6 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8002) r7 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r7, &(0x7f0000000140), 0x10) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x400a044}, 0x20004090) 2.385544534s ago: executing program 8 (id=8155): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x24040030}, 0x20004080) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) shutdown(0xffffffffffffffff, 0x1) r1 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r1, 0xda8d) accept4$inet(r1, 0x0, 0x0, 0x800) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=0x3) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x1, 0x0, 0x10158}, &(0x7f0000000100)=0x0, 0x0, 0x0) syz_ublk_add_dev(r2, r3, 0x0, 0x0, 0x0, &(0x7f0000000300)) 1.915057416s ago: executing program 5 (id=8156): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) socket$netlink(0x10, 0x3, 0x13) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000200), 0xfffffd9d) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x3c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x1a, 0x3, "91abc12404cf378042f26c43f91f68d8a90767c0bc71"}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x9}], {0x14}}, 0x98}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f00009c0000/0x1000)=nil, 0x1000, 0xc) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000280)={&(0x7f00000059c0), 0x0, 0x0, 0x0}) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x4000004) unshare(0x1e000980) 1.786402641s ago: executing program 4 (id=8157): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r0, 0x0, 0xd0, &(0x7f0000000100)=0x11, 0x4) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'netdevsim0\x00'}) set_mempolicy(0x6005, &(0x7f0000000080)=0x5, 0x7ff) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000000000000000000000037000004d232000000fc0200000000000000000000000000000500"/58, @ANYRESOCT, @ANYBLOB="2ff643eac2e8e9e371c57d4bd5194f0d9660184193e20830449bed96fae9f97c40da40c17c538d79e0757b58d0"], 0x15c}, 0x1, 0x0, 0x0, 0x20040884}, 0x4002014) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = syz_io_uring_setup(0x3b47, &(0x7f0000000500)={0x0, 0x5d8d, 0x1000, 0x2, 0x284}, &(0x7f0000000580), &(0x7f00000005c0), 0x0) io_uring_register$IORING_REGISTER_RESIZE_RINGS(r4, 0x21, &(0x7f0000000800)={0x0, 0x6cda, 0x20, 0x1, 0x3df}, 0x1) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000000c0)=@x86={0x5, 0xfb, 0x80, 0x0, 0x4, 0xd, 0x2, 0x1, 0x4, 0x8, 0x10, 0x3, 0x0, 0xfffffff8, 0x8, 0x4, 0x6, 0x0, 0x0, '\x00', 0x0, 0x7}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) clock_settime(0xfffffffb, &(0x7f0000000140)={0x77359400}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000140)={0x2710, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x3, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x0, 0xc, 0x0, 0xfb, 0x4, 0xfc, 0x38}}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x6d, 0x0, 0x100000000005, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x9, 0x80000004400080, 0x1c00000, 0x6, 0x0, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.784565071s ago: executing program 7 (id=8158): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000200)={0xa, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_CURSOR2(r0, 0xc02464bb, &(0x7f0000000100)={0x1, r1, 0x2063, 0xfa4f, 0x101, 0xc35, 0x101, 0x40, 0x3ae2}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000180)={0x0, 0x3d, 0x5, 0x8, 0x3, [], [0xc4, 0x1e, 0xfffffc00, 0x4], [0x6, 0x5, 0x0, 0x7], [0x9, 0x1, 0x6, 0x9b54]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r4, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x6}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000040)='H', 0x1}], 0x1}}], 0x1, 0x200400d1) shutdown(r4, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r4, 0x84, 0x23, &(0x7f00000001c0), 0x8) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$DRM_IOCTL_DROP_MASTER(r0, 0x641f) ioctl$KVM_SET_NESTED_STATE(r5, 0x4080aebf, &(0x7f0000000600)=@vmx={0x0, 0x0, 0x2080, {0x26000, 0x0, {}, 0x0, 0x3}}) ioctl$KVM_SET_DEBUGREGS(r5, 0x4080aea2, &(0x7f0000000000)={[0xd000, 0x1000, 0x4], 0x100, 0x42, 0x8}) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r6, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80400000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x18, 0x1411, 0x100, 0x70bd27, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x10}, 0x1) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000080)={{0x3c, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e24, 0x14, 'sed\x00', 0x2, 0x9, 0x2d}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x4e22, 0x1, 0xa, 0x7ffffffe, 0x1000fb}}, 0x44) ioctl$KVM_RUN(r5, 0xae80, 0x0) r7 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x8, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f0000000040)={0xf0f045}) ppoll(&(0x7f0000000000)=[{r7, 0x9f712fd3135d63af}], 0x1, 0x0, 0x0, 0x0) 1.718803924s ago: executing program 6 (id=8159): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000680), 0x200202, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, 0x0) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000200)={0x80, 0x0, r1}) r4 = shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmdt(r4) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f00000001c0)={0x1, 0x1, [0xf74, 0x4e0, 0xe4b, 0xa20]}) r5 = syz_io_uring_setup(0x617a, &(0x7f00000005c0)={0x0, 0x137c, 0x20000, 0x1, 0x15a, 0x0, r3}, &(0x7f0000000340), &(0x7f0000000380), &(0x7f0000000640)) io_uring_enter(r5, 0x542d, 0xeab9, 0x0, &(0x7f0000000400)={[0x1ff]}, 0x8) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() r6 = fsopen(&(0x7f00000000c0)='romfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff}) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) r4 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000440)={0x0, r0}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x1e, 0x9, 0x7, 0xfffffeff, 0x5a088, r1, 0x3, '\x00', 0x0, r2, 0x0, 0x4, 0x3, 0x2, @value=r3, @void, @value=r4}, 0x50) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x6, 0x209}, 0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x9, 0x9}, 0x8) r5 = open(&(0x7f0000000040)='./file0\x00', 0x101040, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}, 0xffffffff}}}, &(0x7f00000000c0)=0x84) getsockopt$inet_sctp_SCTP_ASSOCINFO(r5, 0x84, 0x1, &(0x7f0000000240)={r6, 0x9, 0x3, 0x5, 0xfffffffe}, &(0x7f0000000280)=0x14) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a42, 0x0) r8 = dup(r7) mmap(&(0x7f0000535000/0x2000)=nil, 0x2000, 0xc, 0x28011, r8, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 164.847006ms ago: executing program 8 (id=8163): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a5002430102030109021200"], 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x640000, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39dcdb) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0xd0f, 0x6558, 0x25dfdbfc, {0x60, 0x0, 0x0, r5, {}, {0x1, 0x2}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x40004}, 0x40000) rseq(&(0x7f0000000080), 0x20, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) close(r2) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) r6 = memfd_create(&(0x7f00000002c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9\xd6\x1c\x1b*\x9a!?\x7f\xa5\xad\x9a,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{&\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+\x02\x00\x00\x00\x00\x00\x00\x00\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc0 HID v0.00 Device [syz1] on syz0 [ 1813.904913][T28619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1813.930852][T28619] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1814.154632][T28621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1814.176362][T28621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1815.257663][T25598] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1815.274691][T25598] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1815.284060][T25598] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1815.309909][T25598] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1815.319461][T25598] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1815.670988][T28644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1815.694074][T28644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1815.923019][T28646] vim2m vim2m.0: Fourcc format (0x47524247) invalid. [ 1816.015413][T28637] bridge0: port 1(bridge_slave_0) entered blocking state [ 1816.023360][T28637] bridge0: port 1(bridge_slave_0) entered disabled state [ 1816.032453][T28637] bridge_slave_0: entered allmulticast mode [ 1816.041582][T28637] bridge_slave_0: entered promiscuous mode [ 1816.052231][T28637] bridge0: port 2(bridge_slave_1) entered blocking state [ 1816.060474][T28637] bridge0: port 2(bridge_slave_1) entered disabled state [ 1816.070623][T28637] bridge_slave_1: entered allmulticast mode [ 1816.081983][T28637] bridge_slave_1: entered promiscuous mode [ 1816.169138][T28637] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1816.193570][T28637] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1816.203093][ T7149] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 1816.275596][T28637] team0: Port device team_slave_0 added [ 1816.288792][T28637] team0: Port device team_slave_1 added [ 1816.334155][T28637] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1816.342841][T28637] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1816.370886][T28637] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1816.385364][T28637] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1816.393521][T28637] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1816.427538][T28637] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1816.443140][ T7149] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 1816.454413][ T7149] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 1816.471220][ T7149] usb 6-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 1816.481403][ T7149] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1816.500936][ T7149] usb 6-1: Product: syz [ 1816.510478][ T7149] usb 6-1: Manufacturer: syz [ 1816.523707][ T7149] usb 6-1: SerialNumber: syz [ 1816.576925][T28637] hsr_slave_0: entered promiscuous mode [ 1816.584529][T28637] hsr_slave_1: entered promiscuous mode [ 1816.592004][T28637] debugfs: 'hsr0' already exists in 'hsr' [ 1816.598085][T28637] Cannot create hsr debugfs directory [ 1817.375702][ T5635] Bluetooth: hci0: command tx timeout [ 1818.134151][ T7149] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1818.176318][ T7149] usb 6-1: unit 6 not found! [ 1818.182093][ T7149] usb 6-1: unit 2 not found! [ 1818.385758][T28672] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.7782'. [ 1818.406207][ T7149] usb 6-1: USB disconnect, device number 91 [ 1818.412841][T13445] hid-generic 0000:0000:0000.0084: unknown main item tag 0x0 [ 1818.434844][T13445] hid-generic 0000:0000:0000.0084: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1818.639427][T28675] program syz.6.7783 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1818.916412][T19278] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 1819.120289][T19278] usb 7-1: Using ep0 maxpacket: 16 [ 1819.142998][T19278] usb 7-1: config 1 has an invalid interface number: 62 but max is 0 [ 1819.170782][T19278] usb 7-1: config 1 has no interface number 0 [ 1819.184437][T19278] usb 7-1: config 1 interface 62 altsetting 253 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1819.191046][T28637] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1819.216969][T19278] usb 7-1: config 1 interface 62 altsetting 253 bulk endpoint 0x3 has invalid maxpacket 32 [ 1819.239638][T19278] usb 7-1: config 1 interface 62 altsetting 253 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 1819.263523][T28637] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1819.273547][T28637] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1819.290017][T28637] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1819.304407][T28637] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1819.317545][T19278] usb 7-1: config 1 interface 62 has no altsetting 0 [ 1819.337850][T19278] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1819.348027][T28637] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1819.355957][T19278] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1819.368788][T28637] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1819.373806][T19278] usb 7-1: SerialNumber: syz [ 1819.392887][T28637] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1819.420606][T28675] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1819.455926][ T5635] Bluetooth: hci0: command tx timeout [ 1819.660736][T19278] cdc_acm 7-1:1.62: ttyACM0: USB ACM device [ 1819.687410][T19278] usb 7-1: USB disconnect, device number 28 [ 1819.717843][T28637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1819.749969][T28637] 8021q: adding VLAN 0 to HW filter on device team0 [ 1819.773499][T20427] bridge0: port 1(bridge_slave_0) entered blocking state [ 1819.780786][T20427] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1819.805241][T25481] bridge0: port 2(bridge_slave_1) entered blocking state [ 1819.812570][T25481] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1819.949418][T28637] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1820.080097][T28637] veth0_vlan: entered promiscuous mode [ 1820.113338][T28637] veth1_vlan: entered promiscuous mode [ 1820.265763][T28637] veth0_macvtap: entered promiscuous mode [ 1820.327438][T28637] veth1_macvtap: entered promiscuous mode [ 1820.415054][T28637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1820.470544][T28637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1820.512028][T25472] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1820.546351][T25472] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1820.588847][T25472] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1820.650143][T25472] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1820.736680][T19278] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 1820.915621][T19278] usb 7-1: Using ep0 maxpacket: 32 [ 1820.951172][T19278] usb 7-1: config 0 has an invalid interface number: 85 but max is 0 [ 1820.990421][T19278] usb 7-1: config 0 has no interface number 0 [ 1821.036200][T19278] usb 7-1: config 0 interface 85 has no altsetting 0 [ 1821.077658][T19278] usb 7-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1821.100167][T25472] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1821.115508][T19278] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1821.134308][T25472] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1821.150530][T19278] usb 7-1: Product: syz [ 1821.172260][T19278] usb 7-1: Manufacturer: syz [ 1821.182558][T19278] usb 7-1: SerialNumber: syz [ 1821.201473][T19278] usb 7-1: config 0 descriptor?? [ 1821.213291][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1821.239128][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1821.535621][ T5635] Bluetooth: hci0: command tx timeout [ 1821.847045][T19278] appletouch 7-1:0.85: Geyser mode initialized. [ 1821.872115][T19278] input: appletouch as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.85/input/input225 [ 1821.965609][T19275] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1821.983205][T28706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1822.011438][T28706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1822.077925][T19278] usb 7-1: USB disconnect, device number 29 [ 1822.106493][T28706] random: crng reseeded on system resumption [ 1822.148024][T19275] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 1822.171772][T19275] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1822.185397][T19275] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1822.200701][T19278] appletouch 7-1:0.85: input: appletouch disconnected [ 1822.208258][T19275] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1822.233851][T19275] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1822.247579][T19275] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1822.266832][T19275] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1822.278908][T19275] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1822.290672][T19275] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1822.304343][T19275] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1822.344269][T19275] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1822.366728][T19275] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1822.401275][T19275] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1822.420679][T19275] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1822.444546][T19275] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1822.477799][T19275] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1822.497546][T19275] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1822.516125][T19275] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1822.543802][T19275] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1822.564150][T19275] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1822.595749][T19275] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1822.621118][T19275] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1822.646294][T19275] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1822.668009][T19275] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1822.701735][T19275] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1822.720723][T19275] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1822.734874][T19275] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1822.747166][T19275] usb 9-1: Product: syz [ 1822.751470][T19275] usb 9-1: Manufacturer: syz [ 1822.756193][T19275] usb 9-1: SerialNumber: syz [ 1822.766388][T19275] usb 9-1: config 0 descriptor?? [ 1822.779437][T19275] yurex 9-1:0.0: USB YUREX device now attached to Yurex #0 [ 1823.235385][T28701] bridge0: port 2(bridge_slave_1) entered disabled state [ 1823.243475][T28701] bridge0: port 1(bridge_slave_0) entered disabled state [ 1823.290614][T19289] usb 9-1: USB disconnect, device number 2 [ 1823.316506][T19289] yurex 9-1:0.0: USB YUREX #0 now disconnected [ 1823.447944][T28701] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1823.470316][T28701] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1823.615637][T28714] Bluetooth: hci0: command tx timeout [ 1823.724861][T25481] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1823.744723][T25481] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1823.777842][T25481] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1823.797890][T25481] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1823.956907][T28725] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.7792'. [ 1824.739813][T28714] Bluetooth: hci4: command 0x0406 tx timeout [ 1824.997040][T19275] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1825.169234][T19275] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1825.200176][T19275] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1825.234868][T19275] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1825.274593][T19275] usb 9-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 1825.316817][T19275] usb 9-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 1825.364352][T19275] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1825.412233][T19275] usb 9-1: config 1 interface 1 has no altsetting 0 [ 1825.458211][T19275] usb 9-1: string descriptor 0 read error: -22 [ 1825.486749][T19275] usb 9-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 1825.523172][T19275] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1826.691148][T28750] kvm: pic: non byte read [ 1826.698855][T28750] kvm: pic: non byte read [ 1827.018367][T28735] syz.8.7796 (28735): drop_caches: 2 [ 1827.051289][T28735] syz.8.7796 (28735): drop_caches: 2 [ 1827.111538][T19275] usb 9-1: 2:0: failed to get current value for ch 1 (-71) [ 1827.140306][T19275] usb 9-1: Warning! Unlikely small volume range (=207), linear volume or custom curve? [ 1827.164346][T19275] usb 9-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/207/1 [ 1827.287847][T19275] usb 9-1: USB disconnect, device number 3 [ 1827.367248][T28757] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.7803'. [ 1827.709377][T28763] netlink: 'syz.8.7806': attribute type 10 has an invalid length. [ 1827.737505][T28763] fuse: Unknown parameter 'noot' [ 1827.785977][T19275] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 1827.957118][T19275] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 1827.979992][T19275] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1827.997368][T19275] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1828.024429][T19275] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1828.043724][T19275] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1828.067290][T19275] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1828.095865][T19275] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1828.104348][T19275] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1828.115822][T19285] usb 9-1: new full-speed USB device number 4 using dummy_hcd [ 1828.128119][T19275] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1828.145788][T19275] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1828.164761][T19275] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1828.176524][T19275] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1828.188407][T19275] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1828.198352][T19275] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1828.209926][T28769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1828.218499][T13453] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 1828.226840][T19275] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1828.238937][T19275] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1828.246786][T28769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1828.257019][T19275] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1828.266763][T19275] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1828.284009][T19275] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1828.292440][T19275] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1828.303875][T19275] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1828.328776][T19275] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1828.330790][T19285] usb 9-1: config 0 has an invalid interface number: 31 but max is 0 [ 1828.345969][T19275] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1828.356298][T19275] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1828.367646][T19275] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1828.380267][T19275] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1828.389865][T13453] usb 6-1: too many configurations: 36, using maximum allowed: 8 [ 1828.392332][T19275] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1828.406310][T19285] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1828.406341][T19285] usb 9-1: config 0 has no interface number 0 [ 1828.417233][T19285] usb 9-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1828.430190][T19275] usb 7-1: Product: syz [ 1828.437277][T19275] usb 7-1: Manufacturer: syz [ 1828.441972][T19275] usb 7-1: SerialNumber: syz [ 1828.459067][T19275] usb 7-1: config 0 descriptor?? [ 1828.471757][T19275] yurex 7-1:0.0: USB YUREX device now attached to Yurex #0 [ 1828.485898][T19285] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1828.513705][T28771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1828.515757][T19285] usb 9-1: Product: syz [ 1828.526885][T28771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1828.544116][T13453] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1828.567880][T19285] usb 9-1: Manufacturer: syz [ 1828.576057][T13453] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1828.590660][T19285] usb 9-1: SerialNumber: syz [ 1828.609336][T13453] usb 6-1: Product: syz [ 1828.615290][T19285] usb 9-1: config 0 descriptor?? [ 1828.624754][T13453] usb 6-1: Manufacturer: syz [ 1828.635779][T13453] usb 6-1: SerialNumber: syz [ 1828.649169][T19285] hub 9-1:0.31: bad descriptor, ignoring hub [ 1828.665602][T19285] hub 9-1:0.31: probe with driver hub failed with error -5 [ 1828.701267][T13453] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1828.711733][T19285] uvcvideo 9-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 1828.739684][T19285] uvcvideo 9-1:0.31: Entity type for entity Output 32774 was not initialized! [ 1828.778617][T19285] uvcvideo 9-1:0.31: Failed to create links for entity 32774 [ 1828.797243][T19285] uvcvideo 9-1:0.31: Failed to register entities (-22). [ 1828.856346][T19289] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1828.968513][ T7149] usb 7-1: USB disconnect, device number 30 [ 1829.011493][ T7149] yurex 7-1:0.0: USB YUREX #0 now disconnected [ 1829.233010][T28778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1829.275413][T28778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1829.502069][T28781] random: crng reseeded on system resumption [ 1829.936871][T19289] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1829.966924][T19289] ath9k_htc: Failed to initialize the device [ 1830.374454][T19289] usb 6-1: ath9k_htc: USB layer deinitialized [ 1830.545649][ T5635] Bluetooth: hci6: ISO packet for unknown connection handle 0 [ 1830.645597][T19285] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 1830.935536][T19285] usb 7-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 1830.962583][T13453] usb 6-1: USB disconnect, device number 92 [ 1830.997448][T19285] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1831.082549][T19285] usb 7-1: config 0 descriptor?? [ 1831.131889][T19285] gspca_main: spca508-2.14.0 probing 8086:0110 [ 1831.583441][T28797] tipc: Enabling of bearer rejected, failed to enable media [ 1831.720338][T28801] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1831.835794][T19285] gspca_spca508: reg_read err -110 [ 1831.841742][T28800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1831.863988][T19285] gspca_spca508: reg_read err -32 [ 1831.885009][T28800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1831.895275][T19285] gspca_spca508: reg_read err -32 [ 1831.910946][T19285] gspca_spca508: reg_read err -32 [ 1831.934220][T19285] gspca_spca508: reg write: error -32 [ 1831.960722][T19285] spca508 7-1:0.0: probe with driver spca508 failed with error -32 [ 1832.851198][T28819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1832.879636][T28819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1832.957433][T28819] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 1833.010022][T28819] syz.4.7822: vmalloc error: size 9223372036854775807, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1833.024883][T28819] CPU: 0 UID: 0 PID: 28819 Comm: syz.4.7822 Tainted: G L syzkaller #0 PREEMPT(full) [ 1833.024918][T28819] Tainted: [L]=SOFTLOCKUP [ 1833.024927][T28819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1833.024943][T28819] Call Trace: [ 1833.024953][T28819] [ 1833.024964][T28819] dump_stack_lvl+0xe8/0x150 [ 1833.025002][T28819] warn_alloc+0x24c/0x270 [ 1833.025048][T28819] ? __pfx_warn_alloc+0x10/0x10 [ 1833.025099][T28819] ? __mutex_trylock_common+0x15f/0x270 [ 1833.025137][T28819] __vmalloc_node_range_noprof+0x12c/0x1730 [ 1833.025188][T28819] ? rcu_is_watching+0x15/0xb0 [ 1833.025217][T28819] ? trace_contention_end+0x3d/0x140 [ 1833.025252][T28819] ? __mutex_lock+0x30d/0x1550 [ 1833.025288][T28819] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1833.025323][T28819] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1833.025352][T28819] ? dvb_dvr_do_ioctl+0x76/0x220 [ 1833.025392][T28819] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1833.025430][T28819] ? do_vfs_ioctl+0x116f/0x1530 [ 1833.025469][T28819] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 1833.025503][T28819] vmalloc_noprof+0xb2/0xe0 [ 1833.025536][T28819] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 1833.025573][T28819] dvb_dvr_do_ioctl+0x12b/0x220 [ 1833.025615][T28819] dvb_usercopy+0x199/0x2e0 [ 1833.025646][T28819] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 1833.025680][T28819] ? __pfx_dvb_usercopy+0x10/0x10 [ 1833.025722][T28819] ? __fget_files+0x3a2/0x420 [ 1833.025745][T28819] ? __fget_files+0x2a/0x420 [ 1833.025770][T28819] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 1833.025804][T28819] dvb_dvr_ioctl+0x29/0x40 [ 1833.025838][T28819] __se_sys_ioctl+0xfc/0x170 [ 1833.025866][T28819] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1833.025893][T28819] do_syscall_64+0x174/0x580 [ 1833.025921][T28819] ? trace_irq_disable+0x3b/0x140 [ 1833.025958][T28819] ? clear_bhb_loop+0x40/0x90 [ 1833.025988][T28819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1833.026012][T28819] RIP: 0033:0x7f0331b9ce59 [ 1833.026033][T28819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1833.026054][T28819] RSP: 002b:00007f0332a17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1833.026080][T28819] RAX: ffffffffffffffda RBX: 00007f0331e15fa0 RCX: 00007f0331b9ce59 [ 1833.026098][T28819] RDX: 7fffffffffffffff RSI: 0000000000006f2d RDI: 000000000000000a [ 1833.026114][T28819] RBP: 00007f0331c32e6f R08: 0000000000000000 R09: 0000000000000000 [ 1833.026129][T28819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1833.026143][T28819] R13: 00007f0331e16038 R14: 00007f0331e15fa0 R15: 00007f0331f3fa48 [ 1833.026188][T28819] [ 1833.568672][T28819] Mem-Info: [ 1833.573165][T28819] active_anon:71799 inactive_anon:43 isolated_anon:0 [ 1833.573165][T28819] active_file:5500 inactive_file:57214 isolated_file:0 [ 1833.573165][T28819] unevictable:768 dirty:433 writeback:0 [ 1833.573165][T28819] slab_reclaimable:14828 slab_unreclaimable:98763 [ 1833.573165][T28819] mapped:41580 shmem:66135 pagetables:2022 [ 1833.573165][T28819] sec_pagetables:3 bounce:0 [ 1833.573165][T28819] kernel_misc_reclaimable:0 [ 1833.573165][T28819] free:1011882 free_pcp:16191 free_cma:0 [ 1833.623509][T28819] Node 0 active_anon:276980kB inactive_anon:172kB active_file:22000kB inactive_file:228640kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:158108kB dirty:1728kB writeback:0kB shmem:252788kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13512kB pagetables:7916kB sec_pagetables:12kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1833.754840][T13453] usb 7-1: USB disconnect, device number 31 [ 1833.796371][T28819] Node 1 active_anon:10216kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:8212kB dirty:4kB writeback:0kB shmem:11752kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1833.903127][T28819] Node 0 DMA free:11016kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:248kB local_pcp:124kB free_cma:0kB [ 1834.042611][T28819] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 1834.066157][T28819] Node 0 DMA32 free:111584kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:277380kB inactive_anon:172kB active_file:22000kB inactive_file:228640kB unevictable:1536kB writepending:1728kB zspages:0kB present:3129332kB managed:2551348kB mlocked:0kB bounce:0kB free_pcp:60240kB local_pcp:28240kB free_cma:0kB [ 1834.220840][T28832] kvm: pic: non byte read [ 1834.241897][T28819] lowmem_reserve[]: 0 0 0 0 0 [ 1834.260593][T28820] vim2m vim2m.0: Fourcc format (0x47524247) invalid. [ 1834.271120][T28819] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:620kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1834.323907][T28832] kvm: pic: non byte read [ 1834.428810][T28819] lowmem_reserve[]: 0 0 0 0 0 [ 1834.467562][T28819] Node 1 Normal free:3926064kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:10216kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:4312kB local_pcp:0kB free_cma:0kB [ 1834.597247][T13453] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 1834.608437][T28819] lowmem_reserve[]: 0 0 0 0 0 [ 1834.634044][T28819] Node 0 DMA: 2*4kB (M) 2*8kB (M) 1*16kB (M) 1*32kB (M) 1*64kB (M) 3*128kB (M) 3*256kB (M) 1*512kB (M) 3*1024kB (UM) 1*2048kB (M) 1*4096kB (M) = 11016kB [ 1834.698471][T28819] Node 0 DMA32: 2608*4kB (UM) 1922*8kB (UME) 500*16kB (UME) 582*32kB (UME) 316*64kB (UME) 68*128kB (UME) 24*256kB (UME) 17*512kB (UM) 6*1024kB (UM) 6*2048kB (UM) 0*4096kB = 114640kB [ 1834.785409][T28819] Node 0 [ 1834.790944][T13453] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 1834.806833][T28819] Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1834.852817][T28819] Node 1 Normal: 36*4kB (UM) 30*8kB (UM) 37*16kB (UME) 31*32kB (UME) 30*64kB (UME) 12*128kB (UM) 7*256kB (UM) 6*512kB (UME) 4*1024kB (UME) 2*2048kB (UE) 954*4096kB (M) = 3926064kB [ 1834.881138][T13453] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 1834.948430][T13453] usb 6-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 1834.965143][T28819] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1834.988000][T13453] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1835.010462][T28819] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1835.038497][T13453] usb 6-1: Product: syz [ 1835.055708][T13453] usb 6-1: Manufacturer: syz [ 1835.061817][T28819] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1835.082329][T13453] usb 6-1: SerialNumber: syz [ 1835.126151][T28819] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1835.158570][T28819] 128804 total pagecache pages [ 1835.171961][T28819] 0 pages in swap cache [ 1835.184583][T28819] Free swap = 124996kB [ 1835.197695][T28819] Total swap = 124996kB [ 1835.221795][T28819] 2097051 pages RAM [ 1835.237520][T28819] 0 pages HighMem/MovableOnly [ 1835.253000][T28819] 427444 pages reserved [ 1835.272184][T28819] 0 pages cma reserved [ 1836.241646][T28847] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7827'. [ 1836.272039][T28847] bond2: option mode: unable to set because the bond device has slaves [ 1836.318158][T28847] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7827'. [ 1836.351646][T28847] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7827'. [ 1836.497381][T13453] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1836.524365][T13453] usb 6-1: unit 6 not found! [ 1836.542243][T13453] usb 6-1: unit 2 not found! [ 1836.766011][T13453] usb 6-1: USB disconnect, device number 93 [ 1837.548546][ T5635] Bluetooth: hci1: SCO packet for unknown connection handle 0 [ 1839.085839][T28879] vim2m vim2m.0: Fourcc format (0x47524247) invalid. [ 1839.395691][T19275] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 1839.471146][T28886] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1839.493153][T28886] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1839.589763][T19275] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 1839.615849][T19289] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 1839.645809][T28886] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 1839.675614][T19275] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 1839.729024][T19275] usb 7-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 1839.761825][T19275] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1839.775241][T19275] usb 7-1: Product: syz [ 1839.785640][T19289] usb 6-1: Using ep0 maxpacket: 32 [ 1839.789158][T19275] usb 7-1: Manufacturer: syz [ 1839.808213][T19275] usb 7-1: SerialNumber: syz [ 1839.824071][T19289] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 1839.857653][T19289] usb 6-1: config 0 has no interface number 0 [ 1839.870927][T19289] usb 6-1: config 0 interface 85 has no altsetting 0 [ 1839.891952][T19289] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1839.901901][T19289] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1839.910795][T19289] usb 6-1: Product: syz [ 1839.918005][T19289] usb 6-1: Manufacturer: syz [ 1839.923090][T19289] usb 6-1: SerialNumber: syz [ 1839.933828][T19289] usb 6-1: config 0 descriptor?? [ 1839.941504][T28889] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7839'. [ 1839.962501][T28889] bond1: option mode: unable to set because the bond device has slaves [ 1839.987920][T28889] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7839'. [ 1840.010976][T28889] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7839'. [ 1840.538376][T28898] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7842'. [ 1840.575700][T28898] bond1: option mode: unable to set because the bond device has slaves [ 1840.605496][T28900] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7842'. [ 1840.635394][T28900] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7842'. [ 1840.725945][T19289] appletouch 6-1:0.85: Geyser mode initialized. [ 1840.757467][T19289] input: appletouch as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.85/input/input226 [ 1841.358912][T19289] usb 6-1: USB disconnect, device number 94 [ 1841.411893][T28911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1841.435768][T28911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1841.450407][T19289] appletouch 6-1:0.85: input: appletouch disconnected [ 1841.509611][T19275] usb 7-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1841.536636][T19275] usb 7-1: unit 6 not found! [ 1841.551409][T19275] usb 7-1: unit 2 not found! [ 1841.660805][T19275] usb 7-1: USB disconnect, device number 32 [ 1842.186636][T28922] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1842.245873][T28922] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1843.658642][T28936] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7850'. [ 1843.734669][T28938] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7850'. [ 1843.826080][T28936] bond3: option mode: unable to set because the bond device has slaves [ 1843.904533][T28938] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7850'. [ 1844.549182][T19285] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 1844.716699][T19285] usb 6-1: Using ep0 maxpacket: 16 [ 1844.870412][T19285] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1844.919245][T19285] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1844.948632][T19285] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1844.965683][T19285] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1844.977276][T28950] program syz.7.7851 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1844.996026][T19285] usb 6-1: Product: syz [ 1845.039163][T19285] usb 6-1: Manufacturer: syz [ 1845.067504][T19285] usb 6-1: SerialNumber: syz [ 1845.092070][T19285] usb 6-1: config 0 descriptor?? [ 1845.130531][T28955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1845.146629][T19285] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1845.156542][T19285] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1845.164591][T28955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1845.884128][T28945] syz.5.7853: vmalloc error: size 9223372036854775807, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1845.981613][T28945] CPU: 0 UID: 0 PID: 28945 Comm: syz.5.7853 Tainted: G L syzkaller #0 PREEMPT(full) [ 1845.981658][T28945] Tainted: [L]=SOFTLOCKUP [ 1845.981667][T28945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1845.981682][T28945] Call Trace: [ 1845.981691][T28945] [ 1845.981702][T28945] dump_stack_lvl+0xe8/0x150 [ 1845.981741][T28945] warn_alloc+0x24c/0x270 [ 1845.981786][T28945] ? __pfx_warn_alloc+0x10/0x10 [ 1845.981838][T28945] ? __mutex_trylock_common+0x15f/0x270 [ 1845.981875][T28945] __vmalloc_node_range_noprof+0x12c/0x1730 [ 1845.981915][T28945] ? rcu_is_watching+0x15/0xb0 [ 1845.981945][T28945] ? trace_contention_end+0x3d/0x140 [ 1845.981978][T28945] ? __mutex_lock+0x30d/0x1550 [ 1845.982014][T28945] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1845.982048][T28945] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1845.982078][T28945] ? dvb_dvr_do_ioctl+0x76/0x220 [ 1845.982117][T28945] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1845.982152][T28945] ? do_vfs_ioctl+0x116f/0x1530 [ 1845.982195][T28945] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 1845.982233][T28945] vmalloc_noprof+0xb2/0xe0 [ 1845.982266][T28945] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 1845.982306][T28945] dvb_dvr_do_ioctl+0x12b/0x220 [ 1845.982349][T28945] dvb_usercopy+0x199/0x2e0 [ 1845.982382][T28945] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 1845.982418][T28945] ? __pfx_dvb_usercopy+0x10/0x10 [ 1845.982463][T28945] ? __fget_files+0x3a2/0x420 [ 1845.982486][T28945] ? __fget_files+0x2a/0x420 [ 1845.982522][T28945] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 1845.982559][T28945] dvb_dvr_ioctl+0x29/0x40 [ 1845.982598][T28945] __se_sys_ioctl+0xfc/0x170 [ 1845.982628][T28945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1845.982655][T28945] do_syscall_64+0x174/0x580 [ 1845.982685][T28945] ? clear_bhb_loop+0x40/0x90 [ 1845.982715][T28945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1845.982739][T28945] RIP: 0033:0x7fc27659ce59 [ 1845.982762][T28945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1845.982782][T28945] RSP: 002b:00007fc277388028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1845.982808][T28945] RAX: ffffffffffffffda RBX: 00007fc276815fa0 RCX: 00007fc27659ce59 [ 1845.982826][T28945] RDX: 7fffffffffffffff RSI: 0000000000006f2d RDI: 0000000000000009 [ 1845.982842][T28945] RBP: 00007fc276632e6f R08: 0000000000000000 R09: 0000000000000000 [ 1845.982858][T28945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1845.982873][T28945] R13: 00007fc276816038 R14: 00007fc276815fa0 R15: 00007fc27693fa48 [ 1845.982909][T28945] [ 1845.982951][T28945] Mem-Info: [ 1846.472379][T28945] active_anon:71639 inactive_anon:43 isolated_anon:0 [ 1846.472379][T28945] active_file:5500 inactive_file:58754 isolated_file:0 [ 1846.472379][T28945] unevictable:768 dirty:278 writeback:0 [ 1846.472379][T28945] slab_reclaimable:14625 slab_unreclaimable:99480 [ 1846.472379][T28945] mapped:42576 shmem:65714 pagetables:1911 [ 1846.472379][T28945] sec_pagetables:0 bounce:0 [ 1846.472379][T28945] kernel_misc_reclaimable:0 [ 1846.472379][T28945] free:1024279 free_pcp:3192 free_cma:0 [ 1846.555005][T28945] Node 0 active_anon:276340kB inactive_anon:172kB active_file:22000kB inactive_file:234800kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:162092kB dirty:1108kB writeback:0kB shmem:251104kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:8192kB kernel_stack:13444kB pagetables:7472kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1846.603678][T28945] Node 1 active_anon:10216kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:8212kB dirty:4kB writeback:0kB shmem:11752kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1846.746988][T28945] Node 0 DMA free:11016kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:248kB local_pcp:124kB free_cma:0kB [ 1846.781375][T28945] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 1846.788910][T28945] Node 0 DMA32 free:163224kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:274096kB inactive_anon:172kB active_file:22000kB inactive_file:228656kB unevictable:1536kB writepending:1108kB zspages:0kB present:3129332kB managed:2551348kB mlocked:0kB bounce:0kB free_pcp:13564kB local_pcp:11852kB free_cma:0kB [ 1846.844827][T28945] lowmem_reserve[]: 0 0 0 0 0 [ 1846.850349][T28945] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:620kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1846.881458][T28945] lowmem_reserve[]: 0 0 0 0 0 [ 1846.888365][T28945] Node 1 Normal free:3922672kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:10216kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:7652kB local_pcp:4096kB free_cma:0kB [ 1846.993540][T28945] lowmem_reserve[]: 0 0 0 0 0 [ 1847.065663][ T5717] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 1847.217192][ T5717] usb 7-1: Using ep0 maxpacket: 16 [ 1847.224535][ T5717] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1847.252350][ T5717] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1847.265268][T28945] Node 0 DMA: 2*4kB (M) 2*8kB (M) 1*16kB (M) 1*32kB (M) 1*64kB (M) 3*128kB (M) 3*256kB (M) 1*512kB (M) 3*1024kB (UM) 1*2048kB (M) 1*4096kB (M) = 11016kB [ 1847.373023][ T5717] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1847.408154][ T5717] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1847.440503][ T5717] usb 7-1: Product: syz [ 1847.453531][T28945] Node 0 DMA32: 3025*4kB (UME) 2853*8kB (UME) 1357*16kB (UME) 1000*32kB (UME) 425*64kB (UME) 68*128kB (UME) 21*256kB (UME) 17*512kB (UM) 4*1024kB (UM) 7*2048kB (M) 1*4096kB (M) = 161148kB [ 1847.456928][T19285] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1847.484125][ T5717] usb 7-1: Manufacturer: syz [ 1847.503949][ T5717] usb 7-1: SerialNumber: syz [ 1847.520975][T19285] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1847.577912][ T5717] usb 7-1: config 0 descriptor?? [ 1847.586360][T19285] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 1847.630558][ T5717] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1847.640192][T19285] em28xx 6-1:0.0: No AC97 audio processor [ 1847.647734][ T5717] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1847.816962][T28945] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1847.888541][T28971] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 1847.988067][T28945] Node 1 Normal: 43*4kB (UM) 35*8kB (UM) 38*16kB (UME) 36*32kB (UME) 36*64kB (UME) 13*128kB (UM) 7*256kB (UM) 6*512kB (UME) 4*1024kB (UME) 2*2048kB (UE) 953*4096kB (M) = 3922724kB [ 1848.242081][T28945] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1848.494589][T28945] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1848.795567][T28945] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1848.936931][T28945] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1849.158256][T28945] 128252 total pagecache pages [ 1849.297079][T28945] 0 pages in swap cache [ 1849.407733][T28945] Free swap = 124996kB [ 1849.481815][T28945] Total swap = 124996kB [ 1849.592669][T28986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1849.617439][T28986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1849.634060][T28945] 2097051 pages RAM [ 1849.675538][T28945] 0 pages HighMem/MovableOnly [ 1849.710870][T28945] 427444 pages reserved [ 1849.733235][T28990] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7863'. [ 1849.750584][T28990] bond1: option mode: unable to set because the bond device has slaves [ 1849.765562][T28945] 0 pages cma reserved [ 1849.785924][T28989] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7863'. [ 1849.805259][T28989] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7863'. [ 1850.096300][ T5717] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 1850.104687][ T5717] em28xx 7-1:0.0: Config register raw data: 0xfffffffb [ 1850.112901][ T5717] em28xx 7-1:0.0: AC97 chip type couldn't be determined [ 1850.120726][ T5717] em28xx 7-1:0.0: No AC97 audio processor [ 1850.159249][ T5717] usb 7-1: USB disconnect, device number 33 [ 1850.169011][ T5717] em28xx 7-1:0.0: Disconnecting em28xx [ 1850.192624][ T5717] em28xx 7-1:0.0: Freeing device [ 1850.222952][T13453] usb 6-1: USB disconnect, device number 95 [ 1850.261854][T13453] em28xx 6-1:0.0: Disconnecting em28xx [ 1850.304464][T13453] em28xx 6-1:0.0: Freeing device [ 1850.366085][T28996] syzkaller0: entered promiscuous mode [ 1850.371853][T28996] syzkaller0: entered allmulticast mode [ 1850.392946][T28996] tipc: Started in network mode [ 1850.403848][T28996] tipc: Node identity 060f9edefe7b, cluster identity 4711 [ 1850.423788][T28996] tipc: Enabled bearer , priority 0 [ 1850.440744][T28995] tipc: Resetting bearer [ 1850.458834][T28994] kvm: pic: non byte read [ 1850.469258][T28994] kvm: pic: non byte read [ 1850.527018][T29001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1850.537828][T28995] tipc: Disabling bearer [ 1850.544281][T29001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1850.723525][ T5635] Bluetooth: hci2: ISO packet for unknown connection handle 0 [ 1851.616392][T19275] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 1851.796906][T19275] usb 7-1: Using ep0 maxpacket: 16 [ 1851.813727][T19275] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1851.845348][T19275] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 233, changing to 7 [ 1851.885122][T19275] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 240, changing to 7 [ 1851.925536][T19275] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1600, setting to 1024 [ 1851.956256][T19275] usb 7-1: language id specifier not provided by device, defaulting to English [ 1851.975381][T19275] usb 7-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1852.000397][T19275] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1852.055572][T19275] usb 7-1: Product: syz [ 1852.080219][T19275] usb 7-1: Manufacturer: ⯉褮恤ဤ烔᜞ꅰ넺猳Ⅼ몭Ѣ鏍￣츏Ṟ薹ਅ쉜ƛ⹏슌뿅듲 [ 1852.119831][T19275] usb 7-1: SerialNumber: syz [ 1852.871678][T29030] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7874'. [ 1852.993467][T29033] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7874'. [ 1853.144962][T29030] bond3: option mode: unable to set because the bond device has slaves [ 1853.289359][T29033] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7874'. [ 1853.411748][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 1853.419143][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 1854.917076][T19278] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 1855.106855][T19278] usb 6-1: Using ep0 maxpacket: 16 [ 1855.134063][T19278] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1855.156287][T19278] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1855.179472][T19278] usb 6-1: Product: syz [ 1855.200384][T19278] usb 6-1: Manufacturer: syz [ 1855.215196][T19278] usb 6-1: SerialNumber: syz [ 1855.245892][T19278] usb 6-1: config 0 descriptor?? [ 1855.684990][T29037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1855.694348][T29037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1855.704733][T19278] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1855.727962][T19278] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1855.756334][T19278] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1855.775704][T19278] usb 6-1: media controller created [ 1855.794811][T19278] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1855.858693][T19275] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 1856.369182][T19275] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1856.383720][T19278] zl10353_read_register: readreg error (reg=127, ret==0) [ 1856.401109][T19278] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1856.420461][T19275] usb 7-1: USB disconnect, device number 34 [ 1856.442424][T19278] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1856.497440][T19278] usb 6-1: USB disconnect, device number 96 [ 1856.623237][T19273] hid-generic 0000:0000:0000.0085: unknown main item tag 0x0 [ 1856.643959][T19278] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1856.662626][T19273] hid-generic 0000:0000:0000.0085: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1856.689473][ T5635] Bluetooth: hci6: ISO packet for unknown connection handle 0 [ 1858.557754][T19275] usb 6-1: new full-speed USB device number 97 using dummy_hcd [ 1858.779707][T19275] usb 6-1: config 0 has an invalid interface number: 146 but max is 0 [ 1858.800084][T19275] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1858.820784][T19275] usb 6-1: config 0 has no interface number 0 [ 1858.835919][T19275] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0x1C, changing to 0xC [ 1858.857261][T19275] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 1858.913425][T19275] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1858.964010][T19275] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 64 [ 1859.017627][T19275] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1859.057472][T19275] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1859.079683][T19275] usb 6-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1859.095743][T19275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1859.114295][T19275] usb 6-1: Product: syz [ 1859.131519][T19275] usb 6-1: Manufacturer: syz [ 1859.145558][T19275] usb 6-1: SerialNumber: syz [ 1859.159985][T19275] usb 6-1: config 0 descriptor?? [ 1859.171880][T29059] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1859.182344][T19275] usb 6-1: can only deal with bulk endpoints; endpoint 2 is not bulk. [ 1859.190933][T19275] usb 6-1: couldn't find two input bulk endpoints. Bailing out. [ 1859.289497][T29065] netlink: 8 bytes leftover after parsing attributes in process `syz.8.7886'. [ 1859.356519][T29070] netlink: 8 bytes leftover after parsing attributes in process `syz.8.7886'. [ 1859.367847][T29065] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1859.392045][T29059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1859.401376][T29059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1859.405019][T29070] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7886'. [ 1859.669950][T29070] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1859.702922][T29070] bond1: (slave bond0): making interface the new active one [ 1859.715616][T29070] bond1: (slave bond0): Enslaving as an active interface with an up link [ 1859.855670][T19278] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 1860.036491][T19278] usb 7-1: Using ep0 maxpacket: 8 [ 1860.058857][T19278] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1860.084092][T19278] usb 7-1: New USB device found, idVendor=17a1, idProduct=0128, bcdDevice= 5.f6 [ 1860.119273][T19278] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1860.169234][T19278] usb 7-1: Product: syz [ 1860.195672][T19278] usb 7-1: Manufacturer: syz [ 1860.219611][T19278] usb 7-1: SerialNumber: syz [ 1860.258565][T19278] usb 7-1: config 0 descriptor?? [ 1860.292353][T13449] usb 6-1: USB disconnect, device number 97 [ 1860.312664][T19278] gspca_main: t613-2.14.0 probing 17a1:0128 [ 1860.769174][T19278] gspca_t613: unknown sensor 0000 [ 1860.790756][T19278] t613 7-1:0.0: probe with driver t613 failed with error -22 [ 1860.856545][T19278] usb 7-1: USB disconnect, device number 35 [ 1861.795555][T13453] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 1862.030801][T13453] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1862.052283][T13453] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1862.079813][T13453] usb 6-1: Product: syz [ 1862.123980][T13453] usb 6-1: Manufacturer: syz [ 1862.137478][T13453] usb 6-1: SerialNumber: syz [ 1864.266240][T29122] FAULT_INJECTION: forcing a failure. [ 1864.266240][T29122] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1864.444200][T29122] CPU: 1 UID: 0 PID: 29122 Comm: syz.4.7898 Tainted: G L syzkaller #0 PREEMPT(full) [ 1864.444240][T29122] Tainted: [L]=SOFTLOCKUP [ 1864.444249][T29122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1864.444263][T29122] Call Trace: [ 1864.444273][T29122] [ 1864.444284][T29122] dump_stack_lvl+0xe8/0x150 [ 1864.444327][T29122] should_fail_ex+0x40c/0x560 [ 1864.444371][T29122] _copy_to_user+0x31/0xb0 [ 1864.444405][T29122] simple_read_from_buffer+0xe1/0x170 [ 1864.444438][T29122] proc_fail_nth_read+0x1bb/0x230 [ 1864.444467][T29122] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1864.444496][T29122] ? rw_verify_area+0x24a/0x4c0 [ 1864.444525][T29122] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1864.444549][T29122] vfs_read+0x213/0xa80 [ 1864.444583][T29122] ? __pfx___mutex_lock+0x10/0x10 [ 1864.444615][T29122] ? __pfx_vfs_read+0x10/0x10 [ 1864.444645][T29122] ? __fget_files+0x2a/0x420 [ 1864.444672][T29122] ? __fget_files+0x3a2/0x420 [ 1864.444695][T29122] ? __fget_files+0x2a/0x420 [ 1864.444728][T29122] ksys_read+0x150/0x270 [ 1864.444758][T29122] ? __pfx_ksys_read+0x10/0x10 [ 1864.444786][T29122] ? __pfx_ppp_ioctl+0x10/0x10 [ 1864.444976][T29122] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1864.445002][T29122] do_syscall_64+0x174/0x580 [ 1864.445030][T29122] ? trace_irq_disable+0x3b/0x140 [ 1864.445067][T29122] ? clear_bhb_loop+0x40/0x90 [ 1864.445098][T29122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1864.445120][T29122] RIP: 0033:0x7f0331b5d68e [ 1864.445141][T29122] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1864.445161][T29122] RSP: 002b:00007f03329f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1864.445185][T29122] RAX: ffffffffffffffda RBX: 00007f03329f66c0 RCX: 00007f0331b5d68e [ 1864.445200][T29122] RDX: 000000000000000f RSI: 00007f03329f60a0 RDI: 0000000000000005 [ 1864.445214][T29122] RBP: 00007f03329f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1864.445226][T29122] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1864.445239][T29122] R13: 00007f0331e16128 R14: 00007f0331e16090 R15: 00007f0331f3fa48 [ 1864.445271][T29122] [ 1864.941770][T13453] cdc_ncm 6-1:1.0: bind() failure [ 1865.018181][T13453] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 1865.035588][T13453] cdc_ncm 6-1:1.1: bind() failure [ 1865.084393][T13453] usb 6-1: USB disconnect, device number 98 [ 1865.492117][T29128] netlink: 'syz.5.7899': attribute type 21 has an invalid length. [ 1865.513992][T29130] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1865.573884][T29130] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1865.625663][T29133] program syz.8.7903 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1865.635614][T29128] netlink: 128 bytes leftover after parsing attributes in process `syz.5.7899'. [ 1865.678626][T29133] FAULT_INJECTION: forcing a failure. [ 1865.678626][T29133] name failslab, interval 1, probability 0, space 0, times 0 [ 1865.712194][T29133] CPU: 0 UID: 0 PID: 29133 Comm: syz.8.7903 Tainted: G L syzkaller #0 PREEMPT(full) [ 1865.712232][T29133] Tainted: [L]=SOFTLOCKUP [ 1865.712241][T29133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1865.712255][T29133] Call Trace: [ 1865.712264][T29133] [ 1865.712275][T29133] dump_stack_lvl+0xe8/0x150 [ 1865.712309][T29133] should_fail_ex+0x40c/0x560 [ 1865.712353][T29133] should_failslab+0xa8/0x100 [ 1865.712384][T29133] __kmalloc_cache_noprof+0xa8/0x660 [ 1865.712425][T29133] ? binder_get_thread+0x1c6/0x6d0 [ 1865.712589][T29133] ? binder_get_thread+0x1c6/0x6d0 [ 1865.712621][T29133] binder_get_thread+0x1c6/0x6d0 [ 1865.712651][T29133] binder_ioctl+0x2b8/0x1b00 [ 1865.712704][T29133] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1865.712737][T29133] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1865.712779][T29133] ? do_vfs_ioctl+0x116f/0x1530 [ 1865.712808][T29133] ? __pfx_binder_ioctl+0x10/0x10 [ 1865.712833][T29133] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1865.712876][T29133] ? hook_file_ioctl+0x1f0/0x5f0 [ 1865.712927][T29133] ? __fget_files+0x2a/0x420 [ 1865.712951][T29133] ? __fget_files+0x2a/0x420 [ 1865.712972][T29133] ? __fget_files+0x3a2/0x420 [ 1865.712991][T29133] ? __fget_files+0x2a/0x420 [ 1865.713016][T29133] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1865.713049][T29133] ? __pfx_binder_ioctl+0x10/0x10 [ 1865.713074][T29133] __se_sys_ioctl+0xfc/0x170 [ 1865.713103][T29133] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1865.713129][T29133] do_syscall_64+0x174/0x580 [ 1865.713157][T29133] ? trace_irq_disable+0x3b/0x140 [ 1865.713193][T29133] ? clear_bhb_loop+0x40/0x90 [ 1865.713222][T29133] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1865.713245][T29133] RIP: 0033:0x7f5d7459ce59 [ 1865.713267][T29133] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1865.713287][T29133] RSP: 002b:00007f5d75456028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1865.713313][T29133] RAX: ffffffffffffffda RBX: 00007f5d74815fa0 RCX: 00007f5d7459ce59 [ 1865.713330][T29133] RDX: 0000200000000240 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1865.713344][T29133] RBP: 00007f5d75456090 R08: 0000000000000000 R09: 0000000000000000 [ 1865.713359][T29133] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1865.713373][T29133] R13: 00007f5d74816038 R14: 00007f5d74815fa0 R15: 00007f5d7493fa48 [ 1865.713406][T29133] [ 1865.713417][T29133] binder: 29132:29133 ioctl c0306201 200000000240 returned -12 [ 1866.041521][T29128] netlink: 3 bytes leftover after parsing attributes in process `syz.5.7899'. [ 1866.078160][T29139] netlink: 'syz.5.7899': attribute type 21 has an invalid length. [ 1866.125808][T29139] netlink: 128 bytes leftover after parsing attributes in process `syz.5.7899'. [ 1866.140014][T29139] netlink: 3 bytes leftover after parsing attributes in process `syz.5.7899'. [ 1866.487830][T29147] syzkaller0: entered promiscuous mode [ 1866.500387][T29147] syzkaller0: entered allmulticast mode [ 1868.765050][T29169] vim2m vim2m.0: Fourcc format (0x47524247) invalid. [ 1868.789526][T29169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1868.809968][T29169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1869.715605][T19275] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 1869.881084][T19275] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1869.907474][T19275] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1869.940873][T19275] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1869.950298][T19275] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1869.958530][T19275] usb 7-1: SerialNumber: syz [ 1870.230607][T19275] usb 7-1: 0:2 : does not exist [ 1870.378276][T19275] usb 7-1: USB disconnect, device number 36 [ 1870.583207][T13453] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 1870.755593][T13453] usb 6-1: Using ep0 maxpacket: 16 [ 1870.762901][T13453] usb 6-1: config 1 has an invalid interface number: 62 but max is 0 [ 1870.775499][T13453] usb 6-1: config 1 has no interface number 0 [ 1870.788692][T13453] usb 6-1: config 1 interface 62 altsetting 253 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1870.807595][T13453] usb 6-1: config 1 interface 62 altsetting 253 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1870.818437][T13453] usb 6-1: config 1 interface 62 altsetting 253 bulk endpoint 0x3 has invalid maxpacket 0 [ 1870.828869][T13453] usb 6-1: config 1 interface 62 altsetting 253 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 1870.842688][T13453] usb 6-1: config 1 interface 62 has no altsetting 0 [ 1870.851105][T13453] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1870.854298][T29197] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1870.862401][T13453] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1870.891459][T29197] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1870.916784][T13453] usb 6-1: SerialNumber: syz [ 1870.937931][T13453] cdc_acm 6-1:1.62: probe with driver cdc_acm failed with error -12 [ 1870.968900][T29199] netlink: 140 bytes leftover after parsing attributes in process `syz.6.7920'. [ 1870.983327][T29199] netlink: 48 bytes leftover after parsing attributes in process `syz.6.7920'. [ 1871.006958][T29199] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7920'. [ 1871.169531][T13453] usb 6-1: USB disconnect, device number 99 [ 1872.367888][T29211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1872.389003][T29211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1872.681875][ T5635] Bluetooth: hci2: ISO packet for unknown connection handle 0 [ 1874.006259][T29229] vim2m vim2m.0: Fourcc format (0x47524247) invalid. [ 1874.296221][ T5717] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 1874.471837][ T5717] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 1874.509465][ T5717] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 1874.550358][ T5717] usb 7-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 1874.582629][ T5717] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1874.622991][ T5717] usb 7-1: Product: syz [ 1874.640433][ T5717] usb 7-1: Manufacturer: syz [ 1874.654578][ T5717] usb 7-1: SerialNumber: syz [ 1875.207173][T29247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1875.249860][T29247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1876.070569][ T5717] usb 7-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1876.093742][ T5717] usb 7-1: unit 6 not found! [ 1876.111166][ T5717] usb 7-1: unit 2 not found! [ 1876.522328][T29254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1876.532354][ T5717] usb 7-1: USB disconnect, device number 37 [ 1876.612691][T29254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1876.663798][T29252] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1876.690606][T29252] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1877.582346][T29258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1877.637997][T29258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1877.693058][T29258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1877.723898][T29258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1878.896505][ T5635] Bluetooth: hci0: ISO packet for unknown connection handle 0 [ 1879.755682][T19278] usb 7-1: new full-speed USB device number 38 using dummy_hcd [ 1879.982965][T19278] usb 7-1: config 0 has an invalid interface number: 147 but max is 0 [ 1879.998900][T19278] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1880.025488][T19278] usb 7-1: config 0 has no interface number 0 [ 1880.040988][T19278] usb 7-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 1880.058534][T19278] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1880.085501][T19278] usb 7-1: Product: syz [ 1880.086250][T29278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1880.089770][T19278] usb 7-1: Manufacturer: syz [ 1880.089792][T19278] usb 7-1: SerialNumber: syz [ 1880.112488][T29278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1880.136270][T19278] usb 7-1: config 0 descriptor?? [ 1880.167299][T19278] usb 7-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1880.396433][T19278] usb 7-1: USB disconnect, device number 38 [ 1880.404544][T19005] usb 7-1: Failed to submit usb control message: -71 [ 1880.428746][T19005] usb 7-1: unable to send the bmi data to the device: -71 [ 1880.454908][T19005] usb 7-1: unable to get target info from device [ 1880.471690][T19005] usb 7-1: could not get target info (-71) [ 1880.484639][T19005] usb 7-1: could not probe fw (-71) [ 1880.808482][T19289] hid-generic 0000:0000:0000.0086: unknown main item tag 0x0 [ 1880.844478][T19289] hid-generic 0000:0000:0000.0086: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1881.108741][T29287] kvm: pic: non byte read [ 1881.113521][T29287] kvm: pic: non byte read [ 1881.549618][T29293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1881.582810][T29293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1882.333472][T29304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1882.363984][T29304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1882.505658][T19273] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 1882.669948][T29306] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1882.707475][T29306] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1882.724280][T19273] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1882.760949][T19273] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1882.793275][T19273] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1882.832455][T19273] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1882.864263][T19273] usb 7-1: SerialNumber: syz [ 1883.655571][T19289] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 1883.839769][T19289] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1883.861617][T19289] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1883.899393][T19289] usb 6-1: config 0 descriptor?? [ 1883.917405][T19289] cp210x 6-1:0.0: cp210x converter detected [ 1884.301201][T29311] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1884.311059][T29311] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1884.452154][T19273] usb 7-1: 0:2 : does not exist [ 1884.487570][T29316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1884.507938][T29316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1884.539317][T19273] usb 7-1: USB disconnect, device number 39 [ 1885.624370][T19289] cp210x 6-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 1885.645508][T19289] cp210x 6-1:0.0: querying part number failed [ 1885.661269][T19289] usb 6-1: cp210x converter now attached to ttyUSB0 [ 1885.689074][T19289] usb 6-1: USB disconnect, device number 100 [ 1885.710432][T19289] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1885.745951][T19289] cp210x 6-1:0.0: device disconnected [ 1886.167312][ T5635] Bluetooth: hci0: ISO packet for unknown connection handle 0 [ 1886.360098][T13453] hid-generic 0000:0000:0000.0087: unknown main item tag 0x0 [ 1886.413873][T13453] hid-generic 0000:0000:0000.0087: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1887.095504][T13453] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 1887.258154][T13453] usb 6-1: config 1 has an invalid descriptor of length 105, skipping remainder of the config [ 1887.276130][T13453] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1887.298778][T13453] usb 6-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 1887.320279][T13453] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1887.336071][T13453] usb 6-1: Product: syz [ 1887.340459][T13453] usb 6-1: Manufacturer: syz [ 1887.349453][T13453] usb 6-1: SerialNumber: syz [ 1887.711498][T13453] usb 6-1: unit 47 not found! [ 1887.717566][T13453] usb 6-1: unit 102 not found! [ 1887.814844][T13453] usb 6-1: USB disconnect, device number 101 [ 1888.265836][T13453] usb 6-1: new full-speed USB device number 102 using dummy_hcd [ 1888.428299][T13453] usb 6-1: not running at top speed; connect to a high speed hub [ 1888.442410][T13453] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1888.453928][T13453] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1888.462535][T13453] usb 6-1: Product: 뗉䕉쉛⟏ႃ隼嬟冷膕㡞﷟颲渍剷㋦ሖ븰籇઴免䮞㶪㖅⫀솸煷洰餮籄囆ꨦ欏৫罢ᯕ俔妆ꆔ⃗㼁ȗ㿤瞣ѫ籵꿤䖙∜А䒋ᚿ니䈱잚없薀⚵ [ 1888.483696][T13453] usb 6-1: Manufacturer: љ [ 1888.488462][T13453] usb 6-1: SerialNumber: syz [ 1889.052720][T29358] syzkaller0: entered promiscuous mode [ 1889.093610][T29358] syzkaller0: entered allmulticast mode [ 1889.114891][T29359] tipc: Enabled bearer , priority 0 [ 1889.145247][T29357] tipc: Resetting bearer [ 1889.288143][T29357] tipc: Disabling bearer [ 1889.326255][T29361] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1889.364975][T29361] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1889.521529][T29361] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 1889.660254][T29361] syz.8.7966: vmalloc error: size 9223372036854775807, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1889.694217][T29361] CPU: 1 UID: 0 PID: 29361 Comm: syz.8.7966 Tainted: G L syzkaller #0 PREEMPT(full) [ 1889.694256][T29361] Tainted: [L]=SOFTLOCKUP [ 1889.694266][T29361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1889.694281][T29361] Call Trace: [ 1889.694291][T29361] [ 1889.694299][T29361] dump_stack_lvl+0xe8/0x150 [ 1889.694339][T29361] warn_alloc+0x24c/0x270 [ 1889.694383][T29361] ? __pfx_warn_alloc+0x10/0x10 [ 1889.694434][T29361] ? __mutex_trylock_common+0x15f/0x270 [ 1889.694472][T29361] __vmalloc_node_range_noprof+0x12c/0x1730 [ 1889.694513][T29361] ? rcu_is_watching+0x15/0xb0 [ 1889.694543][T29361] ? trace_contention_end+0x3d/0x140 [ 1889.694577][T29361] ? __mutex_lock+0x30d/0x1550 [ 1889.694612][T29361] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1889.694655][T29361] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1889.694694][T29361] ? dvb_dvr_do_ioctl+0x76/0x220 [ 1889.694735][T29361] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1889.694786][T29361] ? do_vfs_ioctl+0x116f/0x1530 [ 1889.694836][T29361] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 1889.694876][T29361] vmalloc_noprof+0xb2/0xe0 [ 1889.694912][T29361] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 1889.694952][T29361] dvb_dvr_do_ioctl+0x12b/0x220 [ 1889.694996][T29361] dvb_usercopy+0x199/0x2e0 [ 1889.695029][T29361] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 1889.695065][T29361] ? __pfx_dvb_usercopy+0x10/0x10 [ 1889.695111][T29361] ? __fget_files+0x3a2/0x420 [ 1889.695133][T29361] ? __fget_files+0x2a/0x420 [ 1889.695160][T29361] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 1889.695196][T29361] dvb_dvr_ioctl+0x29/0x40 [ 1889.695233][T29361] __se_sys_ioctl+0xfc/0x170 [ 1889.695263][T29361] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1889.695291][T29361] do_syscall_64+0x174/0x580 [ 1889.695318][T29361] ? trace_irq_disable+0x3b/0x140 [ 1889.695355][T29361] ? clear_bhb_loop+0x40/0x90 [ 1889.695385][T29361] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1889.695408][T29361] RIP: 0033:0x7f5d7459ce59 [ 1889.695429][T29361] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1889.695449][T29361] RSP: 002b:00007f5d75456028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1889.695472][T29361] RAX: ffffffffffffffda RBX: 00007f5d74815fa0 RCX: 00007f5d7459ce59 [ 1889.695490][T29361] RDX: 7fffffffffffffff RSI: 0000000000006f2d RDI: 000000000000000a [ 1889.695505][T29361] RBP: 00007f5d74632e6f R08: 0000000000000000 R09: 0000000000000000 [ 1889.695519][T29361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1889.695533][T29361] R13: 00007f5d74816038 R14: 00007f5d74815fa0 R15: 00007f5d7493fa48 [ 1889.695569][T29361] [ 1890.107216][T29361] Mem-Info: [ 1890.110396][T29361] active_anon:26123 inactive_anon:60061 isolated_anon:0 [ 1890.110396][T29361] active_file:5905 inactive_file:58233 isolated_file:0 [ 1890.110396][T29361] unevictable:768 dirty:369 writeback:0 [ 1890.110396][T29361] slab_reclaimable:16011 slab_unreclaimable:99682 [ 1890.110396][T29361] mapped:41576 shmem:80822 pagetables:1892 [ 1890.110396][T29361] sec_pagetables:0 bounce:0 [ 1890.110396][T29361] kernel_misc_reclaimable:0 [ 1890.110396][T29361] free:997867 free_pcp:11876 free_cma:0 [ 1890.120549][T13453] cdc_ncm 6-1:1.0: bind() failure [ 1890.167311][T29361] Node 0 active_anon:90940kB inactive_anon:240244kB active_file:23620kB inactive_file:232716kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:158092kB dirty:1476kB writeback:0kB shmem:308200kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB kernel_stack:13448kB pagetables:7296kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1890.203580][T29361] Node 1 active_anon:13552kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:8212kB dirty:0kB writeback:0kB shmem:15088kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1890.249945][T29361] Node 0 DMA free:10172kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:856kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:236kB local_pcp:124kB free_cma:0kB [ 1890.342918][T13453] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 1890.360460][T13453] cdc_ncm 6-1:1.1: bind() failure [ 1890.397895][T13453] usb 6-1: USB disconnect, device number 102 [ 1890.576223][T29361] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 1890.584133][T29361] Node 0 DMA32 free:65900kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:89936kB inactive_anon:240244kB active_file:23620kB inactive_file:232716kB unevictable:3936kB writepending:1476kB zspages:0kB present:3129332kB managed:2551348kB mlocked:2500kB bounce:0kB free_pcp:34836kB local_pcp:19000kB free_cma:0kB [ 1890.619366][T29361] lowmem_reserve[]: 0 0 0 0 0 [ 1890.624200][T29361] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:620kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1890.653878][T29361] lowmem_reserve[]: 0 0 0 0 0 [ 1890.659022][T29361] Node 1 Normal free:3913724kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:13552kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:12088kB local_pcp:6232kB free_cma:0kB [ 1890.785824][T29361] lowmem_reserve[]: 0 0 0 0 0 [ 1890.812083][T29361] Node 0 DMA: 1*4kB (M) 1*8kB (M) 1*16kB (M) 1*32kB (M) 0*64kB 1*128kB (M) 1*256kB (M) 1*512kB (M) 3*1024kB (UM) 1*2048kB (M) 1*4096kB (M) = 10172kB [ 1890.857204][T29361] Node 0 DMA32: 9*4kB (E) 127*8kB (ME) 537*16kB (ME) 494*32kB (UME) 221*64kB (UME) 39*128kB (UME) 15*256kB (UME) 8*512kB (U) 5*1024kB (UM) 4*2048kB (UM) 0*4096kB = 65836kB [ 1890.950706][T29361] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1891.027717][T29361] Node 1 Normal: 35*4kB (UM) 2*8kB (U) 8*16kB (UM) 7*32kB (UME) 6*64kB (UME) 5*128kB (UME) 2*256kB (UE) 4*512kB (UM) 4*1024kB (UME) 1*2048kB (E) 953*4096kB (M) = 3913724kB [ 1891.131273][T29361] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1891.189579][T29361] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1891.250569][T29361] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1891.326755][T29361] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1891.390051][T29361] 142874 total pagecache pages [ 1891.414678][T29361] 0 pages in swap cache [ 1891.449590][T29361] Free swap = 124996kB [ 1891.493570][T29361] Total swap = 124996kB [ 1891.507901][T29361] 2097051 pages RAM [ 1891.522107][T29361] 0 pages HighMem/MovableOnly [ 1891.568395][T29361] 427444 pages reserved [ 1891.603189][T29361] 0 pages cma reserved [ 1892.770422][T29390] netlink: 8 bytes leftover after parsing attributes in process `syz.8.7974'. [ 1893.706373][T29404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1893.738566][T29404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1894.322886][T29407] syzkaller0: entered promiscuous mode [ 1894.473956][T29407] syzkaller0: entered allmulticast mode [ 1894.677433][T29409] tipc: Started in network mode [ 1894.765833][T29409] tipc: Node identity f661d83afe17, cluster identity 4711 [ 1894.877813][T29409] tipc: Enabled bearer , priority 0 [ 1895.397082][T29406] tipc: Resetting bearer [ 1896.209570][T29437] kvm: pic: non byte read [ 1896.214260][T29437] kvm: pic: non byte read [ 1897.315050][T29406] tipc: Disabling bearer [ 1897.597942][T29432] tipc: Enabling of bearer rejected, failed to enable media [ 1897.693201][T13453] tipc: Node number set to 142006330 [ 1898.286556][T29456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1898.302107][T29456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1898.374177][T29458] random: crng reseeded on system resumption [ 1898.395614][ T7149] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 1898.590280][ T7149] usb 7-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1898.620301][ T7149] usb 7-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1898.645605][ T7149] usb 7-1: Product: syz [ 1898.655123][ T7149] usb 7-1: SerialNumber: syz [ 1898.670372][ T7149] usb 7-1: config 0 descriptor?? [ 1898.845806][T13453] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 1898.868097][T29463] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1898.877804][T29463] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1899.015524][T13453] usb 6-1: Using ep0 maxpacket: 16 [ 1899.026669][T13453] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1899.039027][T13453] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1899.068707][T13453] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1899.082336][T13453] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1899.094682][ T5717] usb 7-1: USB disconnect, device number 40 [ 1899.104756][T13453] usb 6-1: Product: syz [ 1899.121669][T13453] usb 6-1: Manufacturer: syz [ 1899.136318][T13453] usb 6-1: SerialNumber: syz [ 1899.150033][T13453] usb 6-1: config 0 descriptor?? [ 1899.161299][T13453] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1899.171565][T13453] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1899.447115][T29461] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 1899.526385][T29470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1899.552502][T29470] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1899.793613][T29472] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1899.809360][T29472] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1899.825855][T29461] syz.5.7993: vmalloc error: size 9223372036854775807, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1899.881467][T29461] CPU: 0 UID: 0 PID: 29461 Comm: syz.5.7993 Tainted: G L syzkaller #0 PREEMPT(full) [ 1899.881508][T29461] Tainted: [L]=SOFTLOCKUP [ 1899.881517][T29461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1899.881532][T29461] Call Trace: [ 1899.881541][T29461] [ 1899.881551][T29461] dump_stack_lvl+0xe8/0x150 [ 1899.881596][T29461] warn_alloc+0x24c/0x270 [ 1899.881641][T29461] ? __pfx_warn_alloc+0x10/0x10 [ 1899.881691][T29461] ? __mutex_trylock_common+0x15f/0x270 [ 1899.881726][T29461] __vmalloc_node_range_noprof+0x12c/0x1730 [ 1899.881765][T29461] ? rcu_is_watching+0x15/0xb0 [ 1899.881795][T29461] ? trace_contention_end+0x3d/0x140 [ 1899.881828][T29461] ? __mutex_lock+0x30d/0x1550 [ 1899.881864][T29461] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1899.881899][T29461] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1899.881928][T29461] ? dvb_dvr_do_ioctl+0x76/0x220 [ 1899.881967][T29461] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1899.882001][T29461] ? do_vfs_ioctl+0x116f/0x1530 [ 1899.882043][T29461] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 1899.882080][T29461] vmalloc_noprof+0xb2/0xe0 [ 1899.882114][T29461] ? dvb_dvr_do_ioctl+0x12b/0x220 [ 1899.882153][T29461] dvb_dvr_do_ioctl+0x12b/0x220 [ 1899.882196][T29461] dvb_usercopy+0x199/0x2e0 [ 1899.882226][T29461] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 1899.882262][T29461] ? __pfx_dvb_usercopy+0x10/0x10 [ 1899.882305][T29461] ? __fget_files+0x3a2/0x420 [ 1899.882328][T29461] ? __fget_files+0x2a/0x420 [ 1899.882352][T29461] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 1899.882388][T29461] dvb_dvr_ioctl+0x29/0x40 [ 1899.882423][T29461] __se_sys_ioctl+0xfc/0x170 [ 1899.882452][T29461] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1899.882478][T29461] do_syscall_64+0x174/0x580 [ 1899.882503][T29461] ? trace_irq_disable+0x3b/0x140 [ 1899.882540][T29461] ? clear_bhb_loop+0x40/0x90 [ 1899.882568][T29461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1899.882599][T29461] RIP: 0033:0x7fc27659ce59 [ 1899.882621][T29461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1899.882642][T29461] RSP: 002b:00007fc277388028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1899.882667][T29461] RAX: ffffffffffffffda RBX: 00007fc276815fa0 RCX: 00007fc27659ce59 [ 1899.882684][T29461] RDX: 7fffffffffffffff RSI: 0000000000006f2d RDI: 000000000000000a [ 1899.882699][T29461] RBP: 00007fc276632e6f R08: 0000000000000000 R09: 0000000000000000 [ 1899.882713][T29461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1899.882728][T29461] R13: 00007fc276816038 R14: 00007fc276815fa0 R15: 00007fc27693fa48 [ 1899.882765][T29461] [ 1899.882860][T29461] Mem-Info: [ 1900.157206][T29461] active_anon:27785 inactive_anon:74245 isolated_anon:375 [ 1900.157206][T29461] active_file:6703 inactive_file:51534 isolated_file:50 [ 1900.157206][T29461] unevictable:768 dirty:203 writeback:0 [ 1900.157206][T29461] slab_reclaimable:17970 slab_unreclaimable:98399 [ 1900.157206][T29461] mapped:41553 shmem:97046 pagetables:1933 [ 1900.157206][T29461] sec_pagetables:0 bounce:0 [ 1900.157206][T29461] kernel_misc_reclaimable:0 [ 1900.157206][T29461] free:991430 free_pcp:7840 free_cma:0 [ 1900.345759][T19278] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 1900.395146][T29461] Node 0 active_anon:87012kB inactive_anon:295380kB active_file:26812kB inactive_file:206020kB unevictable:3236kB isolated(anon):0kB isolated(file):0kB mapped:158100kB dirty:812kB writeback:0kB shmem:359340kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13624kB pagetables:7544kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1900.537773][T19278] usb 7-1: Using ep0 maxpacket: 32 [ 1900.580978][T19278] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1900.604839][T19278] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 1900.618937][T19278] usb 7-1: can't read configurations, error -71 [ 1900.631153][T29461] Node 1 active_anon:27328kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:5632kB isolated(anon):0kB isolated(file):0kB mapped:8212kB dirty:0kB writeback:0kB shmem:28844kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB kernel_stack:64kB pagetables:188kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1900.671871][T29461] Node 0 DMA free:10408kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:856kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1900.703815][T29461] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 1900.710544][T29461] Node 0 DMA32 free:71380kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:87212kB inactive_anon:294424kB active_file:26812kB inactive_file:206020kB unevictable:5632kB writepending:812kB zspages:0kB present:3129332kB managed:2551348kB mlocked:4160kB bounce:0kB free_pcp:2176kB local_pcp:2048kB free_cma:0kB [ 1900.806881][T29461] lowmem_reserve[]: 0 0 0 0 0 [ 1900.811885][T29461] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:620kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1901.018891][T29484] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.7999'. [ 1901.173744][T29461] lowmem_reserve[]: 0 0 0 0 0 [ 1901.337506][T29461] Node 1 Normal free:3905612kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27328kB inactive_anon:0kB active_file:0kB inactive_file:4312kB unevictable:1536kB writepending:0kB zspages:608kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1901.376206][T13453] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1901.388123][T13453] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1901.462346][T13453] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 1901.489289][T13453] em28xx 6-1:0.0: No AC97 audio processor [ 1901.674545][T29461] lowmem_reserve[]: 0 0 0 0 0 [ 1901.730465][T29461] Node 0 DMA: 6*4kB (M) 4*8kB (M) 3*16kB (M) 2*32kB (M) 0*64kB 0*128kB 2*256kB (M) 1*512kB (M) 3*1024kB (UM) 1*2048kB (M) 1*4096kB (M) = 10408kB [ 1901.812282][T29461] Node 0 DMA32: 1259*4kB (UME) 484*8kB (UE) 263*16kB (UE) 377*32kB (UME) 206*64kB (UE) 44*128kB (UE) 11*256kB (UME) 9*512kB (U) 1*1024kB (M) 0*2048kB 0*4096kB = 52444kB [ 1901.847438][T29461] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1901.863505][T29461] Node 1 Normal: 177*4kB (UM) 77*8kB (UM) 52*16kB (UME) 49*32kB (UME) 31*64kB (UME) 8*128kB (UME) 2*256kB (UM) 4*512kB (UM) 3*1024kB (UME) 3*2048kB (UE) 949*4096kB (UM) = 3905612kB [ 1901.883071][T29461] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1901.937832][T29496] syzkaller0: entered promiscuous mode [ 1901.969085][T29496] syzkaller0: entered allmulticast mode [ 1902.001804][T29496] tipc: Started in network mode [ 1902.026146][T29496] tipc: Node identity 763dd65d979f, cluster identity 4711 [ 1902.041370][T29461] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1902.071420][T29496] tipc: Enabled bearer , priority 0 [ 1902.123365][T29495] tipc: Resetting bearer [ 1902.180890][T29461] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1902.213789][T29495] tipc: Disabling bearer [ 1902.291514][T29461] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1902.425939][T29461] 155252 total pagecache pages [ 1902.475364][T29461] 0 pages in swap cache [ 1902.493455][T29461] Free swap = 124788kB [ 1902.501471][T29461] Total swap = 124996kB [ 1902.507004][T29461] 2097051 pages RAM [ 1902.511160][T29461] 0 pages HighMem/MovableOnly [ 1902.517026][T29461] 427444 pages reserved [ 1902.522066][T29461] 0 pages cma reserved [ 1902.687476][T29510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1902.698374][T29510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1902.752204][T29510] bond2: entered promiscuous mode [ 1902.766397][T29510] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1903.161109][T19278] usb 6-1: USB disconnect, device number 103 [ 1903.169720][T19278] em28xx 6-1:0.0: Disconnecting em28xx [ 1903.190423][T19278] em28xx 6-1:0.0: Freeing device [ 1903.974383][T29530] syzkaller1: entered promiscuous mode [ 1903.990966][T29530] syzkaller1: entered allmulticast mode [ 1904.526193][T29536] kvm: pic: non byte read [ 1904.543743][T29536] kvm: pic: non byte read [ 1904.710067][T29540] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1904.730781][T29540] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1905.188713][T29540] gretap0: refused to change device tx_queue_len [ 1905.209447][T29540] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1905.366070][T13453] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 1905.535564][T13453] usb 7-1: Using ep0 maxpacket: 16 [ 1905.544339][T13453] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1905.554370][T13453] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 233, changing to 7 [ 1905.567684][T13453] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 240, changing to 7 [ 1905.583786][T13453] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1600, setting to 1024 [ 1905.599924][T13453] usb 7-1: language id specifier not provided by device, defaulting to English [ 1905.611765][T13453] usb 7-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1905.624715][T13453] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1905.634105][T13453] usb 7-1: Product: syz [ 1905.639178][T13453] usb 7-1: Manufacturer: ⯉褮恤ဤ烔᜞ꅰ넺猳Ⅼ몭Ѣ鏍￣츏Ṟ薹ਅ쉜ƛ⹏슌뿅듲 [ 1905.655499][T13453] usb 7-1: SerialNumber: syz [ 1905.820043][T29554] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1905.833697][T29554] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1905.891348][T29554] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 1906.583401][T13453] usb 7-1: Audio class v2/v3 interfaces need an interface association [ 1906.741808][T13453] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1906.785057][T13453] usb 7-1: USB disconnect, device number 43 [ 1907.301377][T29567] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8024'. [ 1907.317411][T29567] bond2: option mode: unable to set because the bond device has slaves [ 1907.343318][T29567] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8024'. [ 1907.375543][T29567] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8024'. [ 1907.923758][T29578] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.8027'. [ 1909.896678][ T5717] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1910.055744][ T5717] usb 6-1: Using ep0 maxpacket: 16 [ 1910.069479][ T5717] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1910.083993][ T5717] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1910.101247][ T5717] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1910.114241][ T5717] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1910.130557][ T5717] usb 6-1: Product: syz [ 1910.140616][ T5717] usb 6-1: Manufacturer: syz [ 1910.154727][ T5717] usb 6-1: SerialNumber: syz [ 1910.170093][ T5717] usb 6-1: config 0 descriptor?? [ 1910.192044][ T5717] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1910.205699][ T5717] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1910.305617][ T7149] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 1910.443770][T29589] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 1910.535748][ T7149] usb 7-1: device descriptor read/64, error -71 [ 1910.808137][ T7149] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 1910.976012][ T7149] usb 7-1: device descriptor read/64, error -71 [ 1911.108656][ T7149] usb usb7-port1: attempt power cycle [ 1911.125952][ T5717] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1911.139439][ T5717] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1911.185579][ T5717] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 1911.240746][ T5717] em28xx 6-1:0.0: No AC97 audio processor [ 1911.344267][ T5717] usb 6-1: USB disconnect, device number 104 [ 1911.387813][ T5717] em28xx 6-1:0.0: Disconnecting em28xx [ 1911.451444][ T5717] em28xx 6-1:0.0: Freeing device [ 1911.515625][ T7149] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 1911.566395][ T7149] usb 7-1: device descriptor read/8, error -71 [ 1911.890464][ T7149] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 1911.968209][ T7149] usb 7-1: device descriptor read/8, error -71 [ 1912.085822][ T7149] usb usb7-port1: unable to enumerate USB device [ 1912.513964][T29615] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8036'. [ 1912.644850][T29616] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8036'. [ 1912.672055][T29615] bond3: option mode: unable to set because the bond device has slaves [ 1912.746257][T29616] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8036'. [ 1913.329453][ T7149] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 1913.506019][ T7149] usb 7-1: Using ep0 maxpacket: 8 [ 1913.516738][ T7149] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1913.531704][ T7149] usb 7-1: New USB device found, idVendor=17a1, idProduct=0128, bcdDevice= 5.f6 [ 1913.566070][ T7149] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1913.597529][ T7149] usb 7-1: Product: syz [ 1913.609329][ T7149] usb 7-1: Manufacturer: syz [ 1913.632209][ T7149] usb 7-1: SerialNumber: syz [ 1913.653412][ T7149] usb 7-1: config 0 descriptor?? [ 1913.683005][ T7149] gspca_main: t613-2.14.0 probing 17a1:0128 [ 1913.746380][T19278] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1913.938604][T19278] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 1913.966164][T19278] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2e22, bcdDevice= 0.00 [ 1913.987538][T19278] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1914.029433][T19278] usb 6-1: config 0 descriptor?? [ 1914.053944][T29631] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 1914.080136][ T7149] gspca_t613: unknown sensor 0000 [ 1914.094068][ T7149] t613 7-1:0.0: probe with driver t613 failed with error -22 [ 1914.145260][ T7149] usb 7-1: USB disconnect, device number 48 [ 1914.694035][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.716472][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.729130][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.746574][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.764385][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.782490][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.790441][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.806286][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.818289][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 1914.824875][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 1914.847946][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.887340][T19278] koneplus 0003:1E7D:2E22.0088: unknown main item tag 0x0 [ 1914.942771][T19278] koneplus 0003:1E7D:2E22.0088: hidraw0: USB HID v7b.fd Device [HID 1e7d:2e22] on usb-dummy_hcd.5-1/input0 [ 1915.042691][ T5635] Bluetooth: hci1: ISO packet for unknown connection handle 0 [ 1915.141757][T29649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1915.183979][T29649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1915.221706][T29650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1915.237002][T29650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1915.861567][T29653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1915.886531][T29655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1915.889874][T29653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1915.900039][T29655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1916.045052][T29659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1916.068446][T29659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1916.218053][T29664] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8050'. [ 1916.240588][T29664] bond1: option mode: unable to set because the bond device has slaves [ 1916.267959][T29664] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8050'. [ 1916.289843][T29664] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8050'. [ 1916.603953][T29668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1916.631996][T29668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1917.592960][T29676] netlink: 8 bytes leftover after parsing attributes in process `syz.8.8053'. [ 1917.604595][T29676] netlink: 12 bytes leftover after parsing attributes in process `syz.8.8053'. [ 1917.683979][T29677] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8053'. [ 1918.816804][ T5717] usb 6-1: USB disconnect, device number 105 [ 1919.455523][ T5717] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1919.574053][T29700] netlink: 8 bytes leftover after parsing attributes in process `syz.8.8061'. [ 1919.605823][T29700] bond1: option mode: unable to set because the bond device has slaves [ 1919.631227][T29702] netlink: 8 bytes leftover after parsing attributes in process `syz.8.8061'. [ 1919.654608][ T5717] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 1919.666654][T29702] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8061'. [ 1919.691238][ T5717] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1919.716870][ T5717] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1919.756802][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1919.801538][ T5717] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1919.831690][ T5717] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1919.869002][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1919.920281][ T5717] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1919.948024][ T5717] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1919.980448][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1920.001156][ T5717] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1920.030376][ T5717] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1920.061666][T29704] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1920.082323][T29704] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1920.091063][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1920.117111][ T5717] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1920.117164][ T5717] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1920.117197][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1920.118136][ T5717] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1920.118187][ T5717] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1920.118220][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1920.120558][ T5717] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1920.211215][T29705] snd_virmidi snd_virmidi.0: control 0:57412:0:syz0:0 is already present [ 1920.275536][ T5717] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1920.305659][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1920.327936][ T5717] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1920.357033][ T5717] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1920.391876][ T5717] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1920.407905][ T5717] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1920.417563][ T5717] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1920.426223][ T5717] usb 6-1: Product: syz [ 1920.430446][ T5717] usb 6-1: Manufacturer: syz [ 1920.435092][ T5717] usb 6-1: SerialNumber: syz [ 1920.455140][ T5717] usb 6-1: config 0 descriptor?? [ 1920.491218][ T5717] yurex 6-1:0.0: USB YUREX device now attached to Yurex #0 [ 1920.851439][ T5635] Bluetooth: hci6: ISO packet for unknown connection handle 0 [ 1920.932574][T29716] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1920.982780][T29716] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1921.454546][ T5717] usb 6-1: USB disconnect, device number 106 [ 1921.473642][ T5717] yurex 6-1:0.0: USB YUREX #0 now disconnected [ 1923.649436][T29738] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8072'. [ 1923.673858][T29738] bond1: option mode: unable to set because the bond device has slaves [ 1923.693964][T29738] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8072'. [ 1923.708380][T29738] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8072'. [ 1924.627237][T19275] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 1924.805550][T19275] usb 7-1: Using ep0 maxpacket: 32 [ 1924.833473][T19275] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1924.882078][T19275] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1924.923483][T19275] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1924.956604][T19275] usb 7-1: Product: syz [ 1924.973287][T19275] usb 7-1: Manufacturer: syz [ 1924.988706][T19275] usb 7-1: SerialNumber: syz [ 1925.024343][T19275] usb 7-1: config 0 descriptor?? [ 1925.047658][T29758] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1925.311771][T19275] usb 7-1: USB disconnect, device number 49 [ 1925.324836][T29764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1925.344863][T29764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1925.982281][T29768] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1926.006599][T29768] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1926.236178][T29768] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1926.268533][T29768] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1927.027958][T29781] netlink: 8 bytes leftover after parsing attributes in process `syz.8.8084'. [ 1927.080210][T29782] netlink: 8 bytes leftover after parsing attributes in process `syz.8.8084'. [ 1927.101051][T29782] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8084'. [ 1927.113271][T29781] bond1: option mode: unable to set because the bond device has slaves [ 1927.205844][T29785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1927.229261][T29785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1927.472383][T29791] kvm: pic: non byte read [ 1927.478316][T29791] kvm: pic: non byte read [ 1928.075246][T29807] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1928.084842][T29807] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1928.097105][T29807] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1928.106877][T29807] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1928.745142][T29815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1928.789476][T29815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1928.822941][T29815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1928.833072][T29819] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8096'. [ 1928.842515][T29819] bond1: option mode: unable to set because the bond device has slaves [ 1928.853219][T29819] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8096'. [ 1928.862337][T29815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1928.864016][T29819] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8096'. [ 1929.025621][T19275] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 1929.155681][T19278] usb 6-1: new full-speed USB device number 107 using dummy_hcd [ 1929.185699][T19275] usb 7-1: Using ep0 maxpacket: 8 [ 1929.193957][T19275] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1929.209457][T19275] usb 7-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1929.221645][T19275] usb 7-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1929.231918][T19275] usb 7-1: Product: syz [ 1929.236648][T19275] usb 7-1: Manufacturer: syz [ 1929.241821][T19275] usb 7-1: SerialNumber: syz [ 1929.321086][T19278] usb 6-1: config 0 has an invalid interface number: 147 but max is 0 [ 1929.332236][T19278] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1929.343945][T19278] usb 6-1: config 0 has no interface number 0 [ 1929.354637][T19278] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 1929.365642][T19278] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1929.373903][T19278] usb 6-1: Product: syz [ 1929.379760][T19278] usb 6-1: Manufacturer: syz [ 1929.384642][T19278] usb 6-1: SerialNumber: syz [ 1929.397774][T19278] usb 6-1: config 0 descriptor?? [ 1929.435247][T19278] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1929.466460][T19275] usb 7-1: Handspring Visor / Palm OS: No valid connect info available [ 1929.475051][T19275] usb 7-1: Handspring Visor / Palm OS: port 83, is for Debugger use [ 1929.483631][T19275] usb 7-1: Handspring Visor / Palm OS: port 171, is for unknown use [ 1929.492894][T19275] usb 7-1: Handspring Visor / Palm OS: Number of ports: 2 [ 1929.611559][T19005] usb 6-1: Failed to submit usb control message: -71 [ 1929.620213][T19278] usb 6-1: USB disconnect, device number 107 [ 1929.629751][T19005] usb 6-1: unable to send the bmi data to the device: -71 [ 1929.641414][T19005] usb 6-1: unable to get target info from device [ 1929.652328][T19005] usb 6-1: could not get target info (-71) [ 1929.661414][T19005] usb 6-1: could not probe fw (-71) [ 1929.676019][T19275] visor 7-1:1.0: Handspring Visor / Palm OS converter detected [ 1929.709027][T19275] usb 7-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 1929.737913][T19275] usb 7-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 1929.885625][ T5717] usb 7-1: USB disconnect, device number 50 [ 1929.899534][ T5717] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 1929.913578][ T5717] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 1929.925171][ T5717] visor 7-1:1.0: device disconnected [ 1931.450676][T29851] netlink: 20 bytes leftover after parsing attributes in process `syz.6.8104'. [ 1931.481771][T29851] netdevsim netdevsim6 netdevsim0: entered allmulticast mode [ 1931.509835][T29851] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1931.866680][T29856] input: syz1 as /devices/virtual/input/input230 [ 1931.985080][T29858] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8107'. [ 1931.995621][T29858] bond2: option mode: unable to set because the bond device has slaves [ 1932.006659][T29858] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8107'. [ 1932.016349][T29858] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8107'. [ 1932.375539][T19278] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 1932.526754][T19278] usb 7-1: Using ep0 maxpacket: 8 [ 1932.534408][T19278] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1932.547362][T19278] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 255, changing to 11 [ 1932.562532][T19278] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 1932.579210][T19278] usb 7-1: New USB device found, idVendor=10c4, idProduct=8acf, bcdDevice= 0.00 [ 1932.592309][T19278] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1932.605744][T19278] usb 7-1: config 0 descriptor?? [ 1933.128782][T19278] usbhid 7-1:0.0: can't add hid device: -71 [ 1933.145081][T19278] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1933.168998][T19278] usb 7-1: USB disconnect, device number 51 [ 1933.311883][T29877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1933.328529][T29877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1935.197380][T29900] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8119'. [ 1935.228873][T29900] bond1: option mode: unable to set because the bond device has slaves [ 1935.254723][T29902] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8119'. [ 1935.311083][T29902] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8119'. [ 1935.512363][T29906] input: syz1 as /devices/virtual/input/input231 [ 1935.543717][T29912] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 1936.954104][T29921] kvm: pic: non byte read [ 1936.966779][T29921] kvm: pic: non byte read [ 1937.612549][T29926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1937.626961][T29926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1937.666263][T29929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1937.679807][T29929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1937.692135][T29929] FAULT_INJECTION: forcing a failure. [ 1937.692135][T29929] name failslab, interval 1, probability 0, space 0, times 0 [ 1937.705311][T29929] CPU: 1 UID: 0 PID: 29929 Comm: syz.8.8128 Tainted: G L syzkaller #0 PREEMPT(full) [ 1937.705347][T29929] Tainted: [L]=SOFTLOCKUP [ 1937.705356][T29929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1937.705370][T29929] Call Trace: [ 1937.705384][T29929] [ 1937.705393][T29929] dump_stack_lvl+0xe8/0x150 [ 1937.705426][T29929] should_fail_ex+0x40c/0x560 [ 1937.705464][T29929] ? io_alloc_cache_init+0x42/0x140 [ 1937.705575][T29929] should_failslab+0xa8/0x100 [ 1937.705604][T29929] __kvmalloc_node_noprof+0x176/0x860 [ 1937.705632][T29929] ? __kvmalloc_node_noprof+0x35c/0x860 [ 1937.705654][T29929] ? io_alloc_cache_init+0x42/0x140 [ 1937.705684][T29929] io_alloc_cache_init+0x42/0x140 [ 1937.705711][T29929] io_ring_ctx_alloc+0x4ee/0xc40 [ 1937.705756][T29929] io_uring_create+0x50/0x990 [ 1937.705788][T29929] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1937.705813][T29929] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1937.705844][T29929] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1937.705888][T29929] ? __pfx_ksys_write+0x10/0x10 [ 1937.705925][T29929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1937.705951][T29929] do_syscall_64+0x174/0x580 [ 1937.705976][T29929] ? trace_irq_disable+0x3b/0x140 [ 1937.706012][T29929] ? clear_bhb_loop+0x40/0x90 [ 1937.706041][T29929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1937.706064][T29929] RIP: 0033:0x7f5d7459ce59 [ 1937.706086][T29929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1937.706106][T29929] RSP: 002b:00007f5d75455ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1937.706130][T29929] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007f5d7459ce59 [ 1937.706147][T29929] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 00000000000003c9 [ 1937.706162][T29929] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 1937.706177][T29929] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 1937.706192][T29929] R13: 0000200000000890 R14: 00007f5d75455fd8 R15: 0000000000000000 [ 1937.706226][T29929] [ 1938.585527][T13453] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1938.687206][T29938] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8131'. [ 1938.715606][T29938] bond1: option mode: unable to set because the bond device has slaves [ 1938.726994][T29938] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8131'. [ 1938.736275][T29938] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8131'. [ 1938.759591][T13453] usb 6-1: too many configurations: 53, using maximum allowed: 8 [ 1938.817488][T13453] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1938.835492][T13453] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1938.848886][T13453] usb 6-1: Product: syz [ 1938.853144][T13453] usb 6-1: Manufacturer: syz [ 1938.858302][T13453] usb 6-1: SerialNumber: syz [ 1938.886281][T29942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1938.913179][T29942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1938.921751][T29943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1938.947029][T29943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1939.066553][T29942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1939.087118][T29942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1939.095855][T29943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1939.126216][T29943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1939.254673][T13453] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1939.283690][T13453] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1939.324166][T13453] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1939.382727][T29954] input: syz1 as /devices/virtual/input/input232 [ 1939.469977][T13453] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 1939.495595][T13453] usb 6-1: USB disconnect, device number 108 [ 1940.055530][T19278] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 1940.195553][T19278] usb 7-1: device descriptor read/64, error -71 [ 1940.388764][T19275] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1940.465582][T19278] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 1940.574624][T29971] netlink: 8 bytes leftover after parsing attributes in process `syz.8.8141'. [ 1940.585548][T19275] usb 6-1: Using ep0 maxpacket: 32 [ 1940.605339][T19275] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1940.616588][T19278] usb 7-1: device descriptor read/64, error -71 [ 1940.634764][T19275] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1940.666539][T19275] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1940.685614][T19275] usb 6-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 1940.704364][T19275] usb 6-1: Product: syz [ 1940.708971][T19275] usb 6-1: Manufacturer: syz [ 1940.735762][T19278] usb usb7-port1: attempt power cycle [ 1940.741457][T19275] hub 6-1:4.0: USB hub found [ 1940.943242][T19275] hub 6-1:4.0: 2 ports detected [ 1941.101891][T19278] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 1941.166267][T19278] usb 7-1: device descriptor read/8, error -71 [ 1941.254253][T29973] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8143'. [ 1941.284432][T29973] bond1: option mode: unable to set because the bond device has slaves [ 1941.327687][T29973] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8143'. [ 1941.348250][T29973] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8143'. [ 1941.465514][T19278] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 1941.486489][T29959] bridge0: port 3(netdevsim0) entered blocking state [ 1941.515908][T19278] usb 7-1: device descriptor read/8, error -71 [ 1941.626828][T29959] bridge0: port 3(netdevsim0) entered disabled state [ 1941.637117][T19278] usb usb7-port1: unable to enumerate USB device [ 1941.844389][T29959] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 1942.495475][T28714] Bluetooth: hci0: command 0x0406 tx timeout [ 1942.620232][T29959] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 1942.988848][T19275] hub 6-1:4.0: set hub depth failed [ 1943.050878][T29987] input: syz1 as /devices/virtual/input/input233 [ 1943.055026][T19275] usb 6-1: USB disconnect, device number 109 [ 1943.564597][T29997] netlink: 24 bytes leftover after parsing attributes in process `syz.6.8148'. [ 1943.844677][T29990] netlink: 388 bytes leftover after parsing attributes in process `syz.6.8148'. [ 1944.406085][T30011] geneve2: entered promiscuous mode [ 1944.450255][T30011] geneve2: entered allmulticast mode [ 1945.332086][T30020] kvm: pic: non byte read [ 1945.356284][T30020] kvm: pic: non byte read [ 1946.203767][T30033] netlink: 128 bytes leftover after parsing attributes in process `syz.7.8160'. [ 1946.794659][T30044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1946.816643][ T30] INFO: task syz.0.7735:28488 blocked for more than 143 seconds. [ 1946.844371][ T30] Tainted: G L syzkaller #0 [ 1946.875608][T30044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1946.907046][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1946.958869][ T30] task:syz.0.7735 state:D stack:26680 pid:28488 tgid:28487 ppid:24979 task_flags:0x400040 flags:0x00080006 [ 1947.033280][ T30] Call Trace: [ 1947.059897][ T30] [ 1947.082255][ T30] __schedule+0x17d9/0x56c0 [ 1947.113080][ T30] ? __lock_acquire+0x683/0x2cf0 [ 1947.143691][ T30] ? __pfx___schedule+0x10/0x10 [ 1947.170662][ T30] ? schedule+0x90/0x2b0 [ 1947.191512][ T30] schedule+0x164/0x2b0 [ 1947.216228][ T30] schedule_preempt_disabled+0x13/0x30 [ 1947.231331][ T30] rwsem_down_read_slowpath+0x6ba/0x920 [ 1947.246904][ T30] ? rwsem_down_read_slowpath+0x57f/0x920 [ 1947.269654][ T30] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 1947.289255][ T30] down_read+0x9c/0x330 [ 1947.300372][ T30] ? super_lock+0xe0/0x3d0 [ 1947.314211][ T30] super_lock+0x2d6/0x3d0 [ 1947.325220][ T30] ? __pfx_super_lock+0x10/0x10 [ 1947.338811][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 1947.353643][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 1947.374226][ T30] __iterate_supers+0x120/0x240 [ 1947.393092][ T30] ? __pfx_sync_inodes_one_sb+0x10/0x10 [ 1947.417044][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1947.441350][ T30] __ia32_sys_sync+0xa0/0x120 [ 1947.459827][ T30] ? __pfx___ia32_sys_sync+0x10/0x10 [ 1947.482199][ T30] ? do_syscall_64+0x9d/0x580 [ 1947.498162][ T30] do_syscall_64+0x174/0x580 [ 1947.521001][ T30] ? trace_irq_disable+0x3b/0x140 [ 1947.540625][ T30] ? clear_bhb_loop+0x40/0x90 [ 1947.560007][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1947.582726][ T30] RIP: 0033:0x7f5e31f9ce59 [ 1947.597959][ T30] RSP: 002b:00007f5e32df6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 1947.635818][ T30] RAX: ffffffffffffffda RBX: 00007f5e32215fa0 RCX: 00007f5e31f9ce59 [ 1947.671191][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1947.705611][ T30] RBP: 00007f5e32215fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1947.740879][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1947.777306][ T30] R13: 00007f5e32216038 R14: 00007f5e32215fa0 R15: 00007f5e3233fa48 [ 1947.819026][ T30] [ 1947.834426][ T30] INFO: task syz.0.7735:28491 blocked for more than 144 seconds. [ 1947.871266][ T30] Tainted: G L syzkaller #0 [ 1947.902213][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1947.944416][ T30] task:syz.0.7735 state:D stack:28808 pid:28491 tgid:28487 ppid:24979 task_flags:0x400040 flags:0x00080006 [ 1947.993462][ T30] Call Trace: [ 1948.003628][ T30] [ 1948.038357][ T30] __schedule+0x17d9/0x56c0 [ 1948.059591][ T30] ? __lock_acquire+0x13e8/0x2cf0 [ 1948.080623][ T30] ? __pfx___schedule+0x10/0x10 [ 1948.106094][ T30] ? schedule+0x90/0x2b0 [ 1948.121566][ T30] schedule+0x164/0x2b0 [ 1948.136969][ T30] schedule_preempt_disabled+0x13/0x30 [ 1948.161337][ T30] rwsem_down_read_slowpath+0x6ba/0x920 [ 1948.185813][ T30] ? rwsem_down_read_slowpath+0x57f/0x920 [ 1948.214495][ T30] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 1948.244406][ T30] down_read+0x9c/0x330 [ 1948.267620][ T30] ? super_lock+0xe0/0x3d0 [ 1948.284417][ T30] super_lock+0x2d6/0x3d0 [ 1948.299042][ T30] ? __pfx_super_lock+0x10/0x10 [ 1948.314769][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 1948.334705][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 1948.352683][ T30] __iterate_supers+0x120/0x240 [ 1948.372378][ T30] ? __pfx_sync_inodes_one_sb+0x10/0x10 [ 1948.390782][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1948.410610][ T30] __ia32_sys_sync+0xa0/0x120 [ 1948.427871][ T30] ? __pfx___ia32_sys_sync+0x10/0x10 [ 1948.447196][ T30] ? do_syscall_64+0x9d/0x580 [ 1948.459969][ T30] do_syscall_64+0x174/0x580 [ 1948.476667][ T30] ? trace_irq_disable+0x3b/0x140 [ 1948.482920][ T30] ? clear_bhb_loop+0x40/0x90 [ 1948.494659][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1948.509203][ T30] RIP: 0033:0x7f5e31f9ce59 [ 1948.520026][ T30] RSP: 002b:00007f5e32dd5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 1948.542509][ T30] RAX: ffffffffffffffda RBX: 00007f5e32216090 RCX: 00007f5e31f9ce59 [ 1948.561101][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1948.581748][ T30] RBP: 00007f5e32216090 R08: 0000000000000000 R09: 0000000000000000 [ 1948.605956][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1948.637191][ T30] R13: 00007f5e32216128 R14: 00007f5e32216090 R15: 00007f5e3233fa48 [ 1948.658896][ T30] [ 1948.668285][ T30] INFO: task syz.0.7735:28492 blocked for more than 145 seconds. [ 1948.686070][ T30] Tainted: G L syzkaller #0 [ 1948.701546][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1948.722247][ T30] task:syz.0.7735 state:D stack:28808 pid:28492 tgid:28487 ppid:24979 task_flags:0x400040 flags:0x00080006 [ 1948.751735][ T30] Call Trace: [ 1948.761917][ T30] [ 1948.769215][ T30] __schedule+0x17d9/0x56c0 [ 1948.780925][ T30] ? __lock_acquire+0x683/0x2cf0 [ 1948.791408][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 1948.803705][ T30] ? __pfx___schedule+0x10/0x10 [ 1948.820975][ T30] ? schedule+0x90/0x2b0 [ 1948.833132][ T30] schedule+0x164/0x2b0 [ 1948.843493][ T30] schedule_preempt_disabled+0x13/0x30 [ 1948.855230][ T30] rwsem_down_read_slowpath+0x6ba/0x920 [ 1948.871237][ T30] ? rwsem_down_read_slowpath+0x57f/0x920 [ 1948.886367][ T30] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 1948.903736][ T30] down_read+0x9c/0x330 [ 1948.913188][ T30] ? super_lock+0xe0/0x3d0 [ 1948.925941][ T30] super_lock+0x2d6/0x3d0 [ 1948.935678][ T30] ? __pfx_super_lock+0x10/0x10 [ 1948.953390][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 1948.969494][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 1948.993521][ T30] __iterate_supers+0x120/0x240 [ 1949.009340][ T30] ? __pfx_sync_inodes_one_sb+0x10/0x10 [ 1949.030614][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1949.050896][ T30] __ia32_sys_sync+0xa0/0x120 [ 1949.063941][ T30] ? __pfx___ia32_sys_sync+0x10/0x10 [ 1949.081667][ T30] ? do_syscall_64+0x9d/0x580 [ 1949.105432][ T30] do_syscall_64+0x174/0x580 [ 1949.114185][ T30] ? trace_irq_disable+0x3b/0x140 [ 1949.125546][ T30] ? clear_bhb_loop+0x40/0x90 [ 1949.136463][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1949.154809][ T30] RIP: 0033:0x7f5e31f9ce59 [ 1949.159506][ T30] RSP: 002b:00007f5e32db4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 1949.181241][ T30] RAX: ffffffffffffffda RBX: 00007f5e32216180 RCX: 00007f5e31f9ce59 [ 1949.197533][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1949.215529][ T30] RBP: 00007f5e32216180 R08: 0000000000000000 R09: 0000000000000000 [ 1949.246187][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1949.263330][ T30] R13: 00007f5e32216218 R14: 00007f5e32216180 R15: 00007f5e3233fa48 [ 1949.284220][ T30] [ 1949.290886][ T30] INFO: task syz.0.7735:28494 blocked for more than 145 seconds. [ 1949.323963][ T30] Tainted: G L syzkaller #0 [ 1949.343326][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1949.376860][ T30] task:syz.0.7735 state:D stack:28808 pid:28494 tgid:28487 ppid:24979 task_flags:0x400040 flags:0x00080006 [ 1949.422404][ T30] Call Trace: [ 1949.440458][ T30] [ 1949.453635][ T30] __schedule+0x17d9/0x56c0 [ 1949.475217][ T30] ? __lock_acquire+0x683/0x2cf0 [ 1949.498251][ T30] ? wakeup_preempt_fair+0x745/0xb10 [ 1949.516486][ T30] ? __pfx___schedule+0x10/0x10 [ 1949.540293][ T30] ? schedule+0x90/0x2b0 [ 1949.555317][ T30] schedule+0x164/0x2b0 [ 1949.570993][ T30] schedule_preempt_disabled+0x13/0x30 [ 1949.590535][ T30] rwsem_down_read_slowpath+0x6ba/0x920 [ 1949.611596][ T30] ? rwsem_down_read_slowpath+0x57f/0x920 [ 1949.631001][ T30] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 1949.651398][ T30] down_read+0x9c/0x330 [ 1949.657470][ T30] ? super_lock+0xe0/0x3d0 [ 1949.662185][ T30] super_lock+0x2d6/0x3d0 [ 1949.667026][ T30] ? __pfx_super_lock+0x10/0x10 [ 1949.672125][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 1949.677799][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 1949.683196][ T30] __iterate_supers+0x120/0x240 [ 1949.689179][ T30] ? __pfx_sync_inodes_one_sb+0x10/0x10 [ 1949.694965][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1949.704087][ T30] __ia32_sys_sync+0xa0/0x120 [ 1949.709246][ T30] ? __pfx___ia32_sys_sync+0x10/0x10 [ 1949.714716][ T30] ? do_syscall_64+0x9d/0x580 [ 1949.719900][ T30] do_syscall_64+0x174/0x580 [ 1949.724693][ T30] ? trace_irq_disable+0x3b/0x140 [ 1949.730251][ T30] ? clear_bhb_loop+0x40/0x90 [ 1949.735107][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1949.741495][ T30] RIP: 0033:0x7f5e31f9ce59 [ 1949.758410][ T30] RSP: 002b:00007f5e32d93028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 1949.778958][ T30] RAX: ffffffffffffffda RBX: 00007f5e32216270 RCX: 00007f5e31f9ce59 [ 1949.797776][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1949.817428][ T30] RBP: 00007f5e32216270 R08: 0000000000000000 R09: 0000000000000000 [ 1949.835959][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1949.864174][ T30] R13: 00007f5e32216308 R14: 00007f5e32216270 R15: 00007f5e3233fa48 [ 1949.887895][ T30] [ 1949.900164][ T30] INFO: task syz.0.7735:28496 blocked for more than 146 seconds. [ 1949.923482][ T30] Tainted: G L syzkaller #0 [ 1949.942654][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1949.965345][ T30] task:syz.0.7735 state:D stack:28808 pid:28496 tgid:28487 ppid:24979 task_flags:0x400040 flags:0x00080006 [ 1949.996354][ T30] Call Trace: [ 1949.999731][ T30] [ 1950.002706][ T30] __schedule+0x17d9/0x56c0 [ 1950.015172][ T30] ? __lock_acquire+0x683/0x2cf0 [ 1950.045492][ T30] ? __pfx___schedule+0x10/0x10 [ 1950.052132][ T30] ? schedule+0x90/0x2b0 [ 1950.059313][ T30] schedule+0x164/0x2b0 [ 1950.075477][ T30] schedule_preempt_disabled+0x13/0x30 [ 1950.082560][ T30] rwsem_down_read_slowpath+0x6ba/0x920 [ 1950.095627][ T30] ? rwsem_down_read_slowpath+0x57f/0x920 [ 1950.115439][ T30] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 1950.123188][ T30] down_read+0x9c/0x330 [ 1950.136265][ T30] ? super_lock+0xe0/0x3d0 [ 1950.142319][ T30] super_lock+0x2d6/0x3d0 [ 1950.155473][ T30] ? __pfx_super_lock+0x10/0x10 [ 1950.163420][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 1950.175442][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 1950.189518][ T30] __iterate_supers+0x120/0x240 [ 1950.205440][ T30] ? __pfx_sync_inodes_one_sb+0x10/0x10 [ 1950.213594][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1950.227771][ T30] __ia32_sys_sync+0xa0/0x120 [ 1950.238706][ T30] ? __pfx___ia32_sys_sync+0x10/0x10 [ 1950.255492][ T30] ? do_syscall_64+0x9d/0x580 [ 1950.261802][ T30] do_syscall_64+0x174/0x580 [ 1950.275444][ T30] ? trace_irq_disable+0x3b/0x140 [ 1950.283544][ T30] ? clear_bhb_loop+0x40/0x90 [ 1950.295440][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1950.307954][ T30] RIP: 0033:0x7f5e31f9ce59 [ 1950.316955][ T30] RSP: 002b:00007f5e32d72028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [ 1950.335835][ T30] RAX: ffffffffffffffda RBX: 00007f5e32216360 RCX: 00007f5e31f9ce59 [ 1950.355539][ T30] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1950.375495][ T30] RBP: 00007f5e32216360 R08: 0000000000000000 R09: 0000000000000000 [ 1950.395500][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1950.407191][ T30] R13: 00007f5e322163f8 R14: 00007f5e32216360 R15: 00007f5e3233fa48 [ 1950.435674][ T30] [ 1950.447081][ T30] [ 1950.447081][ T30] Showing all locks held in the system: [ 1950.470007][ T30] 2 locks held by ksoftirqd/1/23: [ 1950.485630][ T30] 1 lock held by khungtaskd/30: [ 1950.493536][ T30] #0: ffffffff8e959c20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1950.516961][ T30] 2 locks held by udevd/4991: [ 1950.527034][ T30] 2 locks held by getty/5381: [ 1950.545489][ T30] #0: ffff888033b090a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1950.560778][ T30] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 1950.587665][ T30] 1 lock held by syz.1.7433/27416: [ 1950.599948][ T30] 1 lock held by syz.0.7735/28488: [ 1950.615465][ T30] #0: ffff888028dba0d8 (&type->s_umount_key#55){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 [ 1950.638508][ T30] 1 lock held by syz.0.7735/28491: [ 1950.646728][ T30] #0: ffff888028dba0d8 (&type->s_umount_key#55){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 [ 1950.676541][ T30] 1 lock held by syz.0.7735/28492: [ 1950.688848][ T30] #0: ffff888028dba0d8 (&type->s_umount_key#55){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 [ 1950.715449][ T30] 1 lock held by syz.0.7735/28494: [ 1950.722172][ T30] #0: ffff888028dba0d8 (&type->s_umount_key#55){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 [ 1950.747162][ T30] 1 lock held by syz.0.7735/28496: [ 1950.758398][ T30] #0: ffff888028dba0d8 (&type->s_umount_key#55){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 [ 1950.786565][ T30] 2 locks held by syz.6.8154/30014: [ 1950.793021][ T30] 1 lock held by syz.5.8156/30031: [ 1950.806266][ T30] 2 locks held by syz.8.8163/30044: [ 1950.820789][ T30] #0: ffffffff8fdecec0 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x767/0xc00 [ 1950.847065][ T30] #1: ffffffff8e95ff28 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 1950.873783][ T30] 1 lock held by syz.8.8163/30046: [ 1950.885544][ T30] #0: ffffffff8fdecec0 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x767/0xc00 [ 1950.915692][ T30] [ 1950.918270][ T30] ============================================= [ 1950.918270][ T30] [ 1950.938135][ T30] NMI backtrace for cpu 0 [ 1950.938162][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1950.938191][ T30] Tainted: [L]=SOFTLOCKUP [ 1950.938199][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1950.938212][ T30] Call Trace: [ 1950.938221][ T30] [ 1950.938232][ T30] dump_stack_lvl+0xe8/0x150 [ 1950.938265][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 1950.938302][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1950.938332][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 1950.938371][ T30] sys_info+0x135/0x170 [ 1950.938402][ T30] watchdog+0xfd7/0x1030 [ 1950.938444][ T30] ? watchdog+0x1c7/0x1030 [ 1950.938485][ T30] kthread+0x388/0x470 [ 1950.938512][ T30] ? __pfx_watchdog+0x10/0x10 [ 1950.938544][ T30] ? __pfx_kthread+0x10/0x10 [ 1950.938570][ T30] ret_from_fork+0x514/0xb70 [ 1950.938600][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1950.938626][ T30] ? __switch_to+0xc89/0x1420 [ 1950.938664][ T30] ? __pfx_kthread+0x10/0x10 [ 1950.938690][ T30] ret_from_fork_asm+0x1a/0x30 [ 1950.938743][ T30] [ 1950.938752][ T30] Sending NMI from CPU 0 to CPUs 1: [ 1951.058022][ C1] NMI backtrace for cpu 1 [ 1951.058043][ C1] CPU: 1 UID: 0 PID: 29969 Comm: syz.4.8142 Tainted: G L syzkaller #0 PREEMPT(full) [ 1951.058070][ C1] Tainted: [L]=SOFTLOCKUP [ 1951.058077][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1951.058088][ C1] RIP: 0010:__kasan_check_write+0x0/0x20 [ 1951.058124][ C1] Code: 48 8b 0c 24 31 d2 e9 8f e5 ff ff 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 89 f6 48 8b 0c 24 ba 01 00 00 00 e9 5c e5 ff ff 66 66 [ 1951.058140][ C1] RSP: 0018:ffffc90003fdf1d8 EFLAGS: 00000246 [ 1951.058158][ C1] RAX: ffffffff820582bd RBX: ffffea000194f9f4 RCX: ffff888030df3e00 [ 1951.058173][ C1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea000194f9c0 [ 1951.058186][ C1] RBP: ffffc90003fdf330 R08: ffffea000194f9c7 R09: 1ffffd4000329f38 [ 1951.058206][ C1] R10: dffffc0000000000 R11: fffff94000329f39 R12: ffffc90003fdf660 [ 1951.058221][ C1] R13: 0000000000000000 R14: 0000000000004df7 R15: ffffea000194f9c0 [ 1951.058234][ C1] FS: 0000000000000000(0000) GS:ffff888125320000(0000) knlGS:0000000000000000 [ 1951.058250][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1951.058263][ C1] CR2: 000055557f37c4e8 CR3: 000000007ed30000 CR4: 00000000003526f0 [ 1951.058280][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1951.058292][ C1] DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1951.058304][ C1] Call Trace: [ 1951.058311][ C1] [ 1951.058319][ C1] find_lock_entries+0x604/0xad0 [ 1951.058350][ C1] ? find_lock_entries+0x12a/0xad0 [ 1951.058378][ C1] ? __pfx_find_lock_entries+0x10/0x10 [ 1951.058408][ C1] ? folio_batch_remove_exceptionals+0x183/0x1f0 [ 1951.058441][ C1] shmem_undo_range+0x2c7/0x15d0 [ 1951.058470][ C1] ? __pfx_shmem_undo_range+0x10/0x10 [ 1951.058522][ C1] ? __lock_acquire+0x683/0x2cf0 [ 1951.058545][ C1] ? stack_trace_save+0xa9/0x100 [ 1951.058576][ C1] shmem_evict_inode+0x280/0xa80 [ 1951.058609][ C1] ? inode_wait_for_writeback+0x16d/0x3b0 [ 1951.058635][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1951.058664][ C1] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 1951.058688][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 1951.058721][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 1951.058749][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1951.058777][ C1] evict+0x624/0xb50 [ 1951.058807][ C1] ? __pfx_evict+0x10/0x10 [ 1951.058831][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 1951.058859][ C1] ? _raw_spin_unlock+0x28/0x50 [ 1951.058877][ C1] ? iput+0xb84/0xf00 [ 1951.058898][ C1] dentry_kill+0x1b9/0x880 [ 1951.058925][ C1] finish_dput+0x1a/0x260 [ 1951.058945][ C1] __fput+0x675/0xa50 [ 1951.058967][ C1] task_work_run+0x1d9/0x270 [ 1951.058991][ C1] ? __pfx_task_work_run+0x10/0x10 [ 1951.059014][ C1] ? do_exit+0x735/0x2360 [ 1951.059033][ C1] ? kmem_cache_free+0x182/0x650 [ 1951.059051][ C1] ? put_net+0x191/0x260 [ 1951.059080][ C1] do_exit+0x73a/0x2360 [ 1951.059105][ C1] ? __pfx_do_exit+0x10/0x10 [ 1951.059126][ C1] ? proc_coredump_connector+0x187/0x4e0 [ 1951.059285][ C1] do_group_exit+0x22d/0x2f0 [ 1951.059306][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1951.059326][ C1] get_signal+0x121b/0x12c0 [ 1951.059365][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 1951.059397][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1951.059440][ C1] irqentry_exit+0x2ba/0x8f0 [ 1951.059461][ C1] ? trace_irq_disable+0x3b/0x140 [ 1951.059493][ C1] asm_exc_page_fault+0x26/0x30 [ 1951.059512][ C1] RIP: 0033:0x7f0331a52b27 [ 1951.059529][ C1] Code: Unable to access opcode bytes at 0x7f0331a52afd. [ 1951.059538][ C1] RSP: 002b:00007f03329f8120 EFLAGS: 00010202 [ 1951.059555][ C1] RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f0331b9ce59 [ 1951.059567][ C1] RDX: 00007f03329f8140 RSI: 00007f03329f8270 RDI: 000000000000000b [ 1951.059581][ C1] RBP: 00007f0331c32e6f R08: 0000000000000000 R09: 0000000000000000 [ 1951.059593][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1951.059604][ C1] R13: 00007f0331e16038 R14: 00007f0331e15fa0 R15: 00007f0331f3fa48 [ 1951.059628][ C1] [ 1951.542776][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 1951.549696][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1951.560414][ T30] Tainted: [L]=SOFTLOCKUP [ 1951.564860][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1951.574938][ T30] Call Trace: [ 1951.578227][ T30] [ 1951.581182][ T30] vpanic+0x56c/0xa60 [ 1951.585200][ T30] ? __pfx___schedule+0x10/0x10 [ 1951.590073][ T30] ? __pfx_vpanic+0x10/0x10 [ 1951.594618][ T30] ? nmi_trigger_cpumask_backtrace+0x207/0x380 [ 1951.600836][ T30] panic+0xc5/0xd0 [ 1951.604585][ T30] ? __pfx_panic+0x10/0x10 [ 1951.609040][ T30] ? preempt_schedule_common+0x82/0xd0 [ 1951.614579][ T30] ? preempt_schedule_thunk+0x16/0x40 [ 1951.619970][ T30] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 1951.626167][ T30] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 1951.632357][ T30] watchdog+0x1030/0x1030 [ 1951.636722][ T30] ? watchdog+0x1c7/0x1030 [ 1951.641196][ T30] kthread+0x388/0x470 [ 1951.645302][ T30] ? __pfx_watchdog+0x10/0x10 [ 1951.650025][ T30] ? __pfx_kthread+0x10/0x10 [ 1951.654652][ T30] ret_from_fork+0x514/0xb70 [ 1951.659261][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1951.664402][ T30] ? __switch_to+0xc89/0x1420 [ 1951.669127][ T30] ? __pfx_kthread+0x10/0x10 [ 1951.673754][ T30] ret_from_fork_asm+0x1a/0x30 [ 1951.678551][ T30] [ 1951.682155][ T30] Kernel Offset: disabled [ 1951.686535][ T30] Rebooting in 86400 seconds..