last executing test programs: 15m9.896441215s ago: executing program 2 (id=557): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0xe8c00) pselect6(0x2000, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x8}, 0x0, 0x0) 15m9.205606759s ago: executing program 2 (id=560): setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x50483}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @gre={{0x8}, {0x4}}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) 15m9.029419981s ago: executing program 2 (id=562): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x10c5408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) 15m8.871652859s ago: executing program 2 (id=564): r0 = socket(0x10, 0x3, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x805, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe(0x0) syz_pidfd_open(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) setpgid(r1, r1) setpgid(0x0, r1) mount$9p_fd(0x0, 0x0, 0x0, 0x10000, 0x0) mount$afs(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x18408e, 0x0) r2 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_READY(r2, 0x9360, 0x800000000000001) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0xe4}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000004a00611400000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="ecfff4ff"], 0x1c}}, 0x40000c0) 15m8.421758656s ago: executing program 2 (id=565): io_uring_enter(0xffffffffffffffff, 0x708, 0x41e3, 0x0, 0x0, 0x0) r0 = fsopen(0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x3f, 0x0) io_uring_enter(0xffffffffffffffff, 0x3516, 0x3e44, 0x8, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 15m8.153734397s ago: executing program 2 (id=566): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) socket$inet_udplite(0x2, 0x2, 0x88) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000003bc0)=[{{&(0x7f00000002c0)=@can, 0x80, &(0x7f0000000480)=[{&(0x7f0000000340)}, {&(0x7f0000000400)=""/124, 0x7c}], 0x2, &(0x7f0000000600)=""/204, 0xcc}, 0x3}, {{&(0x7f0000000700)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000000940)=[{&(0x7f0000000780)=""/139, 0x8b}, {&(0x7f0000000840)=""/122, 0x7a}, {&(0x7f00000008c0)=""/108, 0x6c}], 0x3, &(0x7f0000000980)=""/98, 0x62}, 0x7}, {{&(0x7f0000000a00)=@nfc_llcp, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000a80)=""/34, 0x22}, {&(0x7f0000000ac0)=""/16, 0x10}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/156, 0x9c}], 0x4, &(0x7f0000000cc0)=""/17, 0x11}, 0x6}, {{&(0x7f0000000d00)=@qipcrtr, 0x80, &(0x7f0000001e00)=[{&(0x7f0000000d80)=""/4093, 0xffd}, {&(0x7f0000001d80)=""/91, 0x5b}], 0x2, &(0x7f0000001e40)}}, {{&(0x7f0000001e80)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f0000002080)=[{&(0x7f0000001f00)=""/53, 0x35}, {&(0x7f0000001f40)=""/106, 0x6a}, {&(0x7f0000002000)=""/92, 0x5c}], 0x3, &(0x7f00000020c0)=""/229, 0xe5}, 0x5a5}, {{&(0x7f00000021c0)=@sco, 0x80, &(0x7f0000002380), 0x0, &(0x7f00000023c0)=""/4089, 0xff9}}, {{&(0x7f00000033c0)=@in={0x2, 0x0, @dev}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003440)=""/90, 0x5a}], 0x1}, 0x3}, {{0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000003500)=""/254, 0xfe}, {&(0x7f0000003600)=""/64, 0x40}, {&(0x7f0000003640)=""/194, 0xc2}, {&(0x7f0000003740)}, {&(0x7f0000003780)=""/40, 0x28}, {&(0x7f00000037c0)=""/11, 0xb}, {&(0x7f0000003800)=""/193, 0xc1}, {&(0x7f0000003900)=""/74, 0x4a}, {&(0x7f0000003980)=""/89, 0x59}], 0x9, &(0x7f0000003ac0)=""/211, 0xd3}, 0x1000}], 0x8, 0x40000022, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8004, 0x0, 0x9, 0x7, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) fsopen(0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000200), 0x8, 0x2) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) sendmmsg$inet6(r0, &(0x7f0000000380)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x8, @dev={0xfe, 0x80, '\x00', 0x1d}, 0x9}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000001fc0)="dc080082a584fa7c61", 0x9}], 0x1}}], 0x1, 0x4c040) 15m7.789085075s ago: executing program 32 (id=566): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) socket$inet_udplite(0x2, 0x2, 0x88) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000003bc0)=[{{&(0x7f00000002c0)=@can, 0x80, &(0x7f0000000480)=[{&(0x7f0000000340)}, {&(0x7f0000000400)=""/124, 0x7c}], 0x2, &(0x7f0000000600)=""/204, 0xcc}, 0x3}, {{&(0x7f0000000700)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000000940)=[{&(0x7f0000000780)=""/139, 0x8b}, {&(0x7f0000000840)=""/122, 0x7a}, {&(0x7f00000008c0)=""/108, 0x6c}], 0x3, &(0x7f0000000980)=""/98, 0x62}, 0x7}, {{&(0x7f0000000a00)=@nfc_llcp, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000a80)=""/34, 0x22}, {&(0x7f0000000ac0)=""/16, 0x10}, {&(0x7f0000000b00)=""/191, 0xbf}, {&(0x7f0000000bc0)=""/156, 0x9c}], 0x4, &(0x7f0000000cc0)=""/17, 0x11}, 0x6}, {{&(0x7f0000000d00)=@qipcrtr, 0x80, &(0x7f0000001e00)=[{&(0x7f0000000d80)=""/4093, 0xffd}, {&(0x7f0000001d80)=""/91, 0x5b}], 0x2, &(0x7f0000001e40)}}, {{&(0x7f0000001e80)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f0000002080)=[{&(0x7f0000001f00)=""/53, 0x35}, {&(0x7f0000001f40)=""/106, 0x6a}, {&(0x7f0000002000)=""/92, 0x5c}], 0x3, &(0x7f00000020c0)=""/229, 0xe5}, 0x5a5}, {{&(0x7f00000021c0)=@sco, 0x80, &(0x7f0000002380), 0x0, &(0x7f00000023c0)=""/4089, 0xff9}}, {{&(0x7f00000033c0)=@in={0x2, 0x0, @dev}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003440)=""/90, 0x5a}], 0x1}, 0x3}, {{0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000003500)=""/254, 0xfe}, {&(0x7f0000003600)=""/64, 0x40}, {&(0x7f0000003640)=""/194, 0xc2}, {&(0x7f0000003740)}, {&(0x7f0000003780)=""/40, 0x28}, {&(0x7f00000037c0)=""/11, 0xb}, {&(0x7f0000003800)=""/193, 0xc1}, {&(0x7f0000003900)=""/74, 0x4a}, {&(0x7f0000003980)=""/89, 0x59}], 0x9, &(0x7f0000003ac0)=""/211, 0xd3}, 0x1000}], 0x8, 0x40000022, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8004, 0x0, 0x9, 0x7, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) fsopen(0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000200), 0x8, 0x2) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) sendmmsg$inet6(r0, &(0x7f0000000380)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x8, @dev={0xfe, 0x80, '\x00', 0x1d}, 0x9}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000001fc0)="dc080082a584fa7c61", 0x9}], 0x1}}], 0x1, 0x4c040) 3m21.0114824s ago: executing program 1 (id=3010): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f0000000340)={0x6, {{0x2, 0x4e23, @multicast2}}, {{0x2, 0x4e23, @remote}}}, 0x108) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/mcfilter\x00') pread64(r2, &(0x7f00000001c0)=""/144, 0x90, 0x100000001) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = dup3(0xffffffffffffffff, r3, 0x0) socket(0x8, 0x80002, 0xfffffffe) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x1000a, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) accept4$nfc_llcp(r4, 0x0, &(0x7f0000000040), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_open_dev$sg(&(0x7f0000000300), 0x0, 0xca942) syz_open_dev$sg(&(0x7f0000000080), 0xf9ba, 0x14b082) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x401, 0x0) ioctl$COMEDI_SETRSUBD(r7, 0x6410) close(0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) 3m17.191124965s ago: executing program 1 (id=3022): r0 = socket$inet(0x2, 0x1, 0x0) r1 = landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) syz_io_uring_setup(0x110, &(0x7f0000000140), &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0xfffffffffffffffb, &(0x7f0000000000)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000040)=@IORING_OP_TEE={0x21, 0x24, 0x0, @fd_index=0x2, 0x0, 0x0, 0xffff, 0x7, 0x0, {0x0, r4, r0}}) syz_usb_connect(0x3, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="120100009db9b720c82d0c88fcef010203010902240001000010000904910002ff47d00009050c020002fe000009058203200001000573a19d439595c4e4ff99f7dfcc6cb451adb572c015001bbbb16f053f2ecebb872e30203e031fb70eb465d167e71a96f1dc4dac22b32000ec4e7b811d0b1594de5940f1258c0dfed43d8a0a6d77bdc9d6b671593b712d4d5da6a0f4a42a2676755d1b3d5c3b37c369934ec0d40961e3636335b6996780bbd52d2223a88508af77c7"], 0x0) landlock_restrict_self(r1, 0x4) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r5, 0x2, &(0x7f0000001080)={0x3, 0x6}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000001140), r5) sendmsg$DEVLINK_CMD_RATE_NEW(r5, 0x0, 0x800) ioctl$IOCTL_STATUS_ACCEL_DEV(r5, 0x40046103, &(0x7f00000000c0)={0x4, 0x8000, 0x8, 0x7, 0x3, 0x5, 0x0, 0x8f, 0xe7, 0x0, 0x7, "c7afdee501a053ea27f7d2771be60d6b0fdca5dec4aa74528609a07b15b91b5d"}) bind$inet(r0, &(0x7f0000e15000)={0x2, 0x4e20, @multicast1}, 0x10) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x185) fallocate(r6, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r6, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r6, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e21, @rand_addr=0x64010100}, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}], 0x30) 3m13.429617352s ago: executing program 1 (id=3035): syz_init_net_socket$netrom(0x6, 0x5, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000a00)=@abs, 0x2) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) symlinkat(0x0, 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00') ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f00000001c0)=0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000569000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, 0x0}], 0x1, 0x30, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000380)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ffd3bf79a1f5c5dc34cf2645cbc11c4562d22db8780edc5daee171cc04d96d9ec2db07478f347edbd6424923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b000000fb354673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff0100f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce78754182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f26df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132155fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3m11.664418862s ago: executing program 1 (id=3040): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x40, 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x4, &(0x7f0000000980)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bind$tipc(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x1}]}}}, {0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_SREG_QNUM={0x8, 0x4, 0x1, 0x0, 0x10}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f00000003c0)={@loopback}, &(0x7f0000000400)=0x14) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) r4 = request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, 0xfffffffffffffffe) keyctl$restrict_keyring(0x3, r4, 0x0, 0x0) request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x1}, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 3m10.921423787s ago: executing program 1 (id=3041): syz_init_net_socket$netrom(0x6, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x109881, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket$pppoe(0x18, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000a00)=@abs, 0x2) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) io_uring_setup(0x7, 0x0) symlinkat(0x0, 0xffffffffffffffff, &(0x7f0000000200)='./file0\x00') socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f0000002a80)={0x0, 0x0, "f9b531d8575035b83855bc700acbcc0713d386e4eeeb74f1578f5f8edb271db31fc3925b32844d79a878eaae631e6218f6ede90190c531210a3484ccb22c8c0fdd057c3ca4ddc03b6f8f5e241c692dbfba54233c976a239812691cf06a4fc98824dd931713ab9dbb6ae93c3137e82b04309dc29779b56df75979d6e792006f09ac4484ecdfb764de8575517d96458a5620198ea168a083984d4fe5d36ba4d4aa207455ea5c46354e16909f1ee2e3041fe34669ab19b3444fc42e81511f94ced457bc82752535db70aff27acf95bd88d76ab7c42dfb4cfd6adf7066ec406b26e10c062a22498067f852e5d6a206b069f833f7c57072458ad07895a6bc31c1a1f4", "cb46256f67c276631fe13b128be9c30b2beaa47530b8084f8e29c2d747f442e75658aff7b97e1178a2eeb2fea55c00fffc830eda9b51a73e062a7511da0b6b624bee89dfd4a8e3c1c61def0f783047658affdc69d967c63be4c8c614d1051cfbf95b18288fca094f61f6a3a27177982a7c46da48231f906be1f19285028baef5dfae6a789de6feed9d484b3f68ef34871ee33edd16b31e22f263620bee0190cb5612f6b0b6126df551e6c3f30d306c0b7b3c8e4a640717019eb155f832f97b8c3e316e95a60786315f2cc9c11ca92baa1e23d6b1d5c31edb8777a50bc81e5e229d67c952edf13254b8590d2799e79d33a9fcce29812dcfc8f49d33f47ab478d08629b4dc552fe26cc44fea152f21206dd9a461436314b1b4f187312ced9550121e2a3362894008ddcf184c78aa8d0c04e85db6ba1334790abec7b93d5ac9e16d977f6540f4764438008bda4fb4c091a8f68c2a7f71d6cdae13689917082d611fbcda3494a12f243645b095cd28a58c01e9e5cf09801f29982b881357c13409f45d009354f19c0a3fce0053ab7cf075af86a5e08c83d26acba0c9d55b1d6e6b712bfba3794ca512433f5c9121c64224cc62c0368ec2202e5d60a1b04b17ebc3841f27d949b54d43483886dc5a29d0bc1206f49e65ee1fde6ec4609cd26e612d1889d688b5364a159b71cc02fc2be1ac008a3deb619f3cd706bf5d2db7480e3d888fef321c3f12cdedaad8a253d7c11d23e9396d04a183b0338b581ebe6deba496930f80d1f2558f804aaf0f0897a5597e0d6a279d41f9a7f51e3b3e2d85b1b72e4e69c4ae0cf80b1b116e31b270518e51e0dd0a36b8891d016ac12ccfa1dd835def1bfb9142e839ed8f4f7b2401cc398d0a6150654caa7fb25f0887dcc26a8ce25998dc89889198cc86dd87b9b4c23306776bda2fa698da106a44112db6e752c19e0f84b534679331e98fd84d8b64d3f67107647de113e0f70b05706327e23d1e287be9c558cc6f9054044421c2b0163fcaf970fd6946b9253acb0bdee6d8c69cc1706c3c4bed0d7cb610a004c1a3e84cfcc7b39e69556d08fed4d8f0fdbcac031280eea2730c3229ec83503be7b519b8c41e3a962457136b9e00d0d54d534d5b5558ce140c28b50f60551a3b679995c2b96ac05595113016f7efbad727f6c7f7e5d7bc148f744d5f4e2b63d81523e4602b1c9246dcdbc000b94563ac66e822147a95ba5f659af5e15054d75cf0c24b5d01505e5ea6f39d2b74c07c69ba52df57b73dc3d9a655874fcbac813169cf6f743f0f52efbe019c5694401ae182952fcb86ddabcfa5ead1db9b4493c6ee4890484dc88ef68b0215a79982a7e17aed8490d1a69c06ad064a26a7a1d39808b4e32604f8846ae582659a19685b0556cca473405d4e6199738587258d7688cf5b884c41a2fcef0eb6b8ad458b6bbd732d141448a04100447b98ac648ff69e3222890fc4480fb1c2a26a92ca9dce6827ab3938e09e68f0e468a04cf17b5afaa50965544ff4bdbd34eb967970fc28889c95b21f99411ff6a0aaaca2e3f9ebe6b9d3f65134d0385c51667a0dbc7ce3abe652ab74505e39d258a9c96bd95b983b6d840c0c4ee8995be215ce81396f1245479458df6c812251b43574e7da84c9130e13d0ecc1dfda05d34d4ba68a09da06e220febdde04be5fe8ca1daec5c5f38b3211e710a890136458c2eb3b9dc81435a472a58064485ad0dfc4efa5f715a7a9adb47a8ef1220be9b12db8a92e2f7d950394963dbfe0820dfb7d4feb78a12110c78ad31bdf1b8df5fa7484efcb37bb2d70211c265bc6573156a2e7a23d1ed9f6224624861cac1d23132573a4b2d4f21d807040b18aae0e687d3233be960ebf91183eeb0332519cd2369d8dda17fd5a40d26ca627c4bc3009aa41674d891001e92b85e1aee74ce0884b0db2ab77bbeae8a266d709d22373ac69838f67900db8cb61000b70928bf45e296c14686ba930e58ebbdf62641dfda58398252ed653aa79dedd5712492dd7b862e54b6bd7945cf009d60ab6c37ef3697921ad9ad1ede2ef2ac78129da714a9a3aa8cad6f329725a74542662a562ef79ff4ea43c8f742404f7f0d0a7d0c3a701c47cf06465737e61fb8d0b32cbb5fbb23f387c8356af61e6647209d64d12d0400f98d4e32c9382a4a6f75659f98aea32e0cb4f1f345ffdaa76006a69efe9bce2336c4a8124e40054e3a6d6f52cb9b3cb295d4b1b45866dfbd1649744aa0e18f3eae2cc4c26f214155ebcb22c6181b23646bb25b2688e85299c5ab8e7c9c1ac3fc063efadd9f5cd7417409a294e284c2404e4ba173b6d591d0b2b759b52e2d4354fd31559045f75e0769a39ec0ffb7bd8c6c9b806e3c6a4d6eff40f2f5621da31901911952afedb470e91fcf054682477630f882f65c27b16c400273f87fcdb45cff42e6a16b499c842d53bd2871443a3430314a3318b64dfde8160744b3fbed28fcdcfddaba2ba6b9950cf3c29f3155b363864cae92f868c75cc79cd11a6bacf008ade068d30b643076230e7db0b71b80b2c479aa9201eb5b58d08feea0def43f5cc06ede74894a21c1c80cfb24aba9ca723114196cc8eae085e34c81738a264f8e207794ac31c718f68a256252c1c147139ce45ed4802dca031d89147ee76adaacaabf0ea23bcf54bb98114ad20f202e2a7052cccb2ebf0bb3cc6b7d66c4c604a77896dec2e8bda8d4bddff49604a51678292ab68c3f08d1e629d6c3dabcdb17653a4d0043e067642951bd3ec872b8572f8669ba62ce807cdf03fe33d34f1708515baffea4fab1e7c9b09fa62faa944c85e5cbf77cf80fac94e46ce5d7c726d0f586b7f4d6171f29abde3c49248e5416ab4fba531551b9949f162186a00ab774082a43b5f4520906280823d4b050f34f0ad25b0f4701fe00b898c0a5826a6ac61d6023ac31b7a9209dbf0ae61d986ee91990896610b4d8c92ecc35192594b7e18978777b4152e893b1391007d13eae29d75655d29aba980e3983ff069f66d2bac451cfbd870eca8d4f68ad11c32215678fae9df50e8cd32f6b52370fe6a02256e2c292a11cc06cf969232f370893875be9593cff359295d3e2490870e6254353434ceb99e7dd94e49d08effedf0e1136c9b060c5f8a67a3d1fb7ce59598c6ebe861a53f9073a1ff4767198e0c8a59f5543f2df66d436cb649f2375bdd362ff817deb8601eecaff794023b55c9d8553837c75e4f45f13860e7a9ed39e66d79765b7c4a26a30d9d2a2a45e2b7818e770e87c8b109fedb5ce4908ac0093a274adf281f183b658d3962b5465b141e9cc9e9af767934c628fa58136a503bed1fac15bc6177b4381c77e6dd6229ec45a7b582b77d6271a63ba2a356b5e1a2a637e2eb6d7c7cf38ddfefb1e314801afcdaaf7858f4dfc51bf625a136dcf575de0b7616227fe7d127e48aea4e7785d5bbb806a949806ec0f69f7a0e2dcb5a492b13ee3157c50fdd920fcbb8c6e17bb5b42b76c56e0379bc01a0597a802161d6ed649d8cdd188cf02f1b80b35c520f2a06879aa893ee8e71f27c645c3c0e1eeffa58eaa36ddeac1924f91dfa0227f281bc2788977aaa8a21240f7ace59326f78019689cb8cdb98628d4c687af5037dd9c012f2ec6ec218f0528b146a1a6a291feb72fefc2442c89b59a9f9d88099852303e46b133e84de8f0be58702b1fc14b891900ad8411bf5c796371b9416f72fe283d36117cab706a80a54b5c0d83f7b93ecf01ff5045bb8c2b6c6cc0424d8f32ca8b56cd399922c7063adbffa3a701fd940a286114e5b2ea3e196892f7d268b564f64fa08b02b1649dd75711dd712c9172f07371f41d1f722d52529b622beccd75d16f58ba6bd2338893c90ae5106d1e4ab2157230a8bff522dee492d700bf37e080ebb1687c7f7dcd8fd4e76697fc30d9408ad09d5bc189f3df84cfbee6e018e7932cea83900ada0734d575c1e92ae00e3105cbdcc4963289efe5ec49ee8315c68e3a9f66792e7f7ecf5ef397671e8127187fddb4e1302a964f38b5cd134f835a94568533c523836dfc66042cbb8f5625a33dc83f1f6e5fd7cbbdc1b05ec51de90e6c941a0a06b3bb9ce97023e0430164ffc49bc9415deaab5a77fdf06baf6fc2264ffa6beb565b79d12ab5c8fe4e22d53f29594f2b1cd92fd9c10754195853e75098c3687c88ff4cbdbee9d9acd617875fb7ab66928df4f65555b4e7f01ff0ebfe489ee9ca3429d5e77c87f6b0361720f4001620722b1b11878ee74c3d120cdbe5b9aaf17ea511a49538f800a6580d18a7f25de966e981fc163e79deeee547ec69bb2f68a437d0f3fb80679c649b82da26763266e48dd40af3e061e3e9a48632c5ad5cbc1460664c9f878dee600be1ec1066f870ef38317136da84c8b859cee9a0c2f91cadc85f425c950c76bf024f28e94e8d531e96b5d30fdc1626abd39b18ae2ca572d7b180a0df789364d7464537419b2551c3802f98821498c05bcddf12842e9b77fac063136ca1199492fd9e26f206124e88751bf6096eb2bf61507e511bf05d319d141d978859fc171564e16cf80e2cd527d90262ce6700594c9b0e54cd613446e70d0e9a31b15338dfa94ecffdeda8d4a5565f9642a7ced585e3009287b139af43493155fd77328e4e2aa616f456ce90a468d32b0d2820da795bbcf368487d609acb876943281bfafb7068485febaf4c781655234686f29389221154397f30ae49181667d3fed57240f7ef384837de057c09833521326e8e9d97ec72d7c1df64e06cf5c1461e311cb4e9330f74716054de27cc2ed71c43f356c7f9d255d3d22d5df89dfab8759e0f419be1dc2e6a096a190a4b6086cbb271e7fd1cd361e1019e8042fefee785bbffeeecf4f79261e37cb81556b25c127e3ce41658328d7739d7621be3086c0d9b6e4ec786119ee42f7c9ffcfbd9454a1a4adc334defd98c1826ebdb849f4c3e8af09c5df00e29593a7594c1a869122fa1cee84f7b750ff859943af0c020c10870cd13a8c84fcbd10064cc2c791b16f4db4be6a20206bfc7bf3b19a3b580e9f701ddb090e31cab13bf0fee9fb1ecbf08000c0afc5c5680eed5697091fc4cafde8da2c9a05315645f9fb2d954399df6bb3b02945dd3d4e1e3394caa8dbe186e293304e6aab0946535bb365e72690c0fcfed2ff20cd5acbaa3ea048caf2bb7bf4eb8b89ed9a21058983ab6ab31f391db1a6987a3c7cea7798b261dca8f56dae814aa128dc9e92d4a5a51f0c6b1c435c97c4e6459add6a5ca9b7e81450767a34768992d3f234f41710aca587e27eee2d472343741e9d0244e4466f72e109dcb51d8aef181216a9f8b0eedeba71b6416b3e50ee6be7b70843cb4d1253607e5051a2bc444bc76767d7b1236e20946e6d99f73c7d21d9209e4301902ad78d9b3f165130be0b0c81ef"}) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f00000001c0)=0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000569000/0x18000)=nil, 0x0, 0x0, 0x30, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r5, 0x4400ae8f, &(0x7f0000000380)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ffd3bf79a1f5c5dc34cf2645cbc11c4562d22db8780edc5daee171cc04d96d9ec2db07478f347edbd6424923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b000000fb354673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff0100f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce78754182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f26df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132155fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3m7.350491153s ago: executing program 1 (id=3054): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_newroute={0x2c, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfe, {0x2, 0x20, 0x10, 0x0, 0xfd, 0x4, 0xfe, 0x2, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x1}, @RTA_GATEWAY={0x8, 0x5, @multicast2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4a044}, 0x20004090) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000090000000000000003000000a5002d15b914e5ffaeb28dd5eddc4e95"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r1, 0x0, 0x10, 0x0, &(0x7f00000008c0)="c1dfb080cd21d308098e000081007e22", 0x0, 0x8006, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newtaction={0x70, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_ctinfo={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x0, 0x0, 0x10000000}}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3f}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x5}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f00000035c0)={{0x2, 0xffff, @multicast2}, {0x0, @broadcast}, 0x4, {0x2, 0x0, @private}, 'sit0\x00'}) ioctl$IOMMU_VFIO_IOAS$SET(r2, 0x3b88, &(0x7f00000002c0)={0xc, r4}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r2, 0x3b71, &(0x7f0000000240)={0x20, 0x0, 0x0, 0x8000, 0x7}) ioctl$IOMMU_VFIO_SET_IOMMU(r2, 0x3b66, 0x1) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r7 = syz_open_dev$audion(&(0x7f0000000140), 0x8, 0x82400) r8 = syz_io_uring_setup(0x5ca1, &(0x7f00000002c0)={0x0, 0x9ad8, 0x800, 0x1, 0x1000a0b, 0x0, r7}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r6, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) r11 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x1c4f, 0x59, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xe50, 0x7, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x10}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_usb_control_io$hid(r11, &(0x7f0000000980)={0x24, 0x0, 0x0, &(0x7f0000000900)={0x0, 0x22, 0x7, {[@local=@item_4={0x3, 0x2, 0x0, "c9005273"}, @main=@item_012={0x1, 0x0, 0xb, 'D'}]}}, 0x0}, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) io_uring_enter(r8, 0x847ba, 0x0, 0xe, 0x0, 0x0) 2m52.01926179s ago: executing program 33 (id=3054): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_newroute={0x2c, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfe, {0x2, 0x20, 0x10, 0x0, 0xfd, 0x4, 0xfe, 0x2, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x1}, @RTA_GATEWAY={0x8, 0x5, @multicast2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4a044}, 0x20004090) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000090000000000000003000000a5002d15b914e5ffaeb28dd5eddc4e95"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r1, 0x0, 0x10, 0x0, &(0x7f00000008c0)="c1dfb080cd21d308098e000081007e22", 0x0, 0x8006, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newtaction={0x70, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_ctinfo={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x0, 0x0, 0x10000000}}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3f}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x5}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f00000035c0)={{0x2, 0xffff, @multicast2}, {0x0, @broadcast}, 0x4, {0x2, 0x0, @private}, 'sit0\x00'}) ioctl$IOMMU_VFIO_IOAS$SET(r2, 0x3b88, &(0x7f00000002c0)={0xc, r4}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r2, 0x3b71, &(0x7f0000000240)={0x20, 0x0, 0x0, 0x8000, 0x7}) ioctl$IOMMU_VFIO_SET_IOMMU(r2, 0x3b66, 0x1) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r7 = syz_open_dev$audion(&(0x7f0000000140), 0x8, 0x82400) r8 = syz_io_uring_setup(0x5ca1, &(0x7f00000002c0)={0x0, 0x9ad8, 0x800, 0x1, 0x1000a0b, 0x0, r7}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r6, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) r11 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x1c4f, 0x59, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xe50, 0x7, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x10}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_usb_control_io$hid(r11, &(0x7f0000000980)={0x24, 0x0, 0x0, &(0x7f0000000900)={0x0, 0x22, 0x7, {[@local=@item_4={0x3, 0x2, 0x0, "c9005273"}, @main=@item_012={0x1, 0x0, 0xb, 'D'}]}}, 0x0}, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) io_uring_enter(r8, 0x847ba, 0x0, 0xe, 0x0, 0x0) 2m15.426899249s ago: executing program 0 (id=3203): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x1f, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000200000000000000f2ffffff85004b8d401700009d0000009500"], &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x9}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x48, 0x0, "f6a7346a1ca3caf66200f0e70b995efa20d5ddc09c0bc0c88e00bdea5e6998967d569964c8b68dae57dea91c0e3ef03a96483bcaaa5ab222d1993083e8e3619fbbff30da0288a8b78a3f921c40fdc06a"}, 0xd8) gettid() sendmmsg$inet(r0, &(0x7f0000000f80)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000500)="c5d2dc3df405df68c9deaa5aa2", 0xd}, {&(0x7f0000000540)="f56c1003c0a0f4d6eff2713b46698e120a4a3300d2c0e67726a5f82f9e7a1c79f6d5e9d61aa39feca0a7e9ec2ab31f093ccf36a2e4fbf80d4cfde4a0182a27743ea387cc2ec69cabbcb7d13edcea76b3dc53efa8af1dee135dead20d8277871c611d81b34f6e5029849aed6e97110c1cd3a6ece7c3fa3dcf6785c01e737fa6343ec99069d25a2eb3e9ee709be9860b5e6c", 0x91}, {&(0x7f0000000600)="4d66b05d07e530467b7e662652f34913024a1177a80c2ed2b610b185478a", 0x1e}, {&(0x7f0000000640)="fa94c4361456a7a8e2bb1fc83f9b7ecc997163d7963a368a01ca099ef6abd8e8d4065f8f51b2ba0b1729c04943fa151b066b3189f2b9743759c2ea6a37bff44010fa13603c25af1a50155d687680b108f55c543d2b0e836e67fa98fa5e323af5ebbd2ae43db6366bb10d32e5e4aaa949f27739b4e764d4ed875e4b20ef0b8fa1f2944e76d8ba7525f32a1002aad7fae3eea2e225bdf6cd5a78e5fba060ee48de4e61d14ef1", 0xa5}, {0x0}], 0x5}}, {{&(0x7f0000000800)={0x2, 0x4e24, @empty}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000840)="1f3ed08a1ea06780855ce67e8b6369c88c2308f2d57f31262871c02ba9c9fb94cedfaf28091957186f7871c395f2aae06a5f39b44d31d56c0c7dc6fe2c14b95ae24e3a97e32b307ba32bea0c3fe18fa15d411b9aa37cb15df12dbe55573d48a7e3d9c47a563ed927ef9ae679978ef42ba91154fced", 0x75}], 0x1, &(0x7f0000000900)=[@ip_ttl={{0x14, 0x0, 0x2, 0xb}}], 0x18}}], 0x2, 0x20000000) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000002c0), 0x4) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='setgroups\x00') r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r2, &(0x7f0000000080), 0x0) r3 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="1c0000005e007f029e3b470d649b72ab25399cd956c07dead6a93690", 0x1c}], 0x1}, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x1d, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000e54903000400"], &(0x7f0000000100)='syzkaller\x00', 0x4000, 0x0, 0x0, 0x40f00, 0x76, '\x00', 0x0, @lsm=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000400)={@in={{0x2, 0x4e20, @multicast2}}, 0x0, 0x0, 0x24, 0x0, "698e86252c563a2eb894ac1de863c518984bfa5ff139aeeef086eed112e6f0ffba88c7d0888990f99dc2416c1cbccf99d18464a65c3587c97aee9217b992893cebfc606ada5e14e782e63da22a6fe97d"}, 0xd8) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0xec) fcntl$setlease(r5, 0x400, 0x0) 2m14.88153566s ago: executing program 0 (id=3205): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x80002, 0x88) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) r1 = openat$kvm(0x0, 0x0, 0x4a2501, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) getresuid(&(0x7f0000000140)=0x0, &(0x7f00000002c0), &(0x7f0000000300)) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000640)={{{@in=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@private0}}, &(0x7f0000000180)=0xe8) add_key(&(0x7f0000000280)='rxrpc\x00', 0x0, &(0x7f0000000100)="0100000002", 0x5, 0xffffffffffffffff) mount$overlay(0x0, 0x0, &(0x7f0000000140), 0x228000, &(0x7f0000000340)={[{@volatile}, {@xino_on}, {@redirect_dir_on}, {@nfs_export_on}, {@uuid_null}, {@uuid_on}, {@redirect_dir_nofollow}], [{@smackfstransmute={'smackfstransmute', 0x3d, '*^'}}, {@dont_appraise}, {@appraise}, {@obj_type={'obj_type', 0x3d, '\'t)-'}}, {@fsmagic={'fsmagic', 0x3d, 0x5}}, {@smackfsfloor={'smackfsfloor', 0x3d, '/-N&'}}, {@euid_lt={'euid<', r3}}]}) mount$9p_xen(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x18012, &(0x7f0000000740)=ANY=[@ANYBLOB='trans=xen,smackfsfloor=,fowner<', @ANYRESDEC=r3, @ANYBLOB=',obj_role=\x00,obj_role=\\#%,subj_user=\x00,smackfstransmute=,smackfstransmute=:,appraise,euid<', @ANYRESDEC=r2, @ANYBLOB="0000d62f1ea140ce016bb16b10d9ac61cb89fdab95cb4e76c11191aaabde9b0c48a756b50d31d1b29c114efc7d78ab80cd9e62affa89096265215ede2b5c"]) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000100), 0x100008, &(0x7f0000000540)=ANY=[@ANYRES64=r1, @ANYRES8]) chdir(&(0x7f0000000080)='./file0\x00') openat$dir(0xffffffffffffff9c, 0x0, 0x490500, 0x61) openat$kvm(0xffffffffffffff9c, 0x0, 0x8082, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r6, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r6, &(0x7f0000000440)="255011c684c139178e7dba58", 0xc, 0x0, &(0x7f000005ffe4)={0xa, 0x4623, 0x0, @loopback}, 0x1c) shutdown(r6, 0x2) exit(0x7) unshare(0x42000000) 2m13.886139179s ago: executing program 0 (id=3208): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$inet6(r0, &(0x7f0000000a80)={0x0, 0x60, &(0x7f0000000a40)=[{&(0x7f0000000340)="13e82e2303c22e527d6887e1", 0xc}, {&(0x7f0000000380)="b9f3bcf8e7a506bb7f384a1e8be2f4cc62287c592bb0234f4cc418adf2a566aa6a4cff", 0x23}, {&(0x7f0000000840)="1c41cd72441f52b1f576e67826d71cc46c43be6faba62ac297c70c0a04beb914e7b501bc6985560e5acbbd2307b39cd1142717b46a7f0aa94f85f36591e04bfb455af4c968e032f510a3d1cd2f399b3799b3f4a45b3568c826288b55117f78e8ab45889a86d85bc9e2f16fc2fe9d8c948534378a852e15f4452437fcb238d698ba2fc8bb3437213e4be46202502358c988dd96a697fb84642f562db819ccda089b6c4839aa8e0955c0abdbe6efef3d7b2f97cd77d166e3e8cc145b9d7ba40da7ed9a54d62e263964bdeef8c84202b47bcaa74852d9cbb91d62bfcba8d4627de454", 0xe1}, {&(0x7f0000000940)="9249b57109a81585a5bd32ed1a48406278df751618c19549f171672c8d5300213ed63bd00fa83343b375766fba15ab3ba4c1e29e555df14e37154885fafec67d83631d36f21109e68bfb295b7094d75b67a862a2edc2744caf7a879c916e48e93d8432ac7b4a7967f748c9bfec03068b85fdde52be5edf89bead53aced098d154d7bed9ae5f9ebe7c3a5f937d7fb6a58a124d316e44eb130f3a99cf4bf53e1e4f23add8641b7c9aaf2c7368c76019f5d8f352f6782d6627c9d1000beabe507c10cc0fefc64fafb9fff069e450752df68599cbeba", 0xd4}], 0x4}, 0x40040) r1 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='user\x00N\xac]\x86\x8a\xa3\x7f\x00', &(0x7f0000000300)='L\t\xdf\x92[\r|>\xeeZ:\xd5\x80\xe7\x1b*\x82\xb6z\xe8\xb4\xf6\x80\xb9\xa9RQ\a\x8e\x80\xd0W\x94\t\t\xc8f\x8e\x8b#&)A9\xdb\x05\a\xe8\xbe\xee@\xbc\xdb\x1d\"\xf6\x05\xac\xef\xdb\x18\xaa\x9a\xcb8q\xf63\x18d\xfbO\x8c\xf4\xc6\x14\xb4\xba_9\xcb\x059&\xda\xdf\x8d\x1d\xfe\xf6\xf3Ux\xc6w\x90\xd7\x882\xf0LO\x0f\xd4@KE\x9e\xecF\x9c\x1b\xa2\xbe\nL,\xcc\xfe}Q\xdc\xe9t\x9c\x89Z\xed\x12\xb6\xd1qj\x04\xae\x97\xe0\xbd\x88K\x9c\xb5SR\x18(\x90-]\xb6h\xb1\x11\x01\xa1\xc7\xc7\xd9;Q\xd4\xc7&Q\"\xad\xf7(\x80\x0f\xde>U\x98\x83H>\xd5\xb1Y\xb6T\xb4\xcf\xd2\x01\x1a\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='user\x00N\xbd]\x86\x8a\xa3\x7f\x00', &(0x7f0000000080)='\x00', 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r3, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, 0x0, 0x0) sendmmsg$inet6(r3, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="82", 0x1}, {&(0x7f0000000040)="2da7", 0x2}], 0x2}}], 0x1, 0x4400c800) sendto$inet6(r3, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r5, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="55544f4661848c20dfdbd28891f4", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x50) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r4, 0x80047210, &(0x7f0000000280)) syz_open_dev$char_usb(0xc, 0xb4, 0x10000) r6 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4) r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000002c0), 0x410000, 0x0) r8 = syz_create_resource$binfmt(&(0x7f0000000300)='./file0\x00') execveat$binfmt(r7, r8, &(0x7f00000006c0)={[&(0x7f00000003c0)=')\x00', &(0x7f0000000400)='GPL\x00', &(0x7f0000000580)='GPL\x00', &(0x7f00000005c0)='$^&&\x00', &(0x7f0000000600)='}\x00', &(0x7f0000000680)='[+\x00']}, &(0x7f0000000740)={[&(0x7f0000000700)=')\xee*&+\x00']}, 0x800) sendmsg$sock(r6, &(0x7f0000000780)={&(0x7f00000000c0)=@in6={0xa, 0x4e23, 0x401, @loopback, 0x4}, 0x80, 0x0, 0x0, &(0x7f0000000080)=[@mark={{0x14, 0x1, 0x51, 0xfffffffb}}], 0x18}, 0x0) 2m10.118154952s ago: executing program 0 (id=3218): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x0, 0x0, 0x1, 0x80000000}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000300)=""/102392, 0x18ff8) r4 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000002c80)="d800000018007b18e00212ba0d8105040a0a1100fe0f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b01602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5", 0xd2}, {&(0x7f00000004c0)="f80ec2e2badd", 0x6}], 0x2, 0x0, 0x0, 0x2663}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) pipe(0x0) sendmsg$IPSET_CMD_CREATE(r2, 0x0, 0x810) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_SAVE(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200484d}, 0x8000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100, 0x2}) r5 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r5, &(0x7f0000001200)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000740)=""/246, 0xf6}, {&(0x7f0000000340)=""/121, 0x79}], 0x2}, 0x1}], 0x2, 0x0, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000009c0)=ANY=[@ANYBLOB="12015002c2ad1040c60545922ad1010203010902240003090400a70904d10600b8dc7a090904fe0c0015e726010904004000ff"], &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0}) 2m4.467822159s ago: executing program 0 (id=3230): r0 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2d6b0c8774af"}) socket$netlink(0x10, 0x3, 0x8) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000002c0)=0x20) statx(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0, &(0x7f0000000240)) pwrite64(r1, 0x0, 0x0, 0x26c) 2m2.193955648s ago: executing program 0 (id=3236): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(&(0x7f0000000240), &(0x7f0000000040)='.\x00', &(0x7f0000000140)='f2fs\x00', 0x0, 0x0) write$UHID_CREATE(r1, &(0x7f00000003c0)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f00000000c0)=""/43, 0x2b}}, 0x120) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r5) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)={0x14, r6, 0x30b, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4044}, 0x20000004) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r5) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r7, 0x0, 0x10) io_setup(0x8, 0x0) write$UHID_DESTROY(r1, &(0x7f0000000080), 0x4) sendmmsg$inet(r0, &(0x7f0000004740)=[{{&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000d40)=ANY=[@ANYBLOB="10000081d17a44000000000007000000"], 0x10}}], 0x1, 0x44008004) 1m47.005981891s ago: executing program 34 (id=3236): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(&(0x7f0000000240), &(0x7f0000000040)='.\x00', &(0x7f0000000140)='f2fs\x00', 0x0, 0x0) write$UHID_CREATE(r1, &(0x7f00000003c0)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f00000000c0)=""/43, 0x2b}}, 0x120) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r5) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)={0x14, r6, 0x30b, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4044}, 0x20000004) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r5) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r7, 0x0, 0x10) io_setup(0x8, 0x0) write$UHID_DESTROY(r1, &(0x7f0000000080), 0x4) sendmmsg$inet(r0, &(0x7f0000004740)=[{{&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000d40)=ANY=[@ANYBLOB="10000081d17a44000000000007000000"], 0x10}}], 0x1, 0x44008004) 14.225575422s ago: executing program 6 (id=3501): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000300)={0x24, &(0x7f0000000380)={0x0, 0x5, 0x2, {0x2, 0xc}}, 0x0, &(0x7f0000000240)={0x0, 0x22, 0x7, {[@main=@item_012={0x1, 0x0, 0x8, "9c"}, @main=@item_4={0x3, 0x0, 0x9, "28fe09db"}]}}, 0x0}, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0x25, 0x0, @val=@tcx}, 0x1c) syz_emit_ethernet(0xfdef, 0x0, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) mq_open(&(0x7f0000000080)='!selin\xdb\xa1\x02\xbf\xd9l\xd7\xcd\xc0uxse\xee\x0e\xcd\xce6\xbf\xfa;\xb9-a\xb8\xef\x8de\x14\xbc\x9ej\xa1q\xa2\xa5\t\x98\x8a\x8f>\xba', 0x6e93ebbbcc088cf2, 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) epoll_create1(0x0) pselect6(0x40, &(0x7f00000000c0)={0x6, 0xfffffffffffffffd, 0x9, 0x40, 0x2, 0xd}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x5, 0x7, 0xffffffffffffff22, 0x2, 0x5, 0x8}, 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0xaf02, 0x0) 13.355500324s ago: executing program 4 (id=3503): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000300)={0x24, &(0x7f0000000380)={0x0, 0x5, 0x2, {0x2, 0xc}}, 0x0, &(0x7f0000000240)={0x0, 0x22, 0x7, {[@main=@item_012={0x1, 0x0, 0x8, "9c"}, @main=@item_4={0x3, 0x0, 0x9, "28fe09db"}]}}, 0x0}, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0x25, 0x0, @val=@tcx}, 0x1c) syz_emit_ethernet(0xfdef, 0x0, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) mq_open(&(0x7f0000000080)='!selin\xdb\xa1\x02\xbf\xd9l\xd7\xcd\xc0uxse\xee\x0e\xcd\xce6\xbf\xfa;\xb9-a\xb8\xef\x8de\x14\xbc\x9ej\xa1q\xa2\xa5\t\x98\x8a\x8f>\xba', 0x6e93ebbbcc088cf2, 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) epoll_create1(0x0) pselect6(0x40, &(0x7f00000000c0)={0x6, 0xfffffffffffffffd, 0x9, 0x40, 0x2, 0xd}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x5, 0x7, 0xffffffffffffff22, 0x2, 0x5, 0x8}, 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0xaf02, 0x0) 11.535810161s ago: executing program 5 (id=3507): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0), 0x12d3c0, 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x3c1, 0x3, 0x358, 0x1b0, 0x12, 0x60a, 0x0, 0x202, 0x288, 0x2e8, 0x2e8, 0x288, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private0, @ipv4={'\x00', '\xff\xff', @private}, [0x0, 0x0, 0x0, 0xff000000], [], 'virt_wifi0\x00', 'veth0_to_team\x00', {}, {}, 0x38}, 0x0, 0x180, 0x1b0, 0x0, {}, [@common=@hbh={{0x48}, {0x5, 0x5, 0x0, [0x2, 0xec, 0x2228, 0x1, 0x8001, 0x57, 0x40, 0x10, 0x5, 0x6, 0xdafc, 0x9, 0x2, 0xe8b, 0x4, 0x6], 0xe}}, @common=@srh1={{0x90}, {0xc, 0x5, 0x3, 0xa, 0xf, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x38}, [0x0, 0xffffffff, 0xff, 0xff], [0xff000000, 0x0, 0xffffffff], [0xffffff00, 0xff, 0xff, 0xff], 0x8a5, 0x263}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x20}}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x9, 0x39e2, 0x1, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000100)={0x1, 0xdc0, 0x3, 0x0, 0x0, [{{r1}, 0x5}, {{r2}, 0xff}, {{r0}, 0x8}]}) socketpair(0x18, 0x1, 0x0, &(0x7f0000000000)) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)="809e74dfdb6c6f7df79c86b7b8613ea387a080032c48a2f8a7e9fc29791f986d3c21fd6627d193a585cefdeeb2399a308b3d72f7b04d976c565d59b05fcf77785c0414506e3f0ed492cc", 0x4a) setsockopt$inet_int(r0, 0x0, 0x12, 0x0, 0x0) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000cc0)=@add_del={0x2, &(0x7f0000000c80)='dummy0\x00'}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x3, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x1, &(0x7f00000006c0)={{}, {0x0, 0x9}}, 0x0) r4 = socket(0x2000000000000021, 0x2, 0x2) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r4) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x8, 0x3, 0x588, 0x1c0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4b8, 0xffffffff, 0xffffffff, 0x4b8, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x9, 0x0, 0x24, 0x1, 'syz1\x00'}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @private2, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], [0xffffffff, 0xff, 0xffffffff, 0xff000000], 'netpci0\x00', 'ipvlan0\x00', {}, {0xff}, 0x2b, 0x2, 0x5, 0x5}, 0x0, 0x298, 0x2f8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x1, 'syz1\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@loopback, [0xff, 0xff000000, 0xffffffff], 0x4e23, 0x4e21, 0x4e22, 0x4e21, 0x100, 0x1, 0x6, 0x3ff, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5e8) syz_usb_connect$uac1(0x0, 0xc4, &(0x7f0000000540)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb2, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@input_terminal={0xc}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0xd, 0x3, 0xb2, 0x1, "b0b3"}, @as_header={0x7}, @as_header={0x7}, @as_header={0x7}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x0, 0x0, 0x0, "839253"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x0, 0x0, 0x0, "8a72012f619991247e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, "", "0f3f"}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x8, 0x1, 0x71, {0x7, 0x25, 0x1, 0x102, 0x40, 0x8}}}}}}}]}}, &(0x7f00000004c0)={0xa, &(0x7f0000000000)={0xa}, 0xbf, &(0x7f0000000180)={0x5, 0xf, 0xbf, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "10123ee0edf71955ca288abaf2b151f3"}, @generic={0xa6, 0x10, 0x0, "c68f076287737e3601cd9076313000b57a84d31489e6c7316e5f57bd1a8b9e032bedddb73216ba827d25965448f106245f5fdc59659a58a65dc1022fa78d764611f5a059d74f48c694147fed9c2e18d0130c1df7740e453ea7d74b392e7f35e7dfd7d159e9ed48348dd1a7dc45b82c65543fd4d12192bbbff5b61ca60b37050bedc1c528d2efc351da341ada6f0e901a46bc6585431cbda419bfbc49f6e1e0a9566870"}]}, 0x6, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x411}}, {0x16, &(0x7f0000000280)=@string={0x16, 0x3, "f50cbb4ff4ea190a2f02a8fe7925c8df9b6c4ba0"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4}}, {0x4, &(0x7f0000000300)=@lang_id={0x4}}, {0x6d, &(0x7f0000000340)=@string={0x6d, 0x3, "f5e0c2ea3bfb4a90eef6005e4dd437b85aa63cee0450baa685175139621b8a8cd5ebd2064681472342ca1d8c1c01c744c91d4cc7acea104a3f17a1cb6fdd594df12b083e4f83af0cb515a4b680f69cd100f72ffb978ba266b6c71f6ff25b00e0ea67f752f4f654cfaa6ab8"}}, {0xcc, &(0x7f00000003c0)=@string={0xcc, 0x3, "008dcfd4fb50eae4cd12a129f1dafaf35956f605065ec7e914b9c5328969fb65076fef84ac32e36d0640becced8e1db27a34c8dba0528b85eb0aada3553a2f599fef4c39caab8515bea97f640cdbbf1aa9189660c3f58a6b81e7cfcd718bf18b9a03fdd5cc81e9e0e9122aa3df9df4a267c72b8355f93c698c781f8d45c8fb9fc19840ac8fa9690ee33022e66c14d5b6991677623846decb63efcb3618da506dfad1b9ee0d7e838144b74a6af29f5e5d8f1b0e0ac7ee125ffa997e8841f845d627f868f267fb6f803544"}}]}) 10.88028131s ago: executing program 6 (id=3509): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x2}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) kexec_load(0xf5, 0x6, &(0x7f00000006c0)=[{&(0x7f0000000500)="bd0c5a38b5283fb870968b1b4e9f314e7e3554124e4a5727412b879e27780dae232088bc19bafa7153655362b9890ecc67032f36c74ffd2d29c1e002d8074c14cb7092736422ab1e7e4d607536ade1ceeaae09308e4b62c9cb99617abbd87db997294ee74d5df3ac657e48df591254c685dc33b90938486a8693e99f1691aed214abb30bb8ff65e1b38f4b963c8cd3615fd3554ff7ed34032cc99de653c660a0bbb85127147da4a4a87754ac0edba3453d6ea02bc3800ad47d19e2a9fe309dd8c18adfb0f0e12d658ca2b995ece026ec", 0xd0, 0x9, 0x8}, {&(0x7f0000000200)="9375298abc50a3e7c47270012b44e35ea6478f98288787b0cd5b5bef8f11c244c7dfb9f5c73ccb0ecf2898dcd5530d390d81260dccfa0fa17b7ae4654eb919eff8e4db1f864cb398dfff18e661b99e765dba06972f263f54a0f670e0013a0538476b619504695890f5c3a19c195fc63e501a4a1bcc1beff06f8aac251a", 0x7d, 0x3, 0x8cd7}, {&(0x7f0000000600)="c042b059c6268e1455ffe2e6767160b6da3985e2401537fa1d674941f804875be8500d13538aec0f21a056d6069c37e18b7fec88c033f1acbcd6de42041253a539841cb8946a0b053126ddec549ee7a3cfae09f873072be7c10ec7ad6d6f3b5b10966e0c1a56b8c6d3bb4009aaba780c406fe1c013bb777c0dc92faeea3795fd68fb239ac067c90e929b7cc91b86028fb3a13496dbd8f58a", 0x98, 0x0, 0x9}, {&(0x7f0000000100)="3fe0e9fd0df45fdbc2695469d513dc2bbc463eccd64e12a59d", 0x19, 0x4cc}, {&(0x7f0000000280)="8991915a81695e", 0x7, 0x6}, {&(0x7f0000000300)="d6117bb9fe6d09d355245fc477b85a085de3ce2a2a4b00f42221d8567505d1172f", 0x21, 0xffffffffffff25e0, 0x10001}], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$vcsn(&(0x7f0000000000), 0xb, 0x10000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) r3 = socket$inet6(0xa, 0x3, 0x5) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f00000000c0)={@private1, 0x800, 0x0, 0x1, 0x9, 0xfffe}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@loopback, 0x800, 0x0, 0x103, 0xa, 0x0, 0xd6fc}, 0x20) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f018581c0bc0065666765f36f0f33f0100a660f3a0cb9000000752066b9800000c00f3a32c632c6004000a50f01d70f0901", 0x32}], 0x1, 0x54, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000440)={[0x2, 0x900000001, 0x800000000, 0x45a, 0x4, 0x0, 0x7, 0x7, 0x0, 0xfc, 0xffffffffffffffff, 0xfdfffffffffffff9, 0x100000001, 0x9, 0xc82, 0x767], 0xeeef0000, 0x80082}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) 10.664380319s ago: executing program 4 (id=3510): r0 = socket$rxrpc(0x21, 0x2, 0xa) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000240)=""/241, &(0x7f0000000040)=0xf1) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) socket$kcm(0x29, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0x0, 0x0) getsockopt$packet_int(0xffffffffffffffff, 0x107, 0xb, 0x0, &(0x7f0000000000)=0xfffffed7) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="80000000000000", @ANYRES32, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001940)={{r1}, &(0x7f0000001880), &(0x7f0000001900)}, 0x20) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xffffffffffffffff, 0x8001, &(0x7f00000000c0)) r2 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200), 0x80000) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000003c0)=0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x2c020400) r5 = syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x4882, 0x8, 0x4, 0xf7}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_UNLINKAT={0x24, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x1}) io_uring_enter(r5, 0x3516, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=@ipv6_getroute={0x34, 0x1a, 0x10, 0x70bd29, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, [@RTA_PRIORITY={0x8, 0x6, 0x4}, @RTA_OIF={0x8}, @RTA_MARK={0x8}]}, 0x34}}, 0x20000000) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c000b"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x1700) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100), 0x4000) 9.984184826s ago: executing program 5 (id=3511): syz_init_net_socket$rose(0xb, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) setrlimit(0x8, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x49920d862a92153b, 0x0, 0x81, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_TOS={0x5, 0x9, 0x1}]}}}]}, 0x3c}}, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000080)={{0x0, 0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f0000000400)) 9.00553445s ago: executing program 5 (id=3514): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$binfmt_register(0xffffff9c, 0x0, 0x1, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r1}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="b4050000000000007112180000000000bc201000210e00000000000000000000159bb11d080054f795ebc6c48b7ee57df364594defe47aa18c81fbcc6c6042dbf743a90b61bae3a57ba478e007fe723b194058bc41fce6c4e98c8804a03ea7c9fc181b86e1c207e4b9c2e55e0d14ef22ee60615176aa293f77cb46958aa9bb869d981e76b9f4fd0f43d8bde942339d7e8fa10c87b5562d7cd8a361f5801b6e29c575dac7f00846c103fa144116db9a8a8850b0715c590a250c52c2b47c7a4176a8c5e2702c9ad3df0cc000"/219], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x3, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x20, 0x0, 0x8}, 0x10}, 0x94) write$binfmt_register(r3, &(0x7f00000004c0)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x0, 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xea(J\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{G\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xbd\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132?\xbf\xb2\x93B\x01\'#\xc0v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde44m\x96+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x8c\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xa1W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, './file0'}, 0x237) socket(0x2, 0x5, 0x7f) sendmsg$IPSET_CMD_FLUSH(r2, 0x0, 0x480c4) r4 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup(r4) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x34000080) syz_80211_join_ibss(&(0x7f0000000180)='wlan1\x00', &(0x7f0000000200)=@default_ibss_ssid, 0x6, 0x2) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x1c}}, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r6, 0x4b45, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$kcm(0xa, 0x2, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x6, @rand_addr=0x64010101, 0x4e22, 0x3, 'ovf\x00', 0x1, 0x80005, 0x5}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r7, 0x0, 0x485, 0x0, 0x0) 8.843629388s ago: executing program 6 (id=3515): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_setup(0x494, &(0x7f0000000400)={0x0, 0xf511, 0x8000, 0x1, 0x46}, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x0, 0x2) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x200, 0x0) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x2f) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000003c0)={r4}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000480)={r4, @in={{0x2, 0x4e24, @multicast1}}, 0xe, 0x3}, 0x90) r5 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1, 0x9, &(0x7f00000009c0)=ANY=[@ANYRES16=r5, @ANYRESOCT, @ANYBLOB="43f87c70a0b16f05b1711d562b2dc6c341bd219faaed5ce780f0e7e74404094f4ec95d39a2828f56fcaacdd586bf7e32f25f8465d20a8d2769a5743c54c182e173dd1c6cf165271bb25e718b5b9ad38bfb0f039fd0d6ee59d74d5b41fffa338123809918cf155e8239e82f34987ce9c5144ba44fcf2b1ee8d8c2e5f1b6385288719639b5b07f930544fe1cbb8e6264b8acb0546da1accf72b25deb94b8ec768d0313217c0777d76cf662c376e6d46a6ea52182186266aa3c5fc1d80474", @ANYRESHEX, @ANYRESDEC, @ANYRES64=0x0, @ANYRES32=r2, @ANYRESOCT], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x27, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="020000000100060000000000040000000000000008000100", @ANYRES32=0x0, @ANYBLOB="100000ff9f0000002000000000000000"], 0x2c, 0x3) ioprio_set$pid(0x3, 0x0, 0x0) 8.182185965s ago: executing program 6 (id=3517): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67200000000000140600000fff07006706000020000000350200000ee60000bf25000000000000bd350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad53010000000000840400000000000014000000000000009500000000000000db13d5d8b740f2cdaabc8383c8f56b8c2b84a800ea6553f3ef4392b3815dcf00c3eebc52267b042d19d6e31e25e589d5f2692c75a547d6f186641ae8c557ccff3878a93b51a0389749df734f49ed5078b10f1e7f2b37626a3ace1ea89f7d2c570720a86853e26168761f0a53358f7ee2baa0e6a67a98a0d57ac09f36cfefbbc7492bbe7cdf64971a57fd64efd46c26"], &(0x7f0000000380)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x6, 0x10, 0x0, 0x57}, 0x48) r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x882) read(r2, &(0x7f0000000240)=""/251, 0xfb) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000020000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r4], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@delchain={0x24, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4}}, 0x24}}, 0x40004) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r8 = accept$alg(r7, 0x0, 0x0) sendmmsg$alg(r8, &(0x7f0000001040)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000012c0)="f12468c6c394472c8eb4d933949b4e7ce34f7e40ba3f0e7faf4c451550fa3e23ce5eff4f94c1d6a8d70a2bac4a61a80878383b7e9b4949e5e1806334e9b2b38c36b1ae9cacf90d28c44777d394f9c35db1f99c67e2e8be7b18eb08f008d897c6f47e09251280c7f663bd27785705ece8f16d41629358dd8090186bbd46a69fb5727ba3e1d26a5489ee962100f4600a24873520bd6266c7d27e2c0645cdc1c5b6e0787b5a9e9a98358e557344f0d8190df4e39a0ae6a3c77022d5bfe6326c9f151c760d16864288295be04e9f6454cafc19431c2f99322dd409b56268d8e40d80ca98b6f6331f06ef5a28ed1b092e16558d33177d4ab70db6768e06f59cf9c9d0382a2d59fcad38fbeded381b74acb93bd915ae6898f8ba1587e780205ad4cbf31186fe3913dcdb2527af89b3f431029416fcf0aa6a5e81d935d7e37e932a4e8cec21daf2eff568ca97132e6c3e659d0332cbdac7111ac4edbad69c5b67e11ebecc863a58ad7264385e8520d3d3f27fa565bfd90907e66b0a6c692f6fa9b666cb3a1e4c341c7fe0235bbd1bcb657637c2c784c874a7d083f80644b6a6e68983", 0x19f}], 0x1, 0x0, 0x0, 0x80}], 0x1, 0xc8d1) recvmmsg(r8, &(0x7f0000002240)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000280)=""/60, 0x3c}, {&(0x7f00000004c0)=""/169, 0xa9}, {&(0x7f0000000940)=""/186, 0xba}], 0x3}, 0x6}], 0x1, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x8000000, 0x4, 0x378, 0xffffffff, 0x100, 0x100, 0x0, 0xfeffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x37}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x44}}, [0xff000000, 0xff000000, 0xff, 0xffffffff], [0xffffff00, 0xffffff00, 0xffffffff, 0xffffffff], 'nicvf0\x00', 'sit0\x00', {0x7f}, {}, 0x67, 0xc, 0x4, 0x11}, 0x2f2, 0xa8, 0xd0}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}, {{@ipv6={@private1, @mcast1, [0x0, 0x0, 0xff, 0xff000000], [0xffffff00, 0x0, 0xffffff00], 'nr0\x00', 'wg1\x00', {0xff}, {}, 0x3b, 0x3, 0x1, 0x2}, 0x0, 0xa8, 0xd0}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2bc53a058df9c1f5}}}, {{@ipv6={@local, @rand_addr=' \x01\x00', [0xff000000, 0xff, 0xff, 0xff0000ff], [0xffffffff, 0xff000000, 0xffffff00, 0xffffffff], 'netdevsim0\x00', 'geneve0\x00', {0xff}, {0xff}, 0x0, 0x3, 0x2, 0x10}, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1, [0xffffffff, 0xff, 0x100fffe00, 0xff000000], 0x4e24, 0x4e20, 0x4e21, 0x4e24, 0xdb, 0x8, 0x548e, 0x0, 0x99}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d8) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0xb, 0x6, 0x3, 0xf5, 0x0, {0x6, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xffffffff}]}, 0x28}, 0x1, 0x0, 0x0, 0x4844}, 0x4800) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000870000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r10, 0x2000000, 0xe, 0x0, &(0x7f00000002c0)="bf4b3e9e3a9e9a758f8ea2a244a7", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_buf(r11, 0x1, 0x3b, 0x0, &(0x7f0000000140)) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r11, 0x29, 0x20, &(0x7f0000000440)={@local, 0x1, 0x0, 0x2, 0x8, 0x9}, 0x20) 7.510095813s ago: executing program 3 (id=3518): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000700000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000100000000000000440005002001000000"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000000c0)={0x1, 0xaa4, 0x0, 0x0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r4, 0x4188aec6, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x95d}) ioctl$KDFONTOP_SET(r2, 0x4b72, &(0x7f0000000380)={0x0, 0x1, 0x7, 0x13, 0x200, &(0x7f0000001780)="1ae19327aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a730900000000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c536689a4a62f872f9ca3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d228186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f91ffffffffd51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6ece06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a2a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0600000000000000a1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe021c773a6664b66ae04aa62c564d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000004000000000f800"}) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @broadcast}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) poll(&(0x7f0000000140)=[{r6, 0x14}], 0x1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) r8 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$IP_VS_SO_GET_DAEMON(r8, 0x0, 0x30, 0x0, &(0x7f0000000040)=0x90) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000000000000200fffe4c0004802800018007000100637400001c000280080001400000000208000240000000070500030001000000200001800700010063740000140002800800024000000011080004400000000c0900010073797a30000000000900020073797a32"], 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000004180)=@newtfilter={0x24, 0x2c, 0x10, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x3, 0xf}, {0xffff}, {0xffff, 0xffe6}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0xc050) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c0800014000000002080001400000003008000240000000030800014000000012080003"], 0x122}}, 0x0) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000640)=ANY=[@ANYBLOB="180100002e00010000000000ffdbdf250501f2800c00180008ac0f000000000014000a0000000000100000000000ffffac14141650bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd0400e9000000009aafe5"], 0x118}], 0x1, 0x0, 0x0, 0x400c445}, 0x0) 6.977191128s ago: executing program 5 (id=3520): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102392, 0x18ff8) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x21) ioctl$KVM_MEMORY_ENCRYPT_UNREG_REGION(r3, 0x8010aebc, &(0x7f0000000240)={0x10000, 0x10000}) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0) connect$inet(r4, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r4, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000003c0)={0x1, 0x0, [{0x8b, 0x0, 0x42}]}) 6.941138045s ago: executing program 3 (id=3521): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x400, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c633774262eb5ab2c7b9c5cff6ce78185d8c4dc064744e042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f00000000c0)={"d1ed39d88b01401790bf03fb10628c46d2e681cdb9e581a38ebb0d965f307e56", r3, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xf, &(0x7f0000000140)={0x7, 0x2}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000840)=0x5) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setresuid(0x0, 0xee01, 0x0) close(0xffffffffffffffff) ioctl$SYNC_IOC_FILE_INFO(r4, 0x40103e05, &(0x7f0000000040)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_MAXSEG(r10, 0x84, 0xd, &(0x7f00000001c0)=@assoc_value={0x0, 0x6}, 0x8) ioctl$SIOCX25SFACILITIES(r9, 0x89e3, &(0x7f0000000080)={0x37, 0x8800000, 0x8, 0x9, 0x8000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./file0/../file0\x00', 0x1ca) openat2$dir(0xffffffffffffff9c, &(0x7f0000000f80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)={0x0, 0x0, 0x2b}, 0x18) r11 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r11, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) 6.825392351s ago: executing program 4 (id=3522): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) close(r2) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17", 0x2b}], 0x1) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r6, 0x40405514, &(0x7f0000000200)={0x9}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r6, 0xc1105511, &(0x7f0000000040)={0x9}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@multicast2, @loopback}, 0x10) 6.047345335s ago: executing program 6 (id=3523): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="120100003afe0620e6040b000001010203010902240001000010000904140002a024260009050602ff0300000009058202"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4, 0x0, 0x1, {0x22, 0x6ec}}}}, &(0x7f0000000380)={0x2c, &(0x7f00000001c0)={0x40, 0x16}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0xa}, &(0x7f00000002c0)={0x20, 0x1, 0x35, "dd2db9872bd3a9aa93dad75ac172d9b8a33c398ad26e0287b5a3b1bb2a9c7bbf1cab08f47209534feceba5684c23d4a313ca442788"}, &(0x7f0000000340)={0x20, 0x3, 0x1, 0x4}}) 5.211522316s ago: executing program 5 (id=3525): syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) accept4$nfc_llcp(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x401, 0x0) close(0x3) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) 5.070530753s ago: executing program 5 (id=3526): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000040)=0x7) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040b01, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x1000000000000, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0884113, &(0x7f0000000080)={0x1, 0x7, 0x0, 0x8, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffe, 0x2}) (async) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r3, &(0x7f00000029c0)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b3243078b089b3930076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef723d0e74000000003cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) 4.973387275s ago: executing program 3 (id=3527): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_setup(0x494, &(0x7f0000000400)={0x0, 0xf511, 0x8000, 0x1, 0x46}, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x0, 0x2) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x2f) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000003c0)={r4}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000480)={r4, @in={{0x2, 0x4e24, @multicast1}}, 0xe, 0x3}, 0x90) r5 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1, 0x9, &(0x7f00000009c0)=ANY=[@ANYRES16=r5, @ANYRESOCT, @ANYBLOB="43f87c70a0b16f05b1711d562b2dc6c341bd219faaed5ce780f0e7e74404094f4ec95d39a2828f56fcaacdd586bf7e32f25f8465d20a8d2769a5743c54c182e173dd1c6cf165271bb25e718b5b9ad38bfb0f039fd0d6ee59d74d5b41fffa338123809918cf155e8239e82f34987ce9c5144ba44fcf2b1ee8d8c2e5f1b6385288719639b5b07f930544fe1cbb8e6264b8acb0546da1accf72b25deb94b8ec768d0313217c0777d76cf662c376e6d46a6ea52182186266aa3c5fc1d80474", @ANYRESHEX, @ANYRESDEC, @ANYRES64=0x0, @ANYRES32=r2, @ANYRESOCT], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x27, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="020000000100060000000000040000000000000008000100", @ANYRES32=0x0, @ANYBLOB="100000ff9f0000002000000000000000"], 0x2c, 0x3) ioprio_set$pid(0x3, 0x0, 0x0) 4.829932158s ago: executing program 7 (id=3528): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8c) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, 0x0, 0x40814) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f00000000c0), &(0x7f0000000380)=0x4) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000000)='cifs\x00', 0x20000, &(0x7f00000001c0)='=\n\x9b\xa1Q\x83\xe9\n@\xf6\"2a\xd7\x1fch\x1a}#\xfa\xe4\n\xdc[\x03\x97\xcd\xf1\xa6b\x9a\x1f\xff\xff\xffIT\xe4\x8c&\xac\xe6:\xc5\xe8\xd9\"\x82\xd5\xeb\x90\xef1:\xba\xc3\xc3\xd3\xad\'\xc44\x17,,\x8dZz\x04\x17-#F\xc7<\xe6\xf5]%gC\x9e\xca\nS\xc3\xc8\x98\xd8\xc8\x9eZ\xa76\x9f\xc2=\xaa\xcet7\xb9\xbd\xd47\xe3\xc8@$8\v\x9f\xfd\xe1!\x11\x19Y\x06J\x8f\x80\xef9Tw8\x1b\xe2\xf3\x85\xd5}\xa5\xb7\xd5|') openat$kvm(0xffffffffffffff9c, 0x0, 0x800000, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000080)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) readv(0xffffffffffffffff, &(0x7f00000013c0)=[{&(0x7f0000001300)=""/35, 0x23}], 0x1) getgroups(0x2, &(0x7f0000000000)=[0x0, 0x0]) 4.472350845s ago: executing program 3 (id=3530): ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000080)) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x2, 0x5}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050e72210281ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) io_uring_setup(0x7884, &(0x7f0000000a40)={0x0, 0x0, 0x2, 0xfffffffe, 0x3bd}) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$I2C(0x0, 0x0, 0x80) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, 0x0, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_io_uring_submit(0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x47bc, 0x3bf6, 0x7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setrlimit(0x4, &(0x7f0000000480)={0x6, 0x7c9ddb4d}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r3, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000280)={0xe4, 0x0, 0x9, 0x5, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x19}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xe}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x4}}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_TUPLE={0xa8, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x3b}}, {0x14, 0x4, @private1}}}]}]}, 0xe4}}, 0x20000000) 4.094889579s ago: executing program 7 (id=3531): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_io_uring_setup(0x126b, &(0x7f00000006c0)={0x0, 0x72ce}, &(0x7f0000000140), &(0x7f0000000780)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f00000000c0)={0x0, 0x1000000, &(0x7f0000000180)=[0xffffffffffffffff]}, 0x1) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) 3.581511874s ago: executing program 7 (id=3532): r0 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, 0x0, 0x0) sendto$inet(r4, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) r5 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {0x0}], 0x2}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 3.352437251s ago: executing program 4 (id=3533): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47, 0x8, 0x0, 0x0}}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f00000000c0)={@val={0x8, 0x800}, @val={0x5, 0x3, 0x3, 0x2, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x4, 0x28, 0x0, 0x0, 0x8, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, {{0x8100, 0x88a8, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x20, 0x5}}}}, 0x36) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x24, 0x0, 0x0) keyctl$chown(0x4, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, 0x0, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x9}]}]}, 0x30}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000004280)=[{{0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}}], 0x1, 0x4004004) 2.850306187s ago: executing program 6 (id=3534): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$binfmt_register(0xffffff9c, 0x0, 0x1, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r1}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="b4050000000000007112180000000000bc201000210e00000000000000000000159bb11d080054f795ebc6c48b7ee57df364594defe47aa18c81fbcc6c6042dbf743a90b61bae3a57ba478e007fe723b194058bc41fce6c4e98c8804a03ea7c9fc181b86e1c207e4b9c2e55e0d14ef22ee60615176aa293f77cb46958aa9bb869d981e76b9f4fd0f43d8bde942339d7e8fa10c87b5562d7cd8a361f5801b6e29c575dac7f00846c103fa144116db9a8a8850b0715c590a250c52c2b47c7a4176a8c5e2702c9ad3df0cc000"/219], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x3, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x20, 0x0, 0x8}, 0x10}, 0x94) write$binfmt_register(r3, &(0x7f00000004c0)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x0, 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xea(J\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{G\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xbd\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132?\xbf\xb2\x93B\x01\'#\xc0v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde44m\x96+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x8c\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xa1W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, './file0'}, 0x237) socket(0x2, 0x5, 0x7f) sendmsg$IPSET_CMD_FLUSH(r2, 0x0, 0x480c4) r4 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup(r4) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x34000080) syz_80211_join_ibss(&(0x7f0000000180)='wlan1\x00', &(0x7f0000000200)=@default_ibss_ssid, 0x6, 0x2) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000001a0069a925bd70000000"], 0x1c}}, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r6, 0x4b45, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$kcm(0xa, 0x2, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x6, @rand_addr=0x64010101, 0x4e22, 0x3, 'ovf\x00', 0x1, 0x80005, 0x5}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r7, 0x0, 0x485, 0x0, 0x0) 2.784332921s ago: executing program 3 (id=3535): io_uring_setup(0x6190, &(0x7f0000000400)={0x0, 0x0, 0x2, 0x3, 0xfffffffe}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$packet(0x11, 0x3, 0x300) r2 = open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x42, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x497, &(0x7f0000000380)={0x0, 0x7079, 0x400, 0x2, 0x67}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_FALLOCATE={0x11, 0x2, 0x0, @fd, 0x5, 0x0, 0x1}) io_uring_enter(r2, 0x40006bd3, 0x873b, 0x20, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0x14, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002800)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)="93", 0x1}], 0x1}}], 0x1, 0x4c000) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newtaction={0x154, 0x30, 0x1, 0x0, 0x0, {}, [{0x140, 0x1, [@m_ctinfo={0x48, 0x2, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x80, 0x5, 0x5, 0x1, 0x2}}]}, {0x4}, {0xc}, {0xc}}}, @m_nat={0xf4, 0x1, 0x0, 0x0, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x0, 0x0, 0xfffffffa}, @local, @remote}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xfffffff6, 0xe, 0x0, 0x1, 0x4}, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x42}, 0xffffffff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x7, 0xffffffff, 0x2, 0x9, 0x7fff}, @multicast1, @rand_addr=0x64010101, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x7, 0x4, 0x20000000, 0xfffffffc, 0x8000}, @local, @loopback, 0xff000000, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xef2c, 0x1ff, 0x2, 0xb, 0xff}, @multicast2, @empty, 0xffffff00, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x20008000}, 0x8000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) 2.555104222s ago: executing program 7 (id=3536): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, 0x0, 0x809d) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0xf8, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000000e0c0)=""/102400, 0x19000) keyctl$clear(0x3, 0xfffffffffffffffd) bpf$MAP_CREATE(0x0, 0x0, 0x64) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000005500)={0x3a8, 0x43, 0x107, 0xfffffffe, 0x25dfdbfc, {0x1, 0x7c}, [@nested={0x4, 0x145}, @nested={0x38f, 0x1, 0x0, 0x1, [@generic="fa69e35250c77dc9ed83d1eb75b44879a4e3e354ecd3f433b9e12ea128bb2a7f0aed11f457cb7af45048ed9ee50f37e5f5a8d1ad2e5e0d7074b7eeed447c7d0620f0d3d717d37a473b28ffdf7195e80991e0e880dcc0d072fa55ae8439109f6aed83686dbd685ff1347f89ab18e2b836c64aa07329f241d71218413c2edad085a4d1ffcaf5d3801fb28df452d3e785802fd36a592f5c3fba02ac8729cc99c3e59487f01101726424e49a7bd385afc3f6f9efa38c44ee0a4859a986a5b74638504aba51c0c00e157f07ec41ccdebe61e4a7aa89e79de741c0cce7d4c59dd53ba3bfe23bf398e5b0ab461779e9379109707b68fe70ede89c06a9584afe588230e4ec1e2617431f28e89d9c4464f4111f06a347536109f580aa831c80e2f88d6253f1c1e477155b8d63ab771b8c728d9c1d0cabf50a8ecb184d37123ae8e8f35d221c0783160c41ea18a863964d50dddf6f2a0bdcc1ef19eff347ee90e6aeae77dbce60d012418e57234de43a4064611e16e5e52cbe0ba5d1095a19df327ce1d2a7aeeb561c854401bac7d2e913285139b2417c5116c05395a31466c5890cbdadfd5bdc21c3fd74e6b8ab00073de5392d1e85b76862d1c43f7440c994fca497e5c15d888fc1b138f1e5598f93ed418fdee56cc5616b20eb61506a8069028787a04c07f445f42eaaa66a5c84af179a0dcc45ab1ba721fff7339874b22dc333d7255217cf71ee3bacc0d04d0873ccb81fee817e454afe4864e4f80994111690efd522274de3b626f5d25f3d3a15bec20be8b638d450dbc6934a756df38acdc5c23be92cf021e58bcd81cdcd637a91fa61bc00b391cda3582901832592755791856fdad90d5d2c896ce3dc7618da069bf6271bbeb1b5bde535c210047b8563fc8ee02904f7da8389859a225247b7c441b3c6c7508098857a92b57571b6c02e8fa6585aa3155468ea3a9bd1cc1446371ef5c73fdd445cfe83cee6e10e5985404d85a41ba2ed2426ca30b574f4ca74acdf5ccdac0bfdfbb9b3f30f04fd9acbc2c8121583b66b90563fa00b13dd5ed23de90c07cf1f714e74516e65a916e3ae7bb15df360cc9b2da894631b1833ef86b373f7ce1e42bb5bb5dc45f51979d4ae2b13f170393bd0050b0d5de4ebe44b61efd4f1d47dcdb035819e67b69e461100b294fdaea79974c7e9c0763e918de7dcc15fce32b7512b610ece27d42a261861d3132a46a91fdaa810c381119f2069f66a69b08b12212c6f66210a1767f9f6fbd293fd4a19dda329ca1872996d882008"]}]}, 0x3a8}, 0x1, 0x0, 0x0, 0xc004}, 0xc000) socket$nl_generic(0x10, 0x3, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x0, 0x40, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, 0xc060, 0x8}}, 0x20}}, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=@bridge_getlink={0x34, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'wg0\x00'}]}, 0x34}}, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000000)={0x0, 0x401, 0xfff}, 0xc) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x49920d862a92153b, 0x8000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x610, 0x8000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MTU={0x8, 0x3, 0x8000000}, @IFLA_LINKMODE={0x5, 0x11, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) 1.41744892s ago: executing program 7 (id=3537): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x1f, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000200000000000000f2ffffff85004b8d401700009d0000009500"], &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x9}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x48, 0x0, "f6a7346a1ca3caf66200f0e70b995efa20d5ddc09c0bc0c88e00bdea5e6998967d569964c8b68dae57dea91c0e3ef03a96483bcaaa5ab222d1993083e8e3619fbbff30da0288a8b78a3f921c40fdc06a"}, 0xd8) gettid() sendmmsg$inet(r0, &(0x7f0000000f80)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000500)="c5d2dc3df405df68c9deaa5aa2", 0xd}, {&(0x7f0000000540)="f56c1003c0a0f4d6eff2713b46698e120a4a3300d2c0e67726a5f82f9e7a1c79f6d5e9d61aa39feca0a7e9ec2ab31f093ccf36a2e4fbf80d4cfde4a0182a27743ea387cc2ec69cabbcb7d13edcea76b3dc53efa8af1dee135dead20d8277871c611d81b34f6e5029849aed6e97110c1cd3a6ece7c3fa3dcf6785c01e737fa6343ec99069d25a2eb3e9ee709be9860b5e6c", 0x91}, {&(0x7f0000000600)="4d66b05d07e530467b7e662652f34913024a1177a80c2ed2b610b18547", 0x1d}, {&(0x7f0000000640)="fa94c4361456a7a8e2bb1fc83f9b7ecc997163d7963a368a01ca099ef6abd8e8d4065f8f51b2ba0b1729c04943fa151b066b3189f2b9743759c2ea6a37bff44010fa13603c25af1a50155d687680b108f55c543d2b0e836e67fa98fa5e323af5ebbd2ae43db6366bb10d32e5e4aaa949f27739b4e764d4ed875e4b20ef0b8fa1f2944e76d8ba7525f32a1002aad7fae3eea2e225bdf6cd5a78e5fba060ee48de4e61d14ef1d620855bb94c8922b6a70ab65582c97c250d2aa2764e00d30951c27ef1516a47a500aaa9527602dd98f8f32c9447b0fc46d9673d96dccf", 0xdc}, {0x0}], 0x5}}, {{&(0x7f0000000800)={0x2, 0x4e24, @empty}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000840)="1f3ed08a1ea06780855ce67e8b6369c88c2308f2d57f31262871c02ba9c9fb94cedfaf28091957186f7871c395f2aae06a5f39b44d31d56c0c7dc6fe2c14b95ae24e3a97e32b307ba32bea0c3fe18fa15d411b9aa37cb15df12dbe55573d48a7e3d9c47a563ed927ef9ae679978ef42ba91154fced", 0x75}], 0x1, &(0x7f0000000900)=[@ip_ttl={{0x14, 0x0, 0x2, 0xb}}], 0x18}}], 0x2, 0x20000000) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000002c0), 0x4) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='setgroups\x00') r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r2, &(0x7f0000000080), 0x0) r3 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="1c0000005e007f029e3b470d649b72ab25399cd956c07dead6a93690", 0x1c}], 0x1}, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x1d, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000e54903000400"], &(0x7f0000000100)='syzkaller\x00', 0x4000, 0x0, 0x0, 0x40f00, 0x76, '\x00', 0x0, @lsm=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000400)={@in={{0x2, 0x4e20, @multicast2}}, 0x0, 0x0, 0x24, 0x0, "698e86252c563a2eb894ac1de863c518984bfa5ff139aeeef086eed112e6f0ffba88c7d0888990f99dc2416c1cbccf99d18464a65c3587c97aee9217b992893cebfc606ada5e14e782e63da22a6fe97d"}, 0xd8) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0xec) fcntl$setlease(r5, 0x400, 0x0) 1.373548014s ago: executing program 4 (id=3538): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r3, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001000000800000000175ff45858771cb6749599f31552d040158273a4cd9e6bf54fa45acccb2878a270d4e51a74f9c11eefd0c9862d6c1dd9d2fc01dd67ab81a1791c79be585a909616b6eb1f51abb33b289c50907384004188fa813fb4c674450e58c9528346c2be4a1d0f5aa27fcd3def33632b5b28d52d1b63245fd1b356550c2207211372b6df0144217148bf074f306319838cf5b3f98771d8af834684c0e95d44f11ec0e94684cf389417d74035e0474e38a3349aa034612161d2599fb0b93eb66c24db6d8f084c479589a393662463fb2", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r4}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0xa, 0x10, &(0x7f0000000500)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x85}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}]}, &(0x7f0000000080)='GPL\x00'}, 0x94) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)}], 0x1}}], 0x1, 0x20008000) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000140)=@gcm_128={{0x304}, "60000100", "9de66ebc3914c06f0f109088d190e700", '\x00', "f8dde5bf3eba23db"}, 0x28) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)) sched_setparam(r0, &(0x7f0000000180)=0xaad6) bpf$PROG_LOAD(0x5, 0x0, 0x0) 369.697214ms ago: executing program 4 (id=3539): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_setup(0x494, &(0x7f0000000400)={0x0, 0xf511, 0x8000, 0x1, 0x46}, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x0, 0x2) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x2f) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000003c0)={r4}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000480)={r4, @in={{0x2, 0x4e24, @multicast1}}, 0xe, 0x3}, 0x90) r5 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1, 0x9, &(0x7f00000009c0)=ANY=[@ANYRES16=r5, @ANYRESOCT, @ANYBLOB="43f87c70a0b16f05b1711d562b2dc6c341bd219faaed5ce780f0e7e74404094f4ec95d39a2828f56fcaacdd586bf7e32f25f8465d20a8d2769a5743c54c182e173dd1c6cf165271bb25e718b5b9ad38bfb0f039fd0d6ee59d74d5b41fffa338123809918cf155e8239e82f34987ce9c5144ba44fcf2b1ee8d8c2e5f1b6385288719639b5b07f930544fe1cbb8e6264b8acb0546da1accf72b25deb94b8ec768d0313217c0777d76cf662c376e6d46a6ea52182186266aa3c5fc1d80474", @ANYRESHEX, @ANYRESDEC, @ANYRES64=0x0, @ANYRES32=r2, @ANYRESOCT], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x27, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="020000000100060000000000040000000000000008000100", @ANYRES32=0x0, @ANYBLOB="100000ff9f0000002000000000000000"], 0x2c, 0x3) ioprio_set$pid(0x3, 0x0, 0x0) 20.655587ms ago: executing program 3 (id=3540): ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="38000000031401002dbd7000000000000900020073797a81000000000800410073697700140033006c6f00"/56], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) prlimit64(r0, 0xc, &(0x7f0000000180)={0x8, 0x6}, &(0x7f0000000f80)) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x880) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x0, 0x0, 0x0, 0x80000001}) dup3(0xffffffffffffffff, r3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_connect(0x1, 0x3a2, &(0x7f00000002c0)={{0x12, 0x1, 0x310, 0x61, 0x5b, 0x12, 0x20, 0xcde, 0x22, 0x1709, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x390, 0x2, 0x55, 0x19, 0x40, 0x5, [{{0x9, 0x4, 0xae, 0x9d, 0x3, 0x2a, 0x5d, 0x59, 0x1, [], [{{0x9, 0x5, 0x1, 0x0, 0x400, 0x5, 0x0, 0xf5}}, {{0x9, 0x5, 0xa, 0x2, 0x98aeb9ccba575931, 0x7, 0x4, 0xeb, [@generic={0xa0, 0x23, "09bdaaafea61156cb71d6d4a5335d01fb55b5c479ca5207926c9a08caf5262d4f9cf15497a69c005cc7d6077aab1f4edf194f2db0eba9e77f8d16746990b112a3ed9318b230530efe9aee75bba2b1f250ec11aac2061c58d8742479ed4ab8c44dd2aa3934f92bae0f3867d8062905bda168a283b0ba37403cd686fe2d956d676ec2e903360e67d225d0ea174d29b8bfa663520430990229dc1a015a88b19"}]}}, {{0x9, 0x5, 0xd, 0x10, 0x8, 0x2, 0x6, 0xfd}}]}}, {{0x9, 0x4, 0x1d, 0x9, 0xd, 0xff, 0xff, 0xff, 0xe0, [@uac_control={{0xa, 0x24, 0x1, 0x1, 0xa}, [@input_terminal={0xc, 0x24, 0x2, 0x2, 0x202, 0x5, 0x34, 0x9, 0x4e, 0x10}]}], [{{0x9, 0x5, 0x9, 0x0, 0x0, 0xb4, 0x36, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xe, 0x5}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x8, 0x8001}]}}, {{0x9, 0x5, 0x3, 0xc, 0x8, 0x6, 0x4, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x2, 0x7}]}}, {{0x9, 0x5, 0x5, 0x1, 0x200, 0x4, 0x86, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x9, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x67b41c0833855d3e, 0x3, 0x2}]}}, {{0x9, 0x5, 0xc, 0x0, 0x3ff, 0x5, 0xf3, 0x80}}, {{0x9, 0x5, 0x0, 0x10, 0x200, 0x0, 0x0, 0x5, [@generic={0x4c, 0x22, "e76a4b19f7dfc65c269626cfa110bf632e83d222d01d74a55e2abb3b6409e3cf0c623455dacf06bfad097a11d4d0e6a408ddf538e04ef458195690c171d9d37949caaf6e24e89ebbd2e4"}, @generic={0x3, 0x21, "ea"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x400, 0x7, 0xe8, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x5, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0xec, 0x4}]}}, {{0x9, 0x5, 0xc, 0x3, 0x20, 0x2, 0x3, 0x37}}, {{0x9, 0x5, 0xb, 0x0, 0x8, 0xf, 0xf6, 0x3, [@generic={0xcf, 0xa, "fb432fef8a35f4af2be2f5e612c9c1aca67754402e599ef406ac1109d46f077d88687d1b28a33c61d5fe28ea3633637fcd9b18d0ebeb857a9b082e360e00d75b3ef4f2a1c3827fb117070a9f8d1f26b3d0233b84ab3173d57e84eeb530ed7463a81e3397ecf44d486745f664d3c82bec9aa782080bdb998f1c4eb98159f85ddadd55d2f103dc7c53cae6a03cf5e8e579e43b0cf25fdb5f5da6e2fc38cd9304315b423cca49fb76430b3c857f9c56a133299c143aaa66c8d8c95a6100f6bf4f3ac10d8d05180e74cf566c56f386"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x20, 0x5}]}}, {{0x9, 0x5, 0x9, 0x0, 0x20, 0xf, 0x3, 0xf3, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x6, 0x5}, @generic={0x2f, 0x22, "49866caeb392ca376cd45d7410d45001a6416e373fa25435275788bb928658dacf4bec0b84de75ce7f5d6b50f4"}]}}, {{0x9, 0x5, 0xf, 0x4, 0x0, 0x45, 0x0, 0x3, [@generic={0x96, 0xc, "4439243dca37af02e6820075f31c7e563f663f460c538b69eefb8eab66e5368eaebc603ac25ee083b4983fe639a1fe6611d12e99ed60e9ff62f64db522b0fa3cd1973df4d655512423c5a33416b61313aae467f4da41528088769a96023b70e551bcf2881f2f6c8c1fbe05fda183ba31a36d6b61c99c8e4e062422fe03589b3a28e879ae48c024b55aa0f2775b6ddc0069bdd11f"}]}}, {{0x9, 0x5, 0x9, 0x2, 0x3ff, 0x40, 0x9, 0x4}}, {{0x9, 0x5, 0x8, 0x0, 0x8, 0xa, 0x7f, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x0, 0x101}]}}, {{0x9, 0x5, 0x80, 0x11, 0x60, 0x5, 0x1, 0x95}}]}}]}}]}}, &(0x7f00000000c0)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0x7, 0xfe, 0x9, 0x20, 0x7}, 0x2f, &(0x7f0000000040)={0x5, 0xf, 0x2f, 0x5, [@wireless={0xb, 0x10, 0x1, 0x0, 0x0, 0x5, 0x0, 0x2, 0x1}, @wireless={0xb, 0x10, 0x1, 0x8, 0xb9, 0x80, 0x5, 0x9, 0xd0}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x4, 0x3, 0x536}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xb, 0x3d, 0x6}, @ptm_cap={0x3}]}, 0x1, [{0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x810}}]}) 0s ago: executing program 7 (id=3541): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x1f, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000200000000000000f2ffffff85004b8d401700009d0000009500"], &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x9}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x48, 0x0, "f6a7346a1ca3caf66200f0e70b995efa20d5ddc09c0bc0c88e00bdea5e6998967d569964c8b68dae57dea91c0e3ef03a96483bcaaa5ab222d1993083e8e3619fbbff30da0288a8b78a3f921c40fdc06a"}, 0xd8) gettid() sendmmsg$inet(r0, &(0x7f0000000f80)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000500)="c5d2dc3df405df68c9deaa5aa2", 0xd}, {&(0x7f0000000540)="f56c1003c0a0f4d6eff2713b46698e120a4a3300d2c0e67726a5f82f9e7a1c79f6d5e9d61aa39feca0a7e9ec2ab31f093ccf36a2e4fbf80d4cfde4a0182a27743ea387cc2ec69cabbcb7d13edcea76b3dc53efa8af1dee135dead20d8277871c611d81b34f6e5029849aed6e97110c1cd3a6ece7c3fa3dcf6785c01e737fa6343ec99069d25a2eb3e9ee709be9860b5e6c", 0x91}, {&(0x7f0000000600)="4d66b05d07e530467b7e662652f34913024a1177a80c2ed2b610b18547", 0x1d}, {&(0x7f0000000640)="fa94c4361456a7a8e2bb1fc83f9b7ecc997163d7963a368a01ca099ef6abd8e8d4065f8f51b2ba0b1729c04943fa151b066b3189f2b9743759c2ea6a37bff44010fa13603c25af1a50155d687680b108f55c543d2b0e836e67fa98fa5e323af5ebbd2ae43db6366bb10d32e5e4aaa949f27739b4e764d4ed875e4b20ef0b8fa1f2944e76d8ba7525f32a1002aad7fae3eea2e225bdf6cd5a78e5fba060ee48de4e61d14ef1d620855bb94c8922b6a70ab65582c97c250d2aa2764e00d30951c27ef1516a47a500aaa9527602dd98f8f32c9447b0fc46d9673d96dccf", 0xdc}, {0x0}], 0x5}}, {{&(0x7f0000000800)={0x2, 0x4e24, @empty}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000840)="1f3ed08a1ea06780855ce67e8b6369c88c2308f2d57f31262871c02ba9c9fb94cedfaf28091957186f7871c395f2aae06a5f39b44d31d56c0c7dc6fe2c14b95ae24e3a97e32b307ba32bea0c3fe18fa15d411b9aa37cb15df12dbe55573d48a7e3d9c47a563ed927ef9ae679978ef42ba91154fced", 0x75}], 0x1, &(0x7f0000000900)=[@ip_ttl={{0x14, 0x0, 0x2, 0xb}}], 0x18}}], 0x2, 0x20000000) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000002c0), 0x4) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='setgroups\x00') r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r2, &(0x7f0000000080), 0x0) r3 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="1c0000005e007f029e3b470d649b72ab25399cd956c07dead6a93690", 0x1c}], 0x1}, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x1d, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000e54903000400"], &(0x7f0000000100)='syzkaller\x00', 0x4000, 0x0, 0x0, 0x40f00, 0x76, '\x00', 0x0, @lsm=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000400)={@in={{0x2, 0x4e20, @multicast2}}, 0x0, 0x0, 0x24, 0x0, "698e86252c563a2eb894ac1de863c518984bfa5ff139aeeef086eed112e6f0ffba88c7d0888990f99dc2416c1cbccf99d18464a65c3587c97aee9217b992893cebfc606ada5e14e782e63da22a6fe97d"}, 0xd8) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0xec) fcntl$setlease(r5, 0x400, 0x0) kernel console output (not intermixed with test programs): T5868] gspca_main: touptek-2.14.0 probing 0547:6801 [ 956.040005][ T5868] usb 4-1: USB disconnect, device number 80 [ 956.626284][T18768] FAULT_INJECTION: forcing a failure. [ 956.626284][T18768] name failslab, interval 1, probability 0, space 0, times 0 [ 956.649521][T18768] CPU: 0 UID: 0 PID: 18768 Comm: syz.0.3060 Tainted: G L syzkaller #0 PREEMPT(full) [ 956.649545][T18768] Tainted: [L]=SOFTLOCKUP [ 956.649550][T18768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 956.649556][T18768] Call Trace: [ 956.649561][T18768] [ 956.649571][T18768] dump_stack_lvl+0x100/0x190 [ 956.649599][T18768] should_fail_ex.cold+0x5/0xa [ 956.649625][T18768] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 956.649647][T18768] should_failslab+0xc2/0x120 [ 956.649663][T18768] kmem_cache_alloc_noprof+0x83/0x780 [ 956.649677][T18768] ? skb_clone+0x190/0x400 [ 956.649696][T18768] ? skb_clone+0x190/0x400 [ 956.649710][T18768] skb_clone+0x190/0x400 [ 956.649725][T18768] netlink_deliver_tap+0xaed/0xcc0 [ 956.649745][T18768] netlink_unicast+0x650/0x870 [ 956.649764][T18768] ? __pfx_netlink_unicast+0x10/0x10 [ 956.649785][T18768] netlink_sendmsg+0x8b0/0xda0 [ 956.649804][T18768] ? __pfx_netlink_sendmsg+0x10/0x10 [ 956.649820][T18768] ? __might_fault+0x30/0x140 [ 956.649837][T18768] ____sys_sendmsg+0xa54/0xc30 [ 956.649849][T18768] ? __pfx_____sys_sendmsg+0x10/0x10 [ 956.649866][T18768] ___sys_sendmsg+0x190/0x1e0 [ 956.649879][T18768] ? __pfx____sys_sendmsg+0x10/0x10 [ 956.649897][T18768] ? find_held_lock+0x2b/0x80 [ 956.649921][T18768] __sys_sendmsg+0x170/0x220 [ 956.649937][T18768] ? __pfx___sys_sendmsg+0x10/0x10 [ 956.649961][T18768] do_syscall_64+0xc9/0xf80 [ 956.649976][T18768] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.649988][T18768] RIP: 0033:0x7f5d1fd9acb9 [ 956.649998][T18768] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 956.650009][T18768] RSP: 002b:00007f5d20be3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 956.650021][T18768] RAX: ffffffffffffffda RBX: 00007f5d20015fa0 RCX: 00007f5d1fd9acb9 [ 956.650033][T18768] RDX: 0000000000000090 RSI: 00002000000001c0 RDI: 0000000000000003 [ 956.650040][T18768] RBP: 00007f5d20be3090 R08: 0000000000000000 R09: 0000000000000000 [ 956.650046][T18768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 956.650053][T18768] R13: 00007f5d20016038 R14: 00007f5d20015fa0 R15: 00007ffcb963f228 [ 956.650067][T18768] [ 956.933401][T18768] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3060'. [ 959.597567][T18793] pim6reg: entered allmulticast mode [ 959.884905][T18803] netlink: 'syz.4.3070': attribute type 1 has an invalid length. [ 959.895866][T18803] netlink: 'syz.4.3070': attribute type 2 has an invalid length. [ 959.903994][T18803] netlink: 'syz.4.3070': attribute type 2 has an invalid length. [ 959.919946][T18803] netlink: 'syz.4.3070': attribute type 1 has an invalid length. [ 959.976868][T18803] netlink: 'syz.4.3070': attribute type 1 has an invalid length. [ 960.550585][ T5868] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 961.049651][ T5868] usb 4-1: Using ep0 maxpacket: 32 [ 961.057665][ T5868] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 961.077875][T18822] CUSE: info not properly terminated [ 961.083280][ T5868] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 961.114052][ T5868] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 961.135603][ T5868] usb 4-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 961.151575][ T5868] usb 4-1: Product: syz [ 961.155894][ T5868] usb 4-1: Manufacturer: syz [ 961.179988][ T5868] usb 4-1: SerialNumber: syz [ 961.188452][ T5868] usb 4-1: config 0 descriptor?? [ 961.256121][ T5868] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 961.421469][ T36] usb 4-1: Failed to submit usb control message: -71 [ 961.421664][ T795] usb 4-1: USB disconnect, device number 81 [ 961.506520][ T36] usb 4-1: unable to send the bmi data to the device: -71 [ 961.522532][ T36] usb 4-1: unable to get target info from device [ 961.538997][ T36] usb 4-1: could not get target info (-71) [ 961.552076][ T36] usb 4-1: could not probe fw (-71) [ 963.579702][ T5861] usb 4-1: new full-speed USB device number 82 using dummy_hcd [ 963.763020][ T5861] usb 4-1: unable to get BOS descriptor or descriptor too short [ 963.800575][ T5861] usb 4-1: not running at top speed; connect to a high speed hub [ 963.825040][ T5861] usb 4-1: config 4 has an invalid interface number: 147 but max is 0 [ 963.856078][ T5861] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 963.890137][ T5861] usb 4-1: config 4 has no interface number 0 [ 963.924206][ T5861] usb 4-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 963.938280][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 963.971199][ T5861] usb 4-1: Product: syz [ 963.975394][ T5861] usb 4-1: Manufacturer: syz [ 963.995040][ T5861] usb 4-1: SerialNumber: syz [ 964.769256][T18879] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3086'. [ 964.892303][T18879] 8021q: adding VLAN 0 to HW filter on device bond3 [ 965.622909][ T5861] uvcvideo 4-1:4.147: probe with driver uvcvideo failed with error -22 [ 965.673557][T18890] CUSE: info not properly terminated [ 965.684221][ T5861] usb 4-1: USB disconnect, device number 82 [ 966.537522][T18902] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 967.591986][T18916] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3090'. [ 968.089704][T16588] usb 5-1: new low-speed USB device number 70 using dummy_hcd [ 968.531242][T16588] usb 5-1: config 4 has an invalid interface number: 161 but max is 3 [ 968.742544][T16588] usb 5-1: config 4 has an invalid interface number: 227 but max is 3 [ 968.769714][T16588] usb 5-1: config 4 has an invalid interface number: 47 but max is 3 [ 968.797776][T16588] usb 5-1: config 4 has an invalid interface number: 141 but max is 3 [ 968.818080][T16588] usb 5-1: config 4 has an invalid interface number: 36 but max is 3 [ 968.839739][T16588] usb 5-1: config 4 has an invalid interface number: 210 but max is 3 [ 968.855186][T16588] usb 5-1: config 4 has 6 interfaces, different from the descriptor's value: 4 [ 968.864794][T16588] usb 5-1: config 4 has no interface number 0 [ 968.871398][T16588] usb 5-1: config 4 has no interface number 1 [ 968.877596][T16588] usb 5-1: config 4 has no interface number 2 [ 968.884145][T16588] usb 5-1: config 4 has no interface number 3 [ 968.890500][ T5868] usb 4-1: new full-speed USB device number 83 using dummy_hcd [ 968.898940][T16588] usb 5-1: config 4 has no interface number 4 [ 968.905797][T16588] usb 5-1: config 4 has no interface number 5 [ 968.923631][T16588] usb 5-1: config 4 interface 161 altsetting 188 endpoint 0x3 has invalid maxpacket 1088, setting to 8 [ 968.955889][T16588] usb 5-1: config 4 interface 161 altsetting 188 has an invalid descriptor for endpoint zero, skipping [ 968.996177][T16588] usb 5-1: config 4 interface 161 altsetting 188 endpoint 0xA has invalid maxpacket 32, setting to 8 [ 969.013790][T16588] usb 5-1: config 4 interface 161 altsetting 188 has a duplicate endpoint with address 0x3, skipping [ 969.026430][T18943] CUSE: info not properly terminated [ 969.044402][T16588] usb 5-1: config 4 interface 161 altsetting 188 endpoint 0x9 has invalid maxpacket 32, setting to 8 [ 969.065232][ T5868] usb 4-1: config 0 has an invalid interface number: 20 but max is 0 [ 969.075033][ T5868] usb 4-1: config 0 has no interface number 0 [ 969.085217][T16588] usb 5-1: config 4 interface 161 altsetting 188 endpoint 0x5 has invalid maxpacket 1024, setting to 8 [ 969.096975][ T5868] usb 4-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 969.112428][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0xD has an invalid bInterval 0, changing to 4 [ 969.130558][T17499] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 969.144134][T17499] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 969.156225][T17499] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 969.165585][ T5868] usb 4-1: config 0 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 969.165800][T17499] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 969.183786][T17499] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 969.191440][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0xD has invalid maxpacket 8, setting to 0 [ 969.204433][T16588] usb 5-1: config 4 interface 227 altsetting 255 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 969.217557][ T5868] usb 4-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 969.227135][ T5868] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 969.237091][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0x8F has invalid maxpacket 31806, setting to 8 [ 969.248675][ T5868] usb 4-1: Product: syz [ 969.253851][ T5868] usb 4-1: Manufacturer: syz [ 969.258482][ T5868] usb 4-1: SerialNumber: syz [ 969.259210][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0x1 is Bulk; changing to Interrupt [ 969.275832][T16588] usb 5-1: config 4 interface 227 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 969.286561][T18944] lo speed is unknown, defaulting to 1000 [ 969.287734][ T5868] usb 4-1: config 0 descriptor?? [ 969.298242][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0x8 is Bulk; changing to Interrupt [ 969.309642][T18929] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 969.318415][ T5868] usb-storage 4-1:0.20: USB Mass Storage device detected [ 969.326144][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0xC has invalid maxpacket 512, setting to 8 [ 969.339868][T16588] usb 5-1: config 4 interface 227 altsetting 255 has a duplicate endpoint with address 0x8, skipping [ 969.351101][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0x4 has invalid maxpacket 64, setting to 0 [ 969.362932][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0x7 has invalid maxpacket 1024, setting to 0 [ 969.374749][T16588] usb 5-1: config 4 interface 227 altsetting 255 endpoint 0xE has invalid maxpacket 1648, setting to 8 [ 969.416782][T16588] usb 5-1: config 4 interface 227 altsetting 255 has a duplicate endpoint with address 0xE, skipping [ 969.428780][ T5868] usb-storage 4-1:0.20: Quirks match for vid 04e6 pid 000b: 4 [ 969.528257][ T5868] scsi host1: usb-storage 4-1:0.20 [ 969.556934][T16588] usb 5-1: config 4 interface 227 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 969.569201][T16588] usb 5-1: config 4 interface 227 altsetting 255 has a duplicate endpoint with address 0x7, skipping [ 969.588082][T16588] usb 5-1: config 4 interface 227 altsetting 255 has a duplicate endpoint with address 0x1, skipping [ 969.608311][T16588] usb 5-1: config 4 interface 47 altsetting 159 has a duplicate endpoint with address 0x3, skipping [ 969.624982][T16588] usb 5-1: config 4 interface 47 altsetting 159 has 1 endpoint descriptor, different from the interface descriptor's value: 14 [ 969.638839][T16588] usb 5-1: config 4 interface 141 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 969.651214][T16588] usb 5-1: config 4 interface 141 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 969.662872][T16588] usb 5-1: config 4 interface 141 altsetting 1 has a duplicate endpoint with address 0x8, skipping [ 969.674570][T16588] usb 5-1: config 4 interface 141 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 969.686293][T16588] usb 5-1: config 4 interface 36 altsetting 159 has a duplicate endpoint with address 0xC, skipping [ 969.699821][T16588] usb 5-1: config 4 interface 36 altsetting 159 has an invalid descriptor for endpoint zero, skipping [ 969.712141][T16588] usb 5-1: config 4 interface 36 altsetting 159 has a duplicate endpoint with address 0xE, skipping [ 969.723487][T16588] usb 5-1: config 4 interface 36 altsetting 159 has a duplicate endpoint with address 0x7, skipping [ 969.742454][T16588] usb 5-1: config 4 interface 36 altsetting 159 has a duplicate endpoint with address 0x4, skipping [ 969.753859][T16588] usb 5-1: config 4 interface 36 altsetting 159 has 5 endpoint descriptors, different from the interface descriptor's value: 7 [ 969.768275][T16588] usb 5-1: too many endpoints for config 4 interface 210 altsetting 83: 61, using maximum allowed: 30 [ 969.779781][T16588] usb 5-1: config 4 interface 210 altsetting 83 endpoint 0xB is Bulk; changing to Interrupt [ 969.790432][T16588] usb 5-1: config 4 interface 210 altsetting 83 has 2 endpoint descriptors, different from the interface descriptor's value: 61 [ 969.804227][T16588] usb 5-1: config 4 interface 161 has no altsetting 0 [ 969.811536][T16588] usb 5-1: config 4 interface 227 has no altsetting 0 [ 969.818614][T16588] usb 5-1: config 4 interface 47 has no altsetting 0 [ 969.825778][T16588] usb 5-1: config 4 interface 141 has no altsetting 0 [ 969.833116][T16588] usb 5-1: config 4 interface 36 has no altsetting 0 [ 969.904677][T16588] usb 5-1: config 4 interface 210 has no altsetting 0 [ 969.913273][T18944] chnl_net:caif_netlink_parms(): no params data found [ 969.940772][T16588] usb 5-1: New USB device found, idVendor=0908, idProduct=0004, bcdDevice=8d.4e [ 969.950384][T16588] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 969.984434][T16588] usb 5-1: Product: 饄댧ອ稼遚︨㌶悲䣳ᙃ風䲽鯚䉙꺡䣧௔ⱍ醠槡嵐갓歪鰎㖗搛펉툸睱挃訵寍墼辶뫧쪙鱗엜ᨅ鹫Ꙝᵇ꣢藻唨鰺䖱 [ 970.122893][T16588] usb 5-1: Manufacturer: Ј [ 970.216216][T16588] usb 5-1: SerialNumber: ᔤ㐥䷗藎玀鬄涉뻂큄fflﱨ僋뿜ꘙ₫슜을ᰅ酢摴娙缢∨뵖衾⮫驳ⓓ嚕嚝꛺쁻虮솯әᾁᷜ貨䁯鸾Ŗ茹㼋档秥皫쵐쳚⚘窆㳦Q爆꼘봱㠓勁窟䍲榮愶話䦢䣣䮜▯鳧쮃䌈덠㩻陵础幻ꝿ舔룳䪛䦳Ꮜⅷઉ憃错൫㜓鳀㿝飖ඟ솽୿ [ 970.375443][T18924] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 970.397663][T18924] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 970.478866][T18924] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 970.720734][T18944] bridge0: port 1(bridge_slave_0) entered blocking state [ 970.734833][T16588] usb_serial_simple 5-1:4.161: siemens_mpi converter detected [ 970.748977][T16588] usb 5-1: siemens_mpi converter now attached to ttyUSB0 [ 970.771414][T16588] usb_serial_simple 5-1:4.227: siemens_mpi converter detected [ 970.780332][T18944] bridge0: port 1(bridge_slave_0) entered disabled state [ 970.809284][T18944] bridge_slave_0: entered allmulticast mode [ 970.809955][T16588] usb 5-1: siemens_mpi converter now attached to ttyUSB1 [ 970.827470][T18944] bridge_slave_0: entered promiscuous mode [ 970.852556][T16588] usb_serial_simple 5-1:4.47: siemens_mpi converter detected [ 970.868318][T18944] bridge0: port 2(bridge_slave_1) entered blocking state [ 970.885552][T18944] bridge0: port 2(bridge_slave_1) entered disabled state [ 970.885857][T16588] usb 5-1: siemens_mpi converter now attached to ttyUSB2 [ 971.145308][T18944] bridge_slave_1: entered allmulticast mode [ 971.150814][T16588] usb_serial_simple 5-1:4.141: siemens_mpi converter detected [ 971.158499][T18944] bridge_slave_1: entered promiscuous mode [ 971.186058][T16588] usb 5-1: siemens_mpi converter now attached to ttyUSB3 [ 971.219187][T16588] usb_serial_simple 5-1:4.36: siemens_mpi converter detected [ 971.248673][T18944] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 971.259390][T16588] usb 5-1: siemens_mpi converter now attached to ttyUSB4 [ 971.281085][T18944] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 971.292457][T17499] Bluetooth: hci2: command tx timeout [ 971.312495][T16588] usb_serial_simple 5-1:4.210: siemens_mpi converter detected [ 971.324844][T16588] usb 5-1: siemens_mpi converter now attached to ttyUSB5 [ 971.339505][T16588] usb 5-1: USB disconnect, device number 70 [ 971.346030][ T5875] usb 4-1: USB disconnect, device number 83 [ 971.365037][T16588] siemens_mpi ttyUSB0: siemens_mpi converter now disconnected from ttyUSB0 [ 971.376031][T16588] usb_serial_simple 5-1:4.161: device disconnected [ 971.394059][T16588] siemens_mpi ttyUSB1: siemens_mpi converter now disconnected from ttyUSB1 [ 971.472620][ T30] audit: type=1400 audit(2000000502.850:1548): avc: denied { write } for pid=18978 comm="syz.3.3106" name="usbmon6" dev="devtmpfs" ino=734 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 971.487264][T18944] team0: Port device team_slave_0 added [ 971.513213][T18979] netlink: 'syz.5.3107': attribute type 1 has an invalid length. [ 971.521018][T18979] netlink: 'syz.5.3107': attribute type 2 has an invalid length. [ 971.528827][T18979] netlink: 'syz.5.3107': attribute type 2 has an invalid length. [ 971.536717][T18979] netlink: 'syz.5.3107': attribute type 1 has an invalid length. [ 971.544498][T18979] netlink: 'syz.5.3107': attribute type 1 has an invalid length. [ 971.567137][T18944] team0: Port device team_slave_1 added [ 971.643919][T16588] usb_serial_simple 5-1:4.227: device disconnected [ 971.664544][T16588] siemens_mpi ttyUSB2: siemens_mpi converter now disconnected from ttyUSB2 [ 971.680524][T16588] usb_serial_simple 5-1:4.47: device disconnected [ 971.704284][T16588] siemens_mpi ttyUSB3: siemens_mpi converter now disconnected from ttyUSB3 [ 971.720270][T16588] usb_serial_simple 5-1:4.141: device disconnected [ 971.781713][T16588] siemens_mpi ttyUSB4: siemens_mpi converter now disconnected from ttyUSB4 [ 971.814623][T18997] fuse: Unknown parameter 'grou00000000000000000000' [ 971.834212][T16588] usb_serial_simple 5-1:4.36: device disconnected [ 971.856018][T18944] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 971.864016][T16588] siemens_mpi ttyUSB5: siemens_mpi converter now disconnected from ttyUSB5 [ 971.871197][T18944] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.349704][T16588] usb_serial_simple 5-1:4.210: device disconnected [ 972.468762][T18944] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 972.487062][T18944] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 972.498441][T18944] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.977754][T18944] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 973.182513][ T30] audit: type=1400 audit(2000000504.560:1549): avc: denied { write } for pid=19007 comm="syz.3.3114" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 973.295582][T19010] netlink: 176976 bytes leftover after parsing attributes in process `syz.3.3114'. [ 973.307318][T18944] hsr_slave_0: entered promiscuous mode [ 973.331965][T18944] hsr_slave_1: entered promiscuous mode [ 973.339970][T19010] netlink: Unknown conntrack attr (type=5378, max=9) [ 973.358221][T18944] debugfs: 'hsr0' already exists in 'hsr' [ 973.370433][T17499] Bluetooth: hci2: command tx timeout [ 973.375719][T18944] Cannot create hsr debugfs directory [ 973.466261][T19015] syzkaller1: entered promiscuous mode [ 973.484698][T19015] syzkaller1: entered allmulticast mode [ 974.029974][ T30] audit: type=1400 audit(2000000505.390:1550): avc: denied { read } for pid=19019 comm="syz.4.3117" path="socket:[65144]" dev="sockfs" ino=65144 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 974.406429][T18944] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 974.430584][T18944] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 974.491342][T18944] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 974.516260][T18944] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 974.632107][ T30] audit: type=1400 audit(2000000506.010:1551): avc: denied { sys_module } for pid=19028 comm="syz.3.3119" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 974.749905][T18944] 8021q: adding VLAN 0 to HW filter on device bond0 [ 974.775511][T18944] 8021q: adding VLAN 0 to HW filter on device team0 [ 974.804168][ T1002] bridge0: port 1(bridge_slave_0) entered blocking state [ 974.810017][ T5861] usb 6-1: new full-speed USB device number 60 using dummy_hcd [ 974.811380][ T1002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 974.833772][T16094] bridge0: port 2(bridge_slave_1) entered blocking state [ 974.840993][T16094] bridge0: port 2(bridge_slave_1) entered forwarding state [ 974.995206][T19050] fuse: Unknown parameter 'group_i00000000000000000000' [ 975.061159][ T5861] usb 6-1: config 0 has no interfaces? [ 975.071836][ T5861] usb 6-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 975.093644][ T5861] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.143188][ T5861] usb 6-1: Product: syz [ 975.180306][ T5861] usb 6-1: Manufacturer: syz [ 975.215927][ T5861] usb 6-1: SerialNumber: syz [ 975.238258][ T5861] usb 6-1: config 0 descriptor?? [ 975.267342][T19052] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 975.450691][T17499] Bluetooth: hci2: command tx timeout [ 975.558595][T19065] team0: Device gtp0 is up. Set it down before adding it as a team port [ 976.034220][T18944] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 977.805581][T17499] Bluetooth: hci2: command tx timeout [ 977.822295][T18944] veth0_vlan: entered promiscuous mode [ 977.861327][T18944] veth1_vlan: entered promiscuous mode [ 977.961856][T18944] veth0_macvtap: entered promiscuous mode [ 978.003859][ T5861] usb 6-1: USB disconnect, device number 60 [ 978.013536][T18944] veth1_macvtap: entered promiscuous mode [ 978.110576][T18944] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 978.146431][T18944] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 978.206393][ T6359] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 978.247268][ T6359] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 978.271081][ T6359] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 978.289251][ T6359] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 978.499679][ T5861] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 978.692484][T18016] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 978.722217][T18016] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 978.762454][ T5861] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 978.784716][ T5861] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 978.825231][ T5861] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 978.830109][T16094] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 978.847692][ T5861] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 978.858392][T16094] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 978.878534][ T5861] usb 6-1: SerialNumber: syz [ 979.083087][T19105] fuse: Bad value for 'fd' [ 979.185958][ T5861] usb 6-1: 0:2 : does not exist [ 979.248339][ T5861] usb 6-1: USB disconnect, device number 61 [ 979.366543][T18817] udevd[18817]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 979.733592][ T5819] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 979.750849][ T5819] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 979.761710][ T5819] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 979.769481][ T5819] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 979.782951][ T5819] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 979.932874][T19118] lo speed is unknown, defaulting to 1000 [ 980.011626][T19127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 980.055416][T19127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 980.170299][ T795] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 980.240043][ T5861] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 980.371525][ T795] usb 1-1: config 128 has an invalid interface number: 148 but max is 0 [ 980.394412][ T795] usb 1-1: config 128 has no interface number 0 [ 980.411450][ T795] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 980.432948][T19118] chnl_net:caif_netlink_parms(): no params data found [ 980.455852][ T5861] usb 6-1: config 1 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 255 [ 980.469897][ T795] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 980.494676][ T5861] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 980.513943][ T795] usb 1-1: config 128 interface 148 has no altsetting 0 [ 980.530146][ T5861] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 980.554205][ T795] usb 1-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 980.574483][ T5861] usb 6-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 980.585700][ T795] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 980.603755][ T5861] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 980.619452][ T795] usb 1-1: Product: syz [ 980.633000][ T795] usb 1-1: Manufacturer: syz [ 980.647306][ T5861] usb-storage 6-1:1.0: USB Mass Storage device detected [ 980.657248][ T795] usb 1-1: SerialNumber: syz [ 980.698877][ T5861] usb-storage 6-1:1.0: Quirks match for vid 1908 pid 1315: 20000 [ 980.846409][ T89] usb 6-1: USB disconnect, device number 62 [ 980.913819][ T795] usb 1-1: USB disconnect, device number 64 [ 980.979154][T19118] bridge0: port 1(bridge_slave_0) entered blocking state [ 980.979774][ T5861] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 981.042177][T19118] bridge0: port 1(bridge_slave_0) entered disabled state [ 981.054887][T19118] bridge_slave_0: entered allmulticast mode [ 981.077761][T19118] bridge_slave_0: entered promiscuous mode [ 981.161361][ T5861] usb 5-1: Using ep0 maxpacket: 32 [ 981.174806][ T5861] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 981.192847][T19118] bridge0: port 2(bridge_slave_1) entered blocking state [ 981.209945][T19118] bridge0: port 2(bridge_slave_1) entered disabled state [ 981.213896][ T5861] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 981.217457][T19118] bridge_slave_1: entered allmulticast mode [ 981.247611][ T5861] usb 5-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 981.260851][ T5861] usb 5-1: Product: syz [ 981.267916][ T5861] usb 5-1: Manufacturer: syz [ 981.278050][ T5861] usb 5-1: SerialNumber: syz [ 981.288600][T19118] bridge_slave_1: entered promiscuous mode [ 981.289146][ T5861] usb 5-1: config 0 descriptor?? [ 981.353497][ T5861] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 981.417419][T18648] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 981.430561][ T795] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 981.543425][T19118] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 981.587196][T19118] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 981.589700][ T795] usb 1-1: Using ep0 maxpacket: 8 [ 981.611714][ T5861] usb 5-1: USB disconnect, device number 71 [ 981.620676][ T5969] usb 5-1: Failed to submit usb control message: -71 [ 981.644870][ T795] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 981.658185][ T5969] usb 5-1: unable to send the bmi data to the device: -71 [ 981.677145][ T795] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 981.687447][ T5969] usb 5-1: unable to get target info from device [ 981.705623][ T795] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 981.717857][ T5969] usb 5-1: could not get target info (-71) [ 981.733284][ T5969] usb 5-1: could not probe fw (-71) [ 981.743955][ T795] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 16 [ 981.767203][ T795] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 981.821861][ T795] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 981.843286][ T795] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.861254][T17499] Bluetooth: hci6: command tx timeout [ 982.197457][T19153] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 3 [ 982.292688][T18648] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 982.445407][ T795] usb 1-1: usb_control_msg returned -32 [ 982.459811][ T795] usbtmc 1-1:16.0: can't read capabilities [ 982.610142][T19118] team0: Port device team_slave_0 added [ 982.809721][T19159] netlink: zone id is out of range [ 982.814925][T19159] netlink: zone id is out of range [ 982.820371][T19159] netlink: zone id is out of range [ 982.825535][T19159] netlink: zone id is out of range [ 982.830768][T19159] netlink: zone id is out of range [ 982.835934][T19159] netlink: zone id is out of range [ 982.841114][T19159] netlink: zone id is out of range [ 982.846255][T19159] netlink: zone id is out of range [ 982.851461][T19159] netlink: zone id is out of range [ 982.985566][T19161] usbtmc 1-1:16.0: usb_bulk_msg returned -71 [ 983.144422][T18648] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.173445][T19118] team0: Port device team_slave_1 added [ 983.186520][ T5861] usb 1-1: USB disconnect, device number 65 [ 983.317547][T18648] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.355271][T19118] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 983.375013][T19118] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 983.457602][T19118] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 983.489901][T19118] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 983.503219][T19118] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 983.562773][T19118] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 983.972371][T17499] Bluetooth: hci6: command tx timeout [ 984.011742][ T30] audit: type=1400 audit(2000000515.380:1552): avc: denied { set_context_mgr } for pid=19177 comm="syz.0.3152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 984.037713][T19178] binder: 19177:19178 ioctl c0306201 0 returned -14 [ 984.169277][T19118] hsr_slave_0: entered promiscuous mode [ 984.190992][T19118] hsr_slave_1: entered promiscuous mode [ 984.197010][T19118] debugfs: 'hsr0' already exists in 'hsr' [ 984.211266][T19118] Cannot create hsr debugfs directory [ 984.466628][T18648] bridge_slave_1: left allmulticast mode [ 984.483200][T18648] bridge_slave_1: left promiscuous mode [ 984.495348][T18648] bridge0: port 2(bridge_slave_1) entered disabled state [ 984.521785][T18648] bridge_slave_0: left allmulticast mode [ 984.534758][T18648] bridge_slave_0: left promiscuous mode [ 984.546894][T18648] bridge0: port 1(bridge_slave_0) entered disabled state [ 984.616636][T19181] fuse: Unknown parameter 'group_id00000000000000000000' [ 985.177706][ T5875] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 985.349655][ T5875] usb 6-1: Using ep0 maxpacket: 32 [ 985.361294][ T5875] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 985.378757][ T5875] usb 6-1: config 0 has no interfaces? [ 985.385031][T18648] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 985.391536][ T5875] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 985.407667][T18648] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 985.409975][ T5875] usb 6-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 985.428823][T18648] bond0 (unregistering): Released all slaves [ 985.435887][ T5875] usb 6-1: Product: syz [ 985.442262][ T5875] usb 6-1: Manufacturer: syz [ 985.460959][ T5875] usb 6-1: config 0 descriptor?? [ 985.735612][T18648] bond1 (unregistering): Released all slaves [ 985.869145][T18648] : left promiscuous mode [ 986.009754][T17499] Bluetooth: hci6: command tx timeout [ 986.087007][T19193] sp0: Synchronizing with TNC [ 986.092541][ T89] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 986.269681][ T89] usb 1-1: Using ep0 maxpacket: 32 [ 986.317007][ T89] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 986.352770][ T89] usb 1-1: config 0 has no interface number 0 [ 986.373644][ T89] usb 1-1: config 0 interface 196 has no altsetting 0 [ 986.401533][ T89] usb 1-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 986.412603][ T89] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 986.420910][ T89] usb 1-1: Product: syz [ 986.431208][ T89] usb 1-1: Manufacturer: syz [ 986.515124][ T89] usb 1-1: SerialNumber: syz [ 986.645073][ T89] usb 1-1: config 0 descriptor?? [ 986.877388][ T795] usb 1-1: USB disconnect, device number 66 [ 987.808900][T18648] hsr_slave_0: left promiscuous mode [ 987.886156][T18648] hsr_slave_1: left promiscuous mode [ 987.985775][T18648] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 988.012820][T18648] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 988.032587][T18648] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 988.052394][T18648] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 988.090063][T17499] Bluetooth: hci6: command tx timeout [ 988.105134][T18648] veth0_macvtap: left promiscuous mode [ 988.130727][T18648] veth1_vlan: left promiscuous mode [ 988.135985][T18648] veth0_vlan: left promiscuous mode [ 988.695603][T19224] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 990.858835][T18648] team0 (unregistering): Port device team_slave_1 removed [ 991.794786][ T89] usb 6-1: USB disconnect, device number 63 [ 991.963419][T17499] Bluetooth: hci5: unexpected event for opcode 0x2043 [ 992.507824][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.514565][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.818203][T19118] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 993.797086][T19118] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 993.893661][T19118] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 994.062881][T19270] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 994.119275][T19118] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 995.386895][T18648] IPVS: stop unused estimator thread 0... [ 995.945991][T19118] 8021q: adding VLAN 0 to HW filter on device bond0 [ 996.833512][T17499] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 996.844898][T17499] Bluetooth: hci5: Injecting HCI hardware error event [ 996.859871][ T5819] Bluetooth: hci5: hardware error 0x00 [ 996.883757][T19118] 8021q: adding VLAN 0 to HW filter on device team0 [ 996.909138][ T3509] bridge0: port 1(bridge_slave_0) entered blocking state [ 996.916302][ T3509] bridge0: port 1(bridge_slave_0) entered forwarding state [ 997.053318][ T3509] bridge0: port 2(bridge_slave_1) entered blocking state [ 997.060464][ T3509] bridge0: port 2(bridge_slave_1) entered forwarding state [ 997.529757][T19325] bridge0: port 3(gretap0) entered blocking state [ 997.537143][T19325] bridge0: port 3(gretap0) entered disabled state [ 997.550096][T19325] gretap0: entered allmulticast mode [ 997.591956][T19325] gretap0: entered promiscuous mode [ 997.602323][T19325] bridge0: port 3(gretap0) entered blocking state [ 997.609387][T19325] bridge0: port 3(gretap0) entered forwarding state [ 998.374395][T19118] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 998.713920][T19118] veth0_vlan: entered promiscuous mode [ 998.761294][T19118] veth1_vlan: entered promiscuous mode [ 998.890296][ T5819] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 999.044365][T19118] veth0_macvtap: entered promiscuous mode [ 999.137320][T19118] veth1_macvtap: entered promiscuous mode [ 999.178614][T19118] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 999.219487][T19118] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 999.255061][T16094] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.283849][T16094] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.332639][T16094] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.393345][T16094] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.527819][ T6012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 999.604497][ T6012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 999.837999][T19345] netlink: 'syz.4.3184': attribute type 1 has an invalid length. [ 999.846049][T19345] netlink: 'syz.4.3184': attribute type 2 has an invalid length. [ 999.854095][T19345] netlink: 'syz.4.3184': attribute type 2 has an invalid length. [ 999.860854][T16094] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 999.870886][T19345] netlink: 'syz.4.3184': attribute type 1 has an invalid length. [ 999.878980][T19345] netlink: 'syz.4.3184': attribute type 1 has an invalid length. [ 1000.048354][T16094] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1000.359042][T19354] fuse: Bad value for 'user_id' [ 1000.825933][T19354] fuse: Bad value for 'user_id' [ 1001.184484][T19358] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3136'. [ 1001.197231][T19358] : entered promiscuous mode [ 1002.298314][T19379] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 1002.368133][T10466] IPVS: starting estimator thread 0... [ 1002.469650][T19381] IPVS: using max 47 ests per chain, 112800 per kthread [ 1002.560481][T16588] IPVS: starting estimator thread 0... [ 1002.673938][T19388] IPVS: using max 76 ests per chain, 182400 per kthread [ 1003.495616][T19397] CUSE: info not properly terminated [ 1003.920569][T19403] netlink: 'syz.5.3197': attribute type 1 has an invalid length. [ 1003.928450][T19403] netlink: 'syz.5.3197': attribute type 2 has an invalid length. [ 1003.937510][T19403] netlink: 'syz.5.3197': attribute type 2 has an invalid length. [ 1003.945618][T19403] netlink: 'syz.5.3197': attribute type 1 has an invalid length. [ 1003.953801][T19403] netlink: 'syz.5.3197': attribute type 1 has an invalid length. [ 1004.252904][T19407] FAULT_INJECTION: forcing a failure. [ 1004.252904][T19407] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1004.286584][T19407] CPU: 0 UID: 0 PID: 19407 Comm: syz.0.3199 Tainted: G L syzkaller #0 PREEMPT(full) [ 1004.286621][T19407] Tainted: [L]=SOFTLOCKUP [ 1004.286628][T19407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1004.286640][T19407] Call Trace: [ 1004.286647][T19407] [ 1004.286655][T19407] dump_stack_lvl+0x100/0x190 [ 1004.286693][T19407] should_fail_ex.cold+0x5/0xa [ 1004.286726][T19407] _copy_from_user+0x2e/0xd0 [ 1004.286754][T19407] __sys_bpf+0x243/0x5050 [ 1004.286779][T19407] ? __pfx___sys_bpf+0x10/0x10 [ 1004.286798][T19407] ? proc_fail_nth_write+0x9f/0x220 [ 1004.286825][T19407] ? find_held_lock+0x2b/0x80 [ 1004.286856][T19407] ? find_held_lock+0x2b/0x80 [ 1004.286879][T19407] ? ksys_write+0x190/0x250 [ 1004.286906][T19407] ? __mutex_unlock_slowpath+0x15c/0x790 [ 1004.286945][T19407] ? fput+0x79/0x100 [ 1004.286968][T19407] ? ksys_write+0x1ac/0x250 [ 1004.286986][T19407] ? __pfx_ksys_write+0x10/0x10 [ 1004.287010][T19407] __x64_sys_bpf+0x7b/0xc0 [ 1004.287029][T19407] ? lockdep_hardirqs_on+0x78/0x100 [ 1004.287049][T19407] do_syscall_64+0xc9/0xf80 [ 1004.287070][T19407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1004.287088][T19407] RIP: 0033:0x7f5d1fd9acb9 [ 1004.287103][T19407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1004.287119][T19407] RSP: 002b:00007f5d20be3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1004.287134][T19407] RAX: ffffffffffffffda RBX: 00007f5d20015fa0 RCX: 00007f5d1fd9acb9 [ 1004.287144][T19407] RDX: 0000000000000050 RSI: 0000200000000040 RDI: 000000000000000a [ 1004.287153][T19407] RBP: 00007f5d20be3090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.287163][T19407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1004.287174][T19407] R13: 00007f5d20016038 R14: 00007f5d20015fa0 R15: 00007ffcb963f228 [ 1004.287198][T19407] [ 1004.566320][T19411] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3201'. [ 1005.933712][T19427] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1006.273410][T19434] lo speed is unknown, defaulting to 1000 [ 1006.804015][T19437] lo speed is unknown, defaulting to 1000 [ 1007.040906][ T5861] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1007.506873][T16757] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 1007.725195][ T5861] usb 4-1: config 0 has an invalid interface number: 84 but max is 0 [ 1007.744869][ T5861] usb 4-1: config 0 has no interface number 0 [ 1007.761538][ T5861] usb 4-1: too many endpoints for config 0 interface 84 altsetting 105: 77, using maximum allowed: 30 [ 1007.772997][ T5861] usb 4-1: config 0 interface 84 altsetting 105 has 0 endpoint descriptors, different from the interface descriptor's value: 77 [ 1007.794094][ T5861] usb 4-1: config 0 interface 84 has no altsetting 0 [ 1007.816126][ T5861] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 1007.846659][ T5861] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1007.893788][T16757] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 1007.913396][T16757] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1008.197369][ T5861] usb 4-1: config 0 descriptor?? [ 1008.221351][T19456] CUSE: info not properly terminated [ 1008.226887][T16757] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1008.263309][T16757] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1008.281961][T16757] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1008.299714][T16757] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1008.429735][T16757] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1008.437479][T16757] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1008.447131][T16757] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1008.485769][T16757] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1008.692020][ T5861] usb 4-1: string descriptor 0 read error: -71 [ 1008.710758][T16757] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1008.728717][ T5861] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 1008.736077][T16757] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1008.748742][T16757] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1008.870747][ T5861] usb 4-1: USB disconnect, device number 84 [ 1009.103936][T16757] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1009.118151][T16757] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1009.130543][T16757] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1009.138671][T16757] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1009.152172][T16757] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1009.176969][T16757] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1009.197026][T16757] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1009.216735][T16757] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1009.255330][T16757] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1009.276351][T16757] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1009.296503][T16757] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1009.395412][T16757] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1009.413158][T16757] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1009.429670][T16757] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1009.438078][T16757] usb 1-1: Product: syz [ 1009.523408][ T6567] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1009.534925][T16757] usb 1-1: Manufacturer: syz [ 1009.557739][T16757] usb 1-1: SerialNumber: syz [ 1009.572306][T16757] usb 1-1: config 0 descriptor?? [ 1009.590318][T16757] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0 [ 1009.610443][T19468] nbd6: detected capacity change from 0 to 63 [ 1009.677569][T19470] block nbd6: NBD_DISCONNECT [ 1009.719735][ T6567] usb 5-1: Using ep0 maxpacket: 32 [ 1009.726786][ T6567] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 1009.814206][ T6567] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1009.825990][T19470] block nbd6: Disconnected due to user request. [ 1009.873819][T19470] block nbd6: shutting down sockets [ 1009.891796][ T6567] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1009.901531][ T6567] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1009.912869][ T6567] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1009.922716][ T6567] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1009.935843][ T6567] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1009.944955][ T6567] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1009.967330][ C0] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1009.969537][ T89] usb 1-1: USB disconnect, device number 67 [ 1009.976978][ C0] buffer_io_error: 11 callbacks suppressed [ 1009.976994][ C0] Buffer I/O error on dev nbd6, logical block 0, async page read [ 1010.008356][ T6567] usb 5-1: config 0 descriptor?? [ 1010.036290][ T89] yurex 1-1:0.0: USB YUREX #0 now disconnected [ 1010.071660][ C0] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.081297][ C0] Buffer I/O error on dev nbd6, logical block 1, async page read [ 1010.134899][ C0] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.144553][ C0] Buffer I/O error on dev nbd6, logical block 2, async page read [ 1010.152936][ C0] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.162549][ C0] Buffer I/O error on dev nbd6, logical block 3, async page read [ 1010.190856][T18990] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.242755][ T6567] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 72 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1010.280537][T18990] Buffer I/O error on dev nbd6, logical block 0, async page read [ 1010.372062][T18990] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.382059][T18990] Buffer I/O error on dev nbd6, logical block 1, async page read [ 1010.389934][T18990] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.399712][T18990] Buffer I/O error on dev nbd6, logical block 2, async page read [ 1010.407544][T18990] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.422055][T18990] Buffer I/O error on dev nbd6, logical block 3, async page read [ 1010.448279][T18990] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.472252][ T6567] usb 5-1: USB disconnect, device number 72 [ 1010.689273][ T6567] usblp0: removed [ 1010.737716][T18990] Buffer I/O error on dev nbd6, logical block 0, async page read [ 1010.770174][T18990] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1010.813453][T18990] Buffer I/O error on dev nbd6, logical block 1, async page read [ 1010.834164][T18990] ldm_validate_partition_table(): Disk read failed. [ 1010.850009][T18990] Dev nbd6: unable to read RDB block 0 [ 1010.866162][T18990] nbd6: unable to read partition table [ 1010.922051][T18990] ldm_validate_partition_table(): Disk read failed. [ 1010.951754][T18990] Dev nbd6: unable to read RDB block 0 [ 1010.957749][T18990] nbd6: unable to read partition table [ 1011.178196][T19488] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1011.185608][T19488] IPv6: NLM_F_CREATE should be set when creating new route [ 1011.193083][T19488] IPv6: NLM_F_CREATE should be set when creating new route [ 1011.200365][T19488] IPv6: NLM_F_CREATE should be set when creating new route [ 1012.289705][ T30] audit: type=1400 audit(2000000543.650:1553): avc: denied { bind } for pid=19496 comm="syz.4.3221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1012.469695][ T89] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 1012.754897][ T89] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1012.774327][ T89] usb 1-1: config 9 has an invalid interface number: 209 but max is 2 [ 1012.809904][ T89] usb 1-1: config 9 has an invalid interface number: 254 but max is 2 [ 1012.835108][ T89] usb 1-1: config 9 has no interface number 1 [ 1013.470542][ T89] usb 1-1: config 9 has no interface number 2 [ 1013.479863][ T89] usb 1-1: config 9 interface 209 has no altsetting 0 [ 1013.486692][ T89] usb 1-1: config 9 interface 254 has no altsetting 0 [ 1013.623626][ T89] usb 1-1: config 9 interface 0 has no altsetting 0 [ 1013.762973][ T89] usb 1-1: New USB device found, idVendor=05c6, idProduct=9245, bcdDevice=d1.2a [ 1013.813198][ T89] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.861315][ T89] usb 1-1: Product: syz [ 1013.886020][ T89] usb 1-1: Manufacturer: syz [ 1013.913981][ T89] usb 1-1: SerialNumber: syz [ 1014.147174][T19518] fuse: Invalid rootmode [ 1014.483127][T19520] veth0_to_team: entered promiscuous mode [ 1015.759767][T16588] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1016.050375][T16588] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 1016.110662][T16588] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1016.142910][T16588] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1016.182214][T16588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1016.227497][T16588] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1016.266556][T16588] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1016.306776][T16588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1016.331281][ T89] usb 1-1: can't set config #9, error -71 [ 1016.337667][T16588] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1016.359439][ T89] usb 1-1: USB disconnect, device number 68 [ 1016.367860][T16588] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1016.398474][T16588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1016.420372][T16588] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1016.439661][T16588] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1016.469222][T16588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1016.491567][T16588] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1016.518300][T16588] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1016.550877][ T30] audit: type=1400 audit(2000000547.930:1554): avc: denied { create } for pid=19533 comm="syz.0.3230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1016.563539][T16588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1016.612953][T16588] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1016.642313][T16588] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1016.686430][T16588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1016.712321][T16588] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1016.739290][T16588] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1016.781142][T16588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1016.797843][T16588] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1016.816356][T16588] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1016.840123][T16142] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 1016.844231][T16588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1016.872783][T16588] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1016.892889][T16588] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1016.910893][T16588] usb 6-1: Product: syz [ 1016.919381][T16588] usb 6-1: Manufacturer: syz [ 1016.929398][T16588] usb 6-1: SerialNumber: syz [ 1016.945931][T16588] usb 6-1: config 0 descriptor?? [ 1016.977303][T16588] yurex 6-1:0.0: USB YUREX device now attached to Yurex #0 [ 1017.001038][T16142] usb 1-1: Using ep0 maxpacket: 8 [ 1017.023204][T16142] usb 1-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 1017.057577][T16142] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1017.089248][T16142] usb 1-1: Product: syz [ 1017.098445][T16142] usb 1-1: Manufacturer: syz [ 1017.110440][T16142] usb 1-1: SerialNumber: syz [ 1017.131689][T16142] usb 1-1: config 0 descriptor?? [ 1017.143103][T16142] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 1017.152409][T16142] pctv452e: pctv452e_power_ctrl: 1 [ 1017.152409][T16142] [ 1017.162013][T16142] usb 1-1: selecting invalid altsetting 3 [ 1017.201613][T16142] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 1017.201613][T16142] [ 1017.235863][T16757] usb 6-1: USB disconnect, device number 64 [ 1017.249959][T16757] yurex 6-1:0.0: USB YUREX #0 now disconnected [ 1017.266254][T16142] dvb-usb: bulk message failed: -22 (5/0) [ 1017.276606][T16142] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1017.417794][T16142] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 1017.425793][T19534] dvb-usb: bulk message failed: -22 (7/0) [ 1017.432128][T19534] pctv452e: I2C error -22; AA 01 00 00 00 -> aa 01 31 03 00 00 00 [ 1017.928093][T16142] usb 1-1: media controller created [ 1017.977750][T16142] dvb-usb: bulk message failed: -22 (8/0) [ 1018.005316][T16142] pctv452e: I2C error -22; AA 02 A0 01 14 -> aa 02 31 04 a0 01 14 [ 1018.070619][T16142] dvb-usb: MAC address reading failed. [ 1018.091869][T16142] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1018.236438][T16142] DVB: Unable to find symbol stb0899_attach() [ 1018.250039][T16142] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 1018.449768][T16588] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1018.670154][ T30] audit: type=1400 audit(2000000550.030:1555): avc: denied { setattr } for pid=17494 comm="syz-executor" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1018.749838][T16142] rc_core: IR keymap rc-tt-1500 not found [ 1018.755651][T16142] Registered IR keymap rc-empty [ 1018.864646][T16142] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 1018.879935][T16588] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1018.881827][T16142] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input29 [ 1018.925499][T16142] dvb-usb: schedule remote query interval to 100 msecs. [ 1018.989942][T19567] : Can't lookup blockdev [ 1019.372255][T16588] usb 4-1: config 0 has no interface number 0 [ 1019.389967][T16588] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1019.420969][T16142] pctv452e: pctv452e_power_ctrl: 0 [ 1019.420969][T16142] [ 1019.432185][T16142] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 1019.469643][T16588] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1019.475071][T16142] usb 1-1: USB disconnect, device number 69 [ 1019.479466][T16588] usb 4-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 1019.534818][T16757] dvb-usb: bulk message failed: -22 (4/0) [ 1019.635752][T16757] dvb-usb: error -22 while querying for an remote control event. [ 1019.736530][T16588] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1019.807702][T16588] usb 4-1: config 0 descriptor?? [ 1019.947644][T16142] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 1020.315981][T16588] prodikeys 0003:041E:2801.001B: hidraw1: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.3-1/input1 [ 1020.418665][T16588] hid_prodikeys: hid-prodikeys: failed to find output report [ 1020.418665][T16588] [ 1021.617367][T16588] usb 4-1: USB disconnect, device number 85 [ 1022.852751][ T30] audit: type=1400 audit(2000000554.230:1556): avc: denied { map } for pid=19616 comm="syz.3.3244" path="/dev/cec3" dev="devtmpfs" ino=963 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1022.945403][ T30] audit: type=1400 audit(2000000554.230:1557): avc: denied { execute } for pid=19616 comm="syz.3.3244" path="/dev/cec3" dev="devtmpfs" ino=963 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1023.109038][T19623] qnx4: unable to read the superblock [ 1023.455477][T19625] block nbd0: server does not support multiple connections per device. [ 1023.545270][T19625] block nbd0: shutting down sockets [ 1024.885762][T19645] : Can't lookup blockdev [ 1025.934921][T19660] Invalid source name [ 1026.056499][T19660] UBIFS error (pid: 19660): cannot open "/dev/sg0", error -22 [ 1026.229721][T16142] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1026.594315][ C1] wlan0: beacon TX faster than countdown (channel/color switch) completion [ 1026.920904][T16142] usb 6-1: too many configurations: 30, using maximum allowed: 8 [ 1026.956572][T16142] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1026.989783][T16142] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1027.018604][T16142] usb 6-1: Product: syz [ 1027.028737][T16142] usb 6-1: Manufacturer: syz [ 1027.048967][T16142] usb 6-1: SerialNumber: syz [ 1027.133287][T16142] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1027.172628][T19675] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3254'. [ 1027.201652][ T5861] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1027.433649][ T30] audit: type=1400 audit(2000000558.810:1558): avc: denied { read } for pid=19657 comm="syz.5.3251" path="socket:[70034]" dev="sockfs" ino=70034 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1028.180281][T10466] usb 6-1: USB disconnect, device number 65 [ 1028.212474][T19680] syzkaller1: entered promiscuous mode [ 1028.218336][T19680] syzkaller1: entered allmulticast mode [ 1028.603729][ T5861] usb 6-1: Service connection timeout for: 256 [ 1028.619320][ T5861] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 1028.630756][ T5861] ath9k_htc: Failed to initialize the device [ 1028.649210][T10466] usb 6-1: ath9k_htc: USB layer deinitialized [ 1029.529716][T16757] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1029.699909][T16757] usb 5-1: Using ep0 maxpacket: 8 [ 1029.725997][T16757] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1030.091539][T16757] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1030.166173][T19716] mkiss: ax0: crc mode is auto. [ 1030.173299][T16757] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1030.257402][T16757] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1030.474067][T16757] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1030.488190][T16757] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1030.641477][T16757] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1030.698347][T19723] qnx4: unable to read the superblock [ 1030.904435][T16757] usb 5-1: usb_control_msg returned -32 [ 1030.919724][T16757] usbtmc 5-1:16.0: can't read capabilities [ 1031.572895][T19712] usbtmc 5-1:16.0: stb usb_control_msg returned -32 [ 1031.917355][ T30] audit: type=1400 audit(2000000563.280:1559): avc: denied { ioctl } for pid=19731 comm="syz.3.3266" path="socket:[70127]" dev="sockfs" ino=70127 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1032.038011][T19734] syzkaller1: entered promiscuous mode [ 1032.043583][T19734] syzkaller1: entered allmulticast mode [ 1032.609653][T16588] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1032.779987][T16588] usb 6-1: Using ep0 maxpacket: 8 [ 1032.797466][T16588] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1032.822187][T16588] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1032.863278][T16588] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1032.894687][T16588] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1032.900420][T16757] usb 5-1: USB disconnect, device number 73 [ 1032.933445][T16588] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1032.965945][T16588] usb 6-1: Manufacturer: ೵侻ਙȯﺨ╹沛ꁋ [ 1033.290697][T19743] NFSD: Failed to start, no listeners configured. [ 1033.368159][T16588] usb 6-1: 0:2 : does not exist [ 1033.525659][T16588] usb 6-1: USB disconnect, device number 66 [ 1034.082135][T17499] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1034.093398][T17499] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1034.133042][T17499] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1034.141275][T17499] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1034.210104][T17499] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1034.831582][T19754] lo speed is unknown, defaulting to 1000 [ 1036.251447][ T5819] Bluetooth: hci0: command tx timeout [ 1036.506933][T19787] netlink: 'syz.6.3282': attribute type 1 has an invalid length. [ 1036.514897][T19787] netlink: 'syz.6.3282': attribute type 2 has an invalid length. [ 1036.522823][T19787] netlink: 'syz.6.3282': attribute type 2 has an invalid length. [ 1036.530991][T19787] netlink: 'syz.6.3282': attribute type 1 has an invalid length. [ 1036.539112][T19787] netlink: 'syz.6.3282': attribute type 1 has an invalid length. [ 1036.779251][ T3509] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.155067][ T3509] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.377247][T16142] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1037.574546][T19754] chnl_net:caif_netlink_parms(): no params data found [ 1037.703135][T16142] usb 5-1: config 128 has an invalid interface number: 148 but max is 0 [ 1037.713813][T16142] usb 5-1: config 128 has no interface number 0 [ 1037.727510][T16142] usb 5-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1037.752563][ T3509] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.755157][T16142] usb 5-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 1037.805531][T16142] usb 5-1: config 128 interface 148 has no altsetting 0 [ 1037.925980][T16142] usb 5-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 1037.951377][T16142] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.991697][T16142] usb 5-1: Product: syz [ 1038.339657][ T5819] Bluetooth: hci0: command tx timeout [ 1038.471901][T16142] usb 5-1: Manufacturer: syz [ 1038.476999][T16142] usb 5-1: SerialNumber: syz [ 1038.645738][ T3509] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1038.797917][T16142] usb 5-1: USB disconnect, device number 74 [ 1038.885983][T19806] : Can't lookup blockdev [ 1039.579274][T19754] bridge0: port 1(bridge_slave_0) entered blocking state [ 1039.617299][T19754] bridge0: port 1(bridge_slave_0) entered disabled state [ 1039.635124][T19754] bridge_slave_0: entered allmulticast mode [ 1039.650586][T19754] bridge_slave_0: entered promiscuous mode [ 1039.760562][T16142] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1039.832452][T19754] bridge0: port 2(bridge_slave_1) entered blocking state [ 1039.861670][T19754] bridge0: port 2(bridge_slave_1) entered disabled state [ 1039.880986][T19754] bridge_slave_1: entered allmulticast mode [ 1039.919497][T19754] bridge_slave_1: entered promiscuous mode [ 1039.979949][T16142] usb 5-1: Using ep0 maxpacket: 8 [ 1040.021177][T16142] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1040.063627][T16142] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1040.098161][T16142] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1040.125916][T16142] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 16 [ 1040.144244][T16142] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1040.203485][T16142] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1040.218639][T19819] veth0_to_team: entered promiscuous mode [ 1040.235127][T16142] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.258586][T19754] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1040.337380][T19754] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1040.408773][ T3509] bridge_slave_1: left allmulticast mode [ 1040.416719][ T5819] Bluetooth: hci0: command tx timeout [ 1040.419909][T19825] loop7: detected capacity change from 16384 to 16383 [ 1040.445883][ T3509] bridge_slave_1: left promiscuous mode [ 1040.457458][ T3509] bridge0: port 2(bridge_slave_1) entered disabled state [ 1040.460002][T16142] usb 5-1: usb_control_msg returned -71 [ 1040.559764][T16142] usbtmc 5-1:16.0: can't read capabilities [ 1040.615994][ T3509] bridge_slave_0: left allmulticast mode [ 1040.633248][T16142] usb 5-1: USB disconnect, device number 75 [ 1040.677047][ T3509] bridge_slave_0: left promiscuous mode [ 1040.717607][T19832] FAULT_INJECTION: forcing a failure. [ 1040.717607][T19832] name failslab, interval 1, probability 0, space 0, times 0 [ 1040.730781][T19832] CPU: 0 UID: 0 PID: 19832 Comm: syz.4.3290 Tainted: G L syzkaller #0 PREEMPT(full) [ 1040.730803][T19832] Tainted: [L]=SOFTLOCKUP [ 1040.730807][T19832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1040.730814][T19832] Call Trace: [ 1040.730819][T19832] [ 1040.730825][T19832] dump_stack_lvl+0x100/0x190 [ 1040.730847][T19832] should_fail_ex.cold+0x5/0xa [ 1040.730868][T19832] should_failslab+0xc2/0x120 [ 1040.730885][T19832] kmem_cache_alloc_noprof+0x83/0x780 [ 1040.730900][T19832] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1040.730914][T19832] ? sctp_get_port_local+0x828/0x1630 [ 1040.730932][T19832] ? sctp_get_port_local+0x828/0x1630 [ 1040.730946][T19832] sctp_get_port_local+0x828/0x1630 [ 1040.730964][T19832] ? __pfx_sctp_get_port_local+0x10/0x10 [ 1040.730980][T19832] ? sctp_bind_addr_match+0x19d/0x300 [ 1040.731000][T19832] sctp_do_bind+0x2b9/0x760 [ 1040.731020][T19832] sctp_connect_new_asoc+0x5e7/0x770 [ 1040.731039][T19832] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1040.731058][T19832] ? __ipv6_addr_type+0x1eb/0x2e0 [ 1040.731071][T19832] ? __ipv6_addr_type+0x1eb/0x2e0 [ 1040.731084][T19832] __sctp_connect+0x3e7/0xc70 [ 1040.731104][T19832] ? __pfx___sctp_connect+0x10/0x10 [ 1040.731122][T19832] ? selinux_sctp_bind_connect+0x112/0x2a0 [ 1040.731145][T19832] __sctp_setsockopt_connectx+0x100/0x190 [ 1040.731165][T19832] sctp_getsockopt+0x3efa/0x7100 [ 1040.731184][T19832] ? find_held_lock+0x2b/0x80 [ 1040.731199][T19832] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 1040.731214][T19832] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 1040.731230][T19832] ? __pfx_sctp_getsockopt+0x10/0x10 [ 1040.731248][T19832] ? avc_has_perm_noaudit+0x145/0x3b0 [ 1040.731265][T19832] ? avc_has_perm+0x135/0x1e0 [ 1040.731279][T19832] ? __pfx_avc_has_perm+0x10/0x10 [ 1040.731296][T19832] ? __lock_acquire+0x4a5/0x2630 [ 1040.731309][T19832] ? sock_has_perm+0x258/0x2f0 [ 1040.731329][T19832] ? find_held_lock+0x2b/0x80 [ 1040.731343][T19832] ? __might_fault+0xc5/0x140 [ 1040.731354][T19832] ? __might_fault+0xc5/0x140 [ 1040.731370][T19832] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1040.731389][T19832] do_sock_getsockopt+0x259/0x3d0 [ 1040.731407][T19832] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1040.731431][T19832] __sys_getsockopt+0x148/0x260 [ 1040.731449][T19832] ? __x64_sys_getsockopt+0xbd/0x160 [ 1040.731462][T19832] ? rcu_is_watching+0x12/0xc0 [ 1040.731478][T19832] __x64_sys_getsockopt+0xbd/0x160 [ 1040.731491][T19832] ? do_syscall_64+0x94/0xf80 [ 1040.731503][T19832] ? lockdep_hardirqs_on+0x78/0x100 [ 1040.731515][T19832] do_syscall_64+0xc9/0xf80 [ 1040.731528][T19832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.731540][T19832] RIP: 0033:0x7f29d299acb9 [ 1040.731550][T19832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1040.731562][T19832] RSP: 002b:00007f29d3804028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1040.731574][T19832] RAX: ffffffffffffffda RBX: 00007f29d2c16090 RCX: 00007f29d299acb9 [ 1040.731582][T19832] RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000005 [ 1040.731588][T19832] RBP: 00007f29d3804090 R08: 0000200000000000 R09: 0000000000000000 [ 1040.731595][T19832] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000001 [ 1040.731601][T19832] R13: 00007f29d2c16128 R14: 00007f29d2c16090 R15: 00007ffeb0969cb8 [ 1040.731615][T19832] [ 1041.404705][ T3509] bridge0: port 1(bridge_slave_0) entered disabled state [ 1042.519886][ T5819] Bluetooth: hci0: command tx timeout [ 1043.534652][ T3509] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1043.697823][ T3509] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1043.805429][ T3509] bond0 (unregistering): Released all slaves [ 1043.881938][ T3509] bond1 (unregistering): Released all slaves [ 1043.984385][ T3509] : left promiscuous mode [ 1044.112417][T19754] team0: Port device team_slave_0 added [ 1044.260835][T19754] team0: Port device team_slave_1 added [ 1045.017200][ T5868] IPVS: starting estimator thread 0... [ 1045.228754][T19878] IPVS: using max 42 ests per chain, 100800 per kthread [ 1045.400716][T19754] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1045.420509][T19754] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1045.465577][T19754] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1045.478427][T19754] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1045.486654][T19754] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1045.509774][ T5868] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 1045.560058][T19754] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1045.838367][ T5868] usb 6-1: config 128 has an invalid interface number: 148 but max is 0 [ 1045.869675][ T5868] usb 6-1: config 128 has no interface number 0 [ 1045.883181][T19889] fuse: Bad value for 'group_id' [ 1045.895944][T19889] fuse: Bad value for 'group_id' [ 1045.909730][ T5868] usb 6-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1046.039757][ T5868] usb 6-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 129, changing to 11 [ 1046.064980][ T5868] usb 6-1: config 128 interface 148 has no altsetting 0 [ 1046.384651][ T5868] usb 6-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 1046.419755][ T5868] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.463262][ T5868] usb 6-1: Product: syz [ 1046.474211][ T5868] usb 6-1: Manufacturer: syz [ 1046.501316][ T5868] usb 6-1: SerialNumber: syz [ 1046.756487][ T5868] usb 6-1: USB disconnect, device number 67 [ 1047.117005][T19754] hsr_slave_0: entered promiscuous mode [ 1047.151611][T19754] hsr_slave_1: entered promiscuous mode [ 1047.202293][ T3509] hsr_slave_0: left promiscuous mode [ 1047.231845][ T3509] hsr_slave_1: left promiscuous mode [ 1047.247337][ T5868] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1047.259963][ T3509] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1047.271023][ T3509] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1047.445050][ T5868] usb 6-1: Using ep0 maxpacket: 8 [ 1047.550340][ T3509] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1047.577314][ T5868] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1047.585950][ T5868] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1047.595879][ T3509] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1047.641659][ T5868] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1047.652107][ T5868] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 16 [ 1047.666398][ T5868] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1047.686228][ T5868] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1047.702863][ T5868] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1047.726929][ T3509] veth1_macvtap: left promiscuous mode [ 1047.740226][ T3509] veth0_macvtap: left promiscuous mode [ 1047.756961][ T3509] veth1_vlan: left promiscuous mode [ 1047.772452][ T3509] veth0_vlan: left promiscuous mode [ 1047.928417][ T5868] usb 6-1: usb_control_msg returned -32 [ 1047.945696][ T5868] usbtmc 6-1:16.0: can't read capabilities [ 1048.062456][ T3509] pim6reg (unregistering): left allmulticast mode [ 1049.039143][ T3509] team0 (unregistering): Port device team_slave_1 removed [ 1049.122761][ T3509] team0 (unregistering): Port device team_slave_0 removed [ 1049.337024][ T5868] usb 6-1: USB disconnect, device number 68 [ 1053.092848][T19939] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1053.260552][T19953] netlink: 'syz.3.3307': attribute type 1 has an invalid length. [ 1053.268463][T19953] netlink: 'syz.3.3307': attribute type 2 has an invalid length. [ 1053.276605][T19953] netlink: 'syz.3.3307': attribute type 2 has an invalid length. [ 1053.284619][T19953] netlink: 'syz.3.3307': attribute type 1 has an invalid length. [ 1053.294043][T19953] netlink: 'syz.3.3307': attribute type 1 has an invalid length. [ 1053.940667][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1053.946986][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.762285][ T5861] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1055.942832][ T5861] usb 5-1: Using ep0 maxpacket: 8 [ 1055.960902][ T5861] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1055.984574][ T5861] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1056.015488][ T5861] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1056.039739][ T5861] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1056.051114][T19983] CUSE: info not properly terminated [ 1056.066916][ T5861] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1056.097260][ T5861] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1056.279593][ T5861] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1056.672101][ T5861] usb 5-1: GET_CAPABILITIES returned 0 [ 1056.677633][ T5861] usbtmc 5-1:16.0: can't read capabilities [ 1057.167665][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1057.177106][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1057.186233][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1057.220862][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1057.230033][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1057.239161][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1057.248260][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1057.252172][T16142] usb 5-1: USB disconnect, device number 76 [ 1061.448273][ T3509] IPVS: stop unused estimator thread 0... [ 1061.565825][T20014] netlink: 'syz.3.3321': attribute type 10 has an invalid length. [ 1061.599952][T20014] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3321'. [ 1061.675430][T20031] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3321'. [ 1062.314093][ T30] audit: type=1400 audit(2000000593.260:1560): avc: denied { connect } for pid=20035 comm="syz.4.3325" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1062.360365][T20027] netlink: 'syz.5.3324': attribute type 1 has an invalid length. [ 1062.369812][T20027] netlink: 'syz.5.3324': attribute type 2 has an invalid length. [ 1062.377675][T20027] netlink: 'syz.5.3324': attribute type 2 has an invalid length. [ 1062.385560][T20027] netlink: 'syz.5.3324': attribute type 1 has an invalid length. [ 1062.393501][T20027] netlink: 'syz.5.3324': attribute type 1 has an invalid length. [ 1062.786096][ T30] audit: type=1400 audit(2000000593.320:1561): avc: denied { listen } for pid=20035 comm="syz.4.3325" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1062.976040][ T30] audit: type=1400 audit(2000000593.460:1562): avc: denied { accept } for pid=20035 comm="syz.4.3325" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1063.076968][T20056] CUSE: info not properly terminated [ 1063.134533][T20047] syzkaller1: entered promiscuous mode [ 1063.242494][T20047] syzkaller1: entered allmulticast mode [ 1063.448019][T19754] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1063.474966][T19754] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1063.516572][T19754] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1063.547486][T19754] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1064.798091][T19754] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1064.864704][T19754] 8021q: adding VLAN 0 to HW filter on device team0 [ 1064.885428][ T2975] bridge0: port 1(bridge_slave_0) entered blocking state [ 1064.892630][ T2975] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1064.920665][ T2975] bridge0: port 2(bridge_slave_1) entered blocking state [ 1064.927865][ T2975] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1065.079669][ T5968] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1065.083613][T19754] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1065.143620][T20081] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3331'. [ 1065.242680][ T5968] usb 4-1: Using ep0 maxpacket: 32 [ 1065.270900][ T5968] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1065.320258][ T5968] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1065.344604][ T5968] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.354977][T20094] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3330'. [ 1065.380175][ T5968] usb 4-1: Product: syz [ 1065.394320][ T5968] usb 4-1: Manufacturer: syz [ 1065.413161][ T5968] usb 4-1: SerialNumber: syz [ 1065.442082][ T5968] usb 4-1: config 0 descriptor?? [ 1065.539715][ T5861] usb 6-1: new full-speed USB device number 69 using dummy_hcd [ 1065.657184][T20065] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1065.666211][T20065] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1065.666784][T19754] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1065.711493][ T5861] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1065.762431][ T5861] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1065.792979][ T5861] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1065.827813][ T5861] usb 6-1: config 0 descriptor?? [ 1066.086166][T20092] qnx4: unable to read the superblock [ 1066.162375][ T5861] usbhid 6-1:0.0: can't add hid device: -71 [ 1066.197459][ T5861] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1066.303848][T20116] virtio-fs: tag not found [ 1066.381766][ T5861] usb 6-1: USB disconnect, device number 69 [ 1066.664215][ T5968] gs_usb 4-1:0.0: Couldn't send data format (err=-110) [ 1066.677417][ T5968] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -110 [ 1066.773724][ T5968] usb 4-1: USB disconnect, device number 86 [ 1067.069640][ T5861] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1067.408090][T19754] veth0_vlan: entered promiscuous mode [ 1067.433371][ T5861] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1067.809480][T20131] netlink: 'syz.6.3337': attribute type 1 has an invalid length. [ 1067.817514][ T5861] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1067.831880][T19754] veth1_vlan: entered promiscuous mode [ 1067.838226][ T5861] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1067.857325][T20131] netlink: 'syz.6.3337': attribute type 2 has an invalid length. [ 1067.880799][ T5861] usb 6-1: config 0 descriptor?? [ 1067.891116][T19754] veth0_macvtap: entered promiscuous mode [ 1068.022846][T20131] netlink: 'syz.6.3337': attribute type 2 has an invalid length. [ 1068.030085][T19754] veth1_macvtap: entered promiscuous mode [ 1068.064983][T20131] netlink: 'syz.6.3337': attribute type 1 has an invalid length. [ 1068.140364][T19754] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1068.146761][T20131] netlink: 'syz.6.3337': attribute type 1 has an invalid length. [ 1068.249817][T19754] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1068.287939][ T195] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1068.313363][ T195] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1068.350902][ T195] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1068.369789][ T5968] usb 5-1: new full-speed USB device number 77 using dummy_hcd [ 1068.391909][ T195] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1068.519735][ T5861] usbhid 6-1:0.0: can't add hid device: -71 [ 1068.540415][ T5861] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1068.560214][ T5968] usb 5-1: config 0 has an invalid interface number: 20 but max is 0 [ 1068.565997][ T5861] usb 6-1: USB disconnect, device number 70 [ 1068.610530][ T5968] usb 5-1: config 0 has no interface number 0 [ 1068.627597][ T5968] usb 5-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1068.830674][ T5968] usb 5-1: config 0 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1068.846289][ T6801] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1068.925292][ T6801] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1068.931953][ T5968] usb 5-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 1068.967643][ T5968] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.005079][ T2975] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1069.014706][ T5968] usb 5-1: Product: syz [ 1069.055140][ T5968] usb 5-1: Manufacturer: syz [ 1069.066255][ T2975] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1069.088542][ T5968] usb 5-1: SerialNumber: syz [ 1069.174016][ T5968] usb 5-1: config 0 descriptor?? [ 1069.214955][T20147] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1069.288198][ T5968] usb-storage 5-1:0.20: USB Mass Storage device detected [ 1069.546613][ T5968] usb-storage 5-1:0.20: Quirks match for vid 04e6 pid 000b: 4 [ 1069.637274][T20174] netlink: 'syz.7.3273': attribute type 4 has an invalid length. [ 1070.049830][ T5968] scsi host1: usb-storage 5-1:0.20 [ 1072.059673][T16588] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1072.067829][T10466] usb 5-1: USB disconnect, device number 77 [ 1072.129030][T20204] FAULT_INJECTION: forcing a failure. [ 1072.129030][T20204] name failslab, interval 1, probability 0, space 0, times 0 [ 1072.184329][T20204] CPU: 1 UID: 0 PID: 20204 Comm: syz.6.3348 Tainted: G L syzkaller #0 PREEMPT(full) [ 1072.184363][T20204] Tainted: [L]=SOFTLOCKUP [ 1072.184369][T20204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1072.184381][T20204] Call Trace: [ 1072.184388][T20204] [ 1072.184395][T20204] dump_stack_lvl+0x100/0x190 [ 1072.184426][T20204] should_fail_ex.cold+0x5/0xa [ 1072.184459][T20204] should_failslab+0xc2/0x120 [ 1072.184482][T20204] kmem_cache_alloc_lru_noprof+0x8e/0x7d0 [ 1072.184507][T20204] ? __d_alloc+0x34/0xa80 [ 1072.184534][T20204] ? __d_alloc+0x34/0xa80 [ 1072.184554][T20204] ? __pfx_inode_set_ctime_current+0x10/0x10 [ 1072.184576][T20204] __d_alloc+0x34/0xa80 [ 1072.184597][T20204] ? new_inode+0x15a/0x1c0 [ 1072.184614][T20204] d_alloc_pseudo+0x1c/0xc0 [ 1072.184631][T20204] alloc_file_pseudo+0xcf/0x230 [ 1072.184659][T20204] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1072.184685][T20204] ? hugetlbfs_get_inode+0x36e/0x6f0 [ 1072.184710][T20204] hugetlb_file_setup+0x2a8/0x5b0 [ 1072.184734][T20204] ksys_mmap_pgoff+0x185/0x5b0 [ 1072.184762][T20204] __x64_sys_mmap+0x125/0x190 [ 1072.184787][T20204] do_syscall_64+0xc9/0xf80 [ 1072.184809][T20204] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1072.184827][T20204] RIP: 0033:0x7faa85b9acb9 [ 1072.184841][T20204] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1072.184858][T20204] RSP: 002b:00007faa86aaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1072.184876][T20204] RAX: ffffffffffffffda RBX: 00007faa85e15fa0 RCX: 00007faa85b9acb9 [ 1072.184888][T20204] RDX: 000000000000000b RSI: 0000000000800000 RDI: 0000200000000000 [ 1072.184899][T20204] RBP: 00007faa86aaa090 R08: ffffffffffffffff R09: 0000000000000000 [ 1072.184910][T20204] R10: 00000000000c3072 R11: 0000000000000246 R12: 0000000000000001 [ 1072.184920][T20204] R13: 00007faa85e16038 R14: 00007faa85e15fa0 R15: 00007fff55b450c8 [ 1072.184949][T20204] [ 1072.388623][ T30] audit: type=1400 audit(2000000603.760:1563): avc: denied { connect } for pid=20207 comm="syz.4.3349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1072.529812][T16588] usb 8-1: Using ep0 maxpacket: 32 [ 1072.539857][T16588] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1072.551128][T16588] usb 8-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1072.564323][T16588] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.573997][T16588] usb 8-1: Product: syz [ 1072.578281][T16588] usb 8-1: Manufacturer: syz [ 1072.584601][T16588] usb 8-1: SerialNumber: syz [ 1072.603767][T16588] usb 8-1: config 0 descriptor?? [ 1072.818558][T20195] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1072.828013][T20195] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1072.849752][T20217] netlink: 'syz.5.3350': attribute type 1 has an invalid length. [ 1072.870953][T20217] netlink: 'syz.5.3350': attribute type 2 has an invalid length. [ 1072.889173][T20217] netlink: 'syz.5.3350': attribute type 2 has an invalid length. [ 1072.958154][T20217] netlink: 'syz.5.3350': attribute type 1 has an invalid length. [ 1073.061503][T20217] netlink: 'syz.5.3350': attribute type 1 has an invalid length. [ 1073.690366][T16588] gs_usb 8-1:0.0: Couldn't send data format (err=-110) [ 1073.700939][T16588] gs_usb 8-1:0.0: probe with driver gs_usb failed with error -110 [ 1073.852631][T10466] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1073.942174][T20231] netlink: 'syz.6.3354': attribute type 4 has an invalid length. [ 1074.230460][T10466] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1074.302511][ T5875] usb 8-1: USB disconnect, device number 2 [ 1074.335506][T10466] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1074.389180][T10466] usb 5-1: Product: syz [ 1074.398668][T10466] usb 5-1: Manufacturer: syz [ 1074.417311][T10466] usb 5-1: SerialNumber: syz [ 1074.441604][T10466] usb 5-1: config 0 descriptor?? [ 1074.646055][T20238] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3356'. [ 1074.667537][T10466] usb 5-1: USB disconnect, device number 78 [ 1074.705378][T20238] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3356'. [ 1074.752759][T20238] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3356'. [ 1074.867214][T20208] netlink: 'syz.4.3349': attribute type 1 has an invalid length. [ 1074.953153][T20208] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1075.079841][T20209] bond2: (slave veth3): Enslaving as an active interface with a down link [ 1075.088921][T20245] FAULT_INJECTION: forcing a failure. [ 1075.088921][T20245] name failslab, interval 1, probability 0, space 0, times 0 [ 1075.168088][T20245] CPU: 1 UID: 0 PID: 20245 Comm: syz.3.3358 Tainted: G L syzkaller #0 PREEMPT(full) [ 1075.168110][T20245] Tainted: [L]=SOFTLOCKUP [ 1075.168114][T20245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1075.168121][T20245] Call Trace: [ 1075.168126][T20245] [ 1075.168131][T20245] dump_stack_lvl+0x100/0x190 [ 1075.168153][T20245] should_fail_ex.cold+0x5/0xa [ 1075.168176][T20245] should_failslab+0xc2/0x120 [ 1075.168192][T20245] ? genl_family_rcv_msg_attrs_parse.isra.0+0xc8/0x290 [ 1075.168212][T20245] __kmalloc_noprof+0xf6/0x9c0 [ 1075.168223][T20245] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 1075.168244][T20245] ? genl_family_rcv_msg_attrs_parse.isra.0+0xc8/0x290 [ 1075.168263][T20245] genl_family_rcv_msg_attrs_parse.isra.0+0xc8/0x290 [ 1075.168285][T20245] genl_family_rcv_msg_doit+0xc7/0x300 [ 1075.168305][T20245] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1075.168329][T20245] ? bpf_lsm_capable+0x9/0x10 [ 1075.168346][T20245] ? security_capable+0x80/0x260 [ 1075.168367][T20245] genl_rcv_msg+0x560/0x800 [ 1075.168379][T20245] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1075.168390][T20245] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 1075.168401][T20245] ? __pfx_nl802154_del_llsec_devkey+0x10/0x10 [ 1075.168419][T20245] ? __pfx_nl802154_post_doit+0x10/0x10 [ 1075.168437][T20245] ? __lock_acquire+0x4a5/0x2630 [ 1075.168451][T20245] netlink_rcv_skb+0x159/0x420 [ 1075.168468][T20245] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1075.168480][T20245] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1075.168501][T20245] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1075.168519][T20245] genl_rcv+0x28/0x40 [ 1075.168536][T20245] netlink_unicast+0x5aa/0x870 [ 1075.168554][T20245] ? __pfx_netlink_unicast+0x10/0x10 [ 1075.168576][T20245] netlink_sendmsg+0x8b0/0xda0 [ 1075.168596][T20245] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1075.168612][T20245] ? __might_fault+0x30/0x140 [ 1075.168629][T20245] ____sys_sendmsg+0xa54/0xc30 [ 1075.168643][T20245] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1075.168659][T20245] ___sys_sendmsg+0x190/0x1e0 [ 1075.168672][T20245] ? __pfx____sys_sendmsg+0x10/0x10 [ 1075.168689][T20245] ? find_held_lock+0x2b/0x80 [ 1075.168713][T20245] __sys_sendmsg+0x170/0x220 [ 1075.168728][T20245] ? __pfx___sys_sendmsg+0x10/0x10 [ 1075.168752][T20245] do_syscall_64+0xc9/0xf80 [ 1075.168765][T20245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1075.168777][T20245] RIP: 0033:0x7f4e18b9acb9 [ 1075.168788][T20245] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1075.168799][T20245] RSP: 002b:00007f4e19af3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1075.168812][T20245] RAX: ffffffffffffffda RBX: 00007f4e18e15fa0 RCX: 00007f4e18b9acb9 [ 1075.168819][T20245] RDX: 0000000020004044 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1075.168825][T20245] RBP: 00007f4e19af3090 R08: 0000000000000000 R09: 0000000000000000 [ 1075.168837][T20245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1075.168844][T20245] R13: 00007f4e18e16038 R14: 00007f4e18e15fa0 R15: 00007ffd2c3a3a68 [ 1075.168858][T20245] [ 1076.049833][ T5861] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1076.159652][T10466] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1076.222013][ T5861] usb 5-1: Using ep0 maxpacket: 8 [ 1076.228365][ T5861] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1076.239171][ T5861] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1076.280737][ T5861] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1076.303765][ T5861] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1076.314075][T10466] usb 4-1: Using ep0 maxpacket: 32 [ 1076.324968][T10466] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 1076.342098][T10466] usb 4-1: config 0 has no interface number 0 [ 1076.359908][ T5861] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1076.375418][T10466] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1076.399771][T10466] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.407826][T10466] usb 4-1: Product: syz [ 1076.412154][ T5861] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1076.430169][ T5861] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1076.439340][T10466] usb 4-1: Manufacturer: syz [ 1076.449734][T10466] usb 4-1: SerialNumber: syz [ 1076.479248][T10466] usb 4-1: config 0 descriptor?? [ 1076.506030][T10466] smsc95xx v2.0.0 [ 1076.688107][ T5861] usb 5-1: GET_CAPABILITIES returned 0 [ 1076.695346][ T5861] usbtmc 5-1:16.0: can't read capabilities [ 1076.891343][ T30] audit: type=1400 audit(2000000608.260:1564): avc: denied { relabelfrom } for pid=20255 comm="syz.6.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1076.921492][T10466] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1076.932537][ T30] audit: type=1400 audit(2000000608.290:1565): avc: denied { relabelto } for pid=20255 comm="syz.6.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1076.952585][T10466] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1077.093962][ T5861] usb 5-1: USB disconnect, device number 79 [ 1077.165704][T10466] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 1077.186625][T10466] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -61 [ 1077.338472][T20264] netlink: 'syz.5.3364': attribute type 1 has an invalid length. [ 1077.346411][T20264] netlink: 'syz.5.3364': attribute type 2 has an invalid length. [ 1077.490203][T20264] netlink: 'syz.5.3364': attribute type 2 has an invalid length. [ 1077.925803][T20276] validate_nla: 2 callbacks suppressed [ 1077.925838][T20276] netlink: 'syz.6.3366': attribute type 4 has an invalid length. [ 1078.726008][T20285] net_ratelimit: 58 callbacks suppressed [ 1078.726047][T20285] netlink: zone id is out of range [ 1078.737296][T20285] netlink: zone id is out of range [ 1078.742737][T20285] netlink: zone id is out of range [ 1078.747923][T20285] netlink: zone id is out of range [ 1078.753294][T20285] netlink: zone id is out of range [ 1078.758470][T20285] netlink: zone id is out of range [ 1078.763667][T20285] netlink: zone id is out of range [ 1078.768820][T20285] netlink: zone id is out of range [ 1078.775662][T20285] netlink: zone id is out of range [ 1078.781976][T20285] netlink: zone id is out of range [ 1079.036092][T16588] usb 4-1: USB disconnect, device number 87 [ 1081.437846][T20327] usb 2-1: USB disconnect, device number 70 [ 1082.061508][T20335] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3377'. [ 1084.667118][T20364] netlink: 'syz.5.3383': attribute type 10 has an invalid length. [ 1084.675195][T20364] netlink: 228 bytes leftover after parsing attributes in process `syz.5.3383'. [ 1085.419272][T20386] syzkaller1: entered promiscuous mode [ 1085.459713][T20386] syzkaller1: entered allmulticast mode [ 1087.966378][T20421] veth0_to_team: entered promiscuous mode [ 1089.382103][T20459] qnx4: unable to read the superblock [ 1089.527048][ T30] audit: type=1400 audit(2000000620.900:1566): avc: denied { bind } for pid=20435 comm="syz.7.3398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1089.857735][T20468] netlink: 408 bytes leftover after parsing attributes in process `syz.5.3402'. [ 1089.867032][T20468] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3402'. [ 1089.876195][T20468] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3402'. [ 1089.889697][T16142] usb 4-1: new full-speed USB device number 88 using dummy_hcd [ 1089.912924][ T30] audit: type=1400 audit(2000000621.290:1567): avc: denied { ioctl } for pid=20465 comm="syz.5.3402" path="/dev/ptyqf" dev="devtmpfs" ino=134 ioctlcmd=0x5423 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 1090.063660][T16142] usb 4-1: config 0 has an invalid interface number: 20 but max is 0 [ 1090.079793][T16142] usb 4-1: config 0 has no interface number 0 [ 1090.079816][ T6567] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1090.090965][T16142] usb 4-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1090.195925][T20474] netlink: 'syz.7.3403': attribute type 1 has an invalid length. [ 1090.204063][T20474] netlink: 'syz.7.3403': attribute type 2 has an invalid length. [ 1090.212294][T20474] netlink: 'syz.7.3403': attribute type 2 has an invalid length. [ 1090.220424][T20474] netlink: 'syz.7.3403': attribute type 1 has an invalid length. [ 1090.228353][T20474] netlink: 'syz.7.3403': attribute type 1 has an invalid length. [ 1090.280396][ T6567] usb 5-1: Using ep0 maxpacket: 32 [ 1090.314795][T16142] usb 4-1: config 0 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1090.317752][ T6567] usb 5-1: no configurations [ 1090.457935][ T6567] usb 5-1: can't read configurations, error -22 [ 1090.536606][T16142] usb 4-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 1090.569165][T16142] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.593261][T16142] usb 4-1: Product: syz [ 1090.647300][T16142] usb 4-1: Manufacturer: syz [ 1090.660221][T16142] usb 4-1: SerialNumber: syz [ 1090.661609][ T6567] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1090.672594][T16142] usb 4-1: config 0 descriptor?? [ 1090.711971][T20463] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1090.719239][ T30] audit: type=1400 audit(2000000622.090:1568): avc: denied { remove_name } for pid=20488 comm="syz.6.3407" name="binder1" dev="binder" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1090.806825][T16142] usb-storage 4-1:0.20: USB Mass Storage device detected [ 1090.814290][ T30] audit: type=1400 audit(2000000622.090:1569): avc: denied { unlink } for pid=20488 comm="syz.6.3407" name="binder1" dev="binder" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1090.920623][T16142] usb-storage 4-1:0.20: Quirks match for vid 04e6 pid 000b: 4 [ 1091.033738][ T30] audit: type=1400 audit(2000000622.370:1570): avc: denied { map } for pid=20488 comm="syz.6.3407" path="/proc/270/net/route" dev="proc" ino=4026533083 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 1091.063819][T16142] scsi host1: usb-storage 4-1:0.20 [ 1091.319677][ T6567] usb 5-1: Using ep0 maxpacket: 32 [ 1091.326437][ T6567] usb 5-1: no configurations [ 1091.332113][ T6567] usb 5-1: can't read configurations, error -22 [ 1091.356489][ T6567] usb usb5-port1: attempt power cycle [ 1091.769757][ T6567] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1091.820818][ T6567] usb 5-1: Using ep0 maxpacket: 32 [ 1091.844672][ T6567] usb 5-1: no configurations [ 1091.859689][ T5819] Bluetooth: hci2: command 0x0406 tx timeout [ 1091.867234][ T6567] usb 5-1: can't read configurations, error -22 [ 1092.019787][ T6567] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1092.112846][ T6567] usb 5-1: Using ep0 maxpacket: 32 [ 1092.125100][ T6567] usb 5-1: no configurations [ 1092.136503][ T6567] usb 5-1: can't read configurations, error -22 [ 1092.154663][ T6567] usb usb5-port1: unable to enumerate USB device [ 1093.331024][ T6567] usb 4-1: USB disconnect, device number 88 [ 1094.616646][T20534] ALSA: mixer_oss: invalid OSS volume 'PHl6qӆONEOUT' [ 1095.270958][T20542] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3417'. [ 1096.369091][T20549] netlink: 'syz.7.3419': attribute type 16 has an invalid length. [ 1096.378348][T20549] netlink: 'syz.7.3419': attribute type 17 has an invalid length. [ 1096.421069][T20549] net_ratelimit: 66 callbacks suppressed [ 1096.421080][T20549] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1096.524496][T20553] netlink: zone id is out of range [ 1096.529879][T20553] netlink: zone id is out of range [ 1096.535847][T20553] netlink: zone id is out of range [ 1096.541117][T20553] netlink: zone id is out of range [ 1096.546320][T20553] netlink: zone id is out of range [ 1096.551648][T20553] netlink: zone id is out of range [ 1096.556821][T20553] netlink: zone id is out of range [ 1096.562067][T20553] netlink: zone id is out of range [ 1096.567264][T20553] netlink: zone id is out of range [ 1097.039084][ T30] audit: type=1400 audit(2000000628.410:1571): avc: denied { listen } for pid=20555 comm="syz.5.3421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1098.143717][T16757] usb 4-1: new full-speed USB device number 89 using dummy_hcd [ 1098.571936][T16757] usb 4-1: config 0 has an invalid interface number: 20 but max is 0 [ 1098.594182][T16757] usb 4-1: config 0 has no interface number 0 [ 1098.625892][T16757] usb 4-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1098.832220][T20589] netlink: 'syz.4.3427': attribute type 4 has an invalid length. [ 1100.095508][T16757] usb 4-1: config 0 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1100.123927][T16757] usb 4-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 1100.136212][T16757] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1100.149306][T16757] usb 4-1: Product: syz [ 1100.158726][T16757] usb 4-1: Manufacturer: syz [ 1100.254143][T16757] usb 4-1: SerialNumber: syz [ 1100.274133][T16757] usb 4-1: config 0 descriptor?? [ 1100.279719][T20571] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1100.304895][T16757] usb-storage 4-1:0.20: USB Mass Storage device detected [ 1100.376776][T16757] usb-storage 4-1:0.20: Quirks match for vid 04e6 pid 000b: 4 [ 1100.688501][T16757] scsi host1: usb-storage 4-1:0.20 [ 1100.840753][T20610] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3431'. [ 1102.168468][T20608] usb 4-1: reset full-speed USB device number 89 using dummy_hcd [ 1102.180247][ T5819] Bluetooth: hci6: command 0x0406 tx timeout [ 1103.500943][ T9] usb 4-1: USB disconnect, device number 89 [ 1103.717741][T20640] syzkaller1: entered promiscuous mode [ 1103.736839][T20640] syzkaller1: entered allmulticast mode [ 1103.829205][T20644] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3437'. [ 1104.931156][T20660] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3442'. [ 1105.411749][T20662] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 1105.469721][ T5933] usb 5-1: new full-speed USB device number 84 using dummy_hcd [ 1105.609091][ T5875] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1105.640011][ T5933] usb 5-1: device descriptor read/64, error -71 [ 1105.819720][ T5875] usb 6-1: Using ep0 maxpacket: 8 [ 1105.858842][ T5875] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1105.890040][ T5875] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1105.899194][ T5875] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1105.910995][ T5933] usb 5-1: new full-speed USB device number 85 using dummy_hcd [ 1105.928328][ T5875] usb 6-1: config 0 descriptor?? [ 1106.526010][ T5933] usb 5-1: device descriptor read/64, error -71 [ 1106.576194][ T5875] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1106.659227][ T5933] usb usb5-port1: attempt power cycle [ 1106.911264][T20688] netlink: 256 bytes leftover after parsing attributes in process `syz.7.3447'. [ 1107.090076][ T5933] usb 5-1: new full-speed USB device number 86 using dummy_hcd [ 1107.097991][T17499] Bluetooth: hci0: command 0x0401 tx timeout [ 1107.222717][ T5933] usb 5-1: device descriptor read/8, error -71 [ 1107.346294][ T5875] usb 6-1: USB disconnect, device number 71 [ 1107.367141][T20688] x_tables: ip6_tables: CT.2 target: invalid size 72 (kernel) != (user) 0 [ 1107.459741][ T5933] usb 5-1: new full-speed USB device number 87 using dummy_hcd [ 1107.510316][ T5933] usb 5-1: device descriptor read/8, error -71 [ 1107.630360][ T5933] usb usb5-port1: unable to enumerate USB device [ 1107.665121][T20695] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3448'. [ 1107.676400][ T30] audit: type=1400 audit(2000000639.050:1572): avc: denied { read write } for pid=20694 comm="syz.7.3448" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1108.325836][ T30] audit: type=1400 audit(2000000639.050:1573): avc: denied { open } for pid=20694 comm="syz.7.3448" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1108.361116][T20702] qnx4: unable to read the superblock [ 1108.605041][T20704] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1109.249697][ T89] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1109.414624][ T89] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1109.426408][ T89] usb 4-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1109.458401][ T89] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1109.511376][ T89] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1109.708191][ T89] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1109.732047][ T89] usb 4-1: invalid MIDI out EP 0 [ 1110.364912][ T89] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1111.815894][T20738] 9pnet_virtio: no channels available for device syz [ 1111.825643][T20738] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1111.847962][T20738] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 1111.858909][T20738] overlayfs: failed to look up (tracing) for ino (-66) [ 1112.750468][T16142] usb 4-1: USB disconnect, device number 90 [ 1113.035724][T20746] netlink: 'syz.3.3462': attribute type 1 has an invalid length. [ 1113.043737][T20746] netlink: 'syz.3.3462': attribute type 2 has an invalid length. [ 1113.051746][T20746] netlink: 'syz.3.3462': attribute type 2 has an invalid length. [ 1113.060567][T20746] netlink: 'syz.3.3462': attribute type 1 has an invalid length. [ 1113.068440][T20746] netlink: 'syz.3.3462': attribute type 1 has an invalid length. [ 1113.424881][T20750] net_ratelimit: 143 callbacks suppressed [ 1113.424913][T20750] netlink: zone id is out of range [ 1113.436518][T20750] netlink: zone id is out of range [ 1113.441871][T20750] netlink: zone id is out of range [ 1113.447201][T20750] netlink: zone id is out of range [ 1113.452660][T20750] netlink: zone id is out of range [ 1113.457824][T20750] netlink: zone id is out of range [ 1113.463123][T20750] netlink: zone id is out of range [ 1113.468328][T20750] netlink: zone id is out of range [ 1113.473623][T20750] netlink: zone id is out of range [ 1113.490611][T20750] netlink: zone id is out of range [ 1113.988851][T20755] 9pnet_virtio: no channels available for device syz [ 1113.998098][T20755] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1114.239922][T19856] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1114.291429][T20760] netlink: 'syz.5.3466': attribute type 10 has an invalid length. [ 1114.299338][T20760] netlink: 228 bytes leftover after parsing attributes in process `syz.5.3466'. [ 1114.502537][T19856] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1114.512692][T19856] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1114.524814][T19856] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1114.589362][T19856] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1115.010914][T19856] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1115.019487][T19856] usb 5-1: Product: syz [ 1115.027088][T19856] usb 5-1: Manufacturer: syz [ 1115.060730][T19856] usb 5-1: SerialNumber: syz [ 1115.106137][T19856] usb 5-1: config 0 descriptor?? [ 1115.128880][T20755] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1115.136358][T20755] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1115.288932][T19856] usb 5-1: ucan: probing device on interface #0 [ 1115.379971][T20755] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 1115.390046][T20755] overlayfs: failed to look up (tracing) for ino (-66) [ 1115.415880][T19856] usb 5-1: ucan: could not read protocol version, ret=-71 [ 1115.463577][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.469216][T19856] usb 5-1: ucan: probe failed; try to update the device firmware [ 1115.477967][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.510685][T20772] fuse: Unknown parameter '' [ 1115.580352][T19856] usb 5-1: USB disconnect, device number 88 [ 1115.668629][T20780] netlink: 'syz.5.3469': attribute type 1 has an invalid length. [ 1115.676813][T20780] netlink: 'syz.5.3469': attribute type 2 has an invalid length. [ 1115.686260][T20780] netlink: 'syz.5.3469': attribute type 2 has an invalid length. [ 1115.694646][T20780] netlink: 'syz.5.3469': attribute type 1 has an invalid length. [ 1115.809830][ T89] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1116.010209][ T89] usb 4-1: Using ep0 maxpacket: 16 [ 1116.017876][ T89] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1116.077633][ T89] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1116.155045][ T89] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1116.186044][ T89] usb 4-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=f6.59 [ 1116.312483][ T89] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1116.331838][ T89] usb 4-1: Product: syz [ 1116.894846][ T89] usb 4-1: Manufacturer: syz [ 1116.921994][ T89] usb 4-1: SerialNumber: syz [ 1117.210307][ T89] usb 4-1: config 0 descriptor?? [ 1117.572642][ T89] peak_usb 4-1:0.0 can0: sending cmd f=0x6 n=0x1 failure: -8 [ 1117.626861][T20800] FAULT_INJECTION: forcing a failure. [ 1117.626861][T20800] name failslab, interval 1, probability 0, space 0, times 0 [ 1117.639835][ T89] peak_usb 4-1:0.0: unable to read PCAN-USB serial number (err -8) [ 1117.700076][T20800] CPU: 0 UID: 0 PID: 20800 Comm: syz.4.3476 Tainted: G L syzkaller #0 PREEMPT(full) [ 1117.700098][T20800] Tainted: [L]=SOFTLOCKUP [ 1117.700103][T20800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1117.700110][T20800] Call Trace: [ 1117.700114][T20800] [ 1117.700119][T20800] dump_stack_lvl+0x100/0x190 [ 1117.700141][T20800] should_fail_ex.cold+0x5/0xa [ 1117.700161][T20800] should_failslab+0xc2/0x120 [ 1117.700178][T20800] __kmalloc_cache_noprof+0x80/0x810 [ 1117.700189][T20800] ? __pfx___pnet_find_base_ndev+0x10/0x10 [ 1117.700203][T20800] ? smc_pnet_add+0x472/0x1720 [ 1117.700217][T20800] ? smc_pnet_add+0x472/0x1720 [ 1117.700229][T20800] smc_pnet_add+0x472/0x1720 [ 1117.700244][T20800] ? __pfx_smc_pnet_add+0x10/0x10 [ 1117.700259][T20800] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1aa/0x290 [ 1117.700279][T20800] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1b4/0x290 [ 1117.700300][T20800] genl_family_rcv_msg_doit+0x214/0x300 [ 1117.700321][T20800] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1117.700344][T20800] ? bpf_lsm_capable+0x9/0x10 [ 1117.700361][T20800] ? security_capable+0x80/0x260 [ 1117.700380][T20800] genl_rcv_msg+0x560/0x800 [ 1117.700392][T20800] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1117.700403][T20800] ? __pfx_smc_pnet_add+0x10/0x10 [ 1117.700417][T20800] ? __lock_acquire+0x4a5/0x2630 [ 1117.700431][T20800] netlink_rcv_skb+0x159/0x420 [ 1117.700447][T20800] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1117.700458][T20800] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1117.700480][T20800] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1117.700498][T20800] genl_rcv+0x28/0x40 [ 1117.700514][T20800] netlink_unicast+0x5aa/0x870 [ 1117.700533][T20800] ? __pfx_netlink_unicast+0x10/0x10 [ 1117.700554][T20800] netlink_sendmsg+0x8b0/0xda0 [ 1117.700573][T20800] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1117.700589][T20800] ? __might_fault+0x30/0x140 [ 1117.700607][T20800] ____sys_sendmsg+0xa54/0xc30 [ 1117.700619][T20800] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1117.700636][T20800] ___sys_sendmsg+0x190/0x1e0 [ 1117.700649][T20800] ? __pfx____sys_sendmsg+0x10/0x10 [ 1117.700666][T20800] ? find_held_lock+0x2b/0x80 [ 1117.700690][T20800] __sys_sendmsg+0x170/0x220 [ 1117.700705][T20800] ? __pfx___sys_sendmsg+0x10/0x10 [ 1117.700724][T20800] ? __pfx_handle_softirqs+0x10/0x10 [ 1117.700744][T20800] do_syscall_64+0xc9/0xf80 [ 1117.700758][T20800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1117.700770][T20800] RIP: 0033:0x7f29d299acb9 [ 1117.700781][T20800] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1117.700791][T20800] RSP: 002b:00007f29d3825028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1117.700803][T20800] RAX: ffffffffffffffda RBX: 00007f29d2c15fa0 RCX: 00007f29d299acb9 [ 1117.700811][T20800] RDX: 0000000000000080 RSI: 0000200000000000 RDI: 0000000000000004 [ 1117.700817][T20800] RBP: 00007f29d3825090 R08: 0000000000000000 R09: 0000000000000000 [ 1117.700823][T20800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1117.700830][T20800] R13: 00007f29d2c16038 R14: 00007f29d2c15fa0 R15: 00007ffeb0969cb8 [ 1117.700844][T20800] [ 1118.121199][ T89] peak_usb 4-1:0.0: probe with driver peak_usb failed with error -8 [ 1121.654429][ T5875] usb 4-1: USB disconnect, device number 91 [ 1123.189831][ T5875] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 1123.641191][ T5875] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 1123.649766][ T5875] usb 8-1: config 0 has no interface number 0 [ 1123.655939][ T5875] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1123.683364][ T5875] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1124.146254][ T5875] usb 8-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 1124.166964][ T5875] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1124.177454][ T5875] usb 8-1: config 0 descriptor?? [ 1125.156216][ T5875] prodikeys 0003:041E:2801.001C: hidraw0: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.7-1/input1 [ 1125.192151][ T5875] hid_prodikeys: hid-prodikeys: failed to find output report [ 1125.192151][ T5875] [ 1125.374043][T20880] netlink: 7 bytes leftover after parsing attributes in process `syz.5.3495'. [ 1125.676140][T20879] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 1125.900137][T16757] usb 8-1: USB disconnect, device number 3 [ 1125.945500][T20872] delete_channel: no stack [ 1127.901670][T20915] ALSA: mixer_oss: invalid OSS volume 'PHl6qӆONEOUT' [ 1128.189880][T16143] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1128.356100][T16143] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1128.369646][T16143] usb 5-1: config 0 has no interface number 0 [ 1128.383697][T16143] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1128.410928][T16143] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1128.433977][T16143] usb 5-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 1128.464021][T16143] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1128.485114][T16143] usb 5-1: config 0 descriptor?? [ 1128.561645][T16588] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 1128.814823][T16588] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1128.836185][T16588] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1129.262155][T16143] prodikeys 0003:041E:2801.001D: hidraw0: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.4-1/input1 [ 1129.290140][T16588] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1129.313456][T16143] hid_prodikeys: hid-prodikeys: failed to find output report [ 1129.313456][T16143] [ 1129.323486][T16588] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1129.340060][T16588] usb 8-1: Product: syz [ 1129.344320][T16588] usb 8-1: Manufacturer: syz [ 1129.348932][T16588] usb 8-1: SerialNumber: syz [ 1129.371621][T16143] usb 5-1: USB disconnect, device number 89 [ 1129.391757][T20923] fido_id[20923]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 1129.413274][T16588] cdc_ncm 8-1:1.0: NCM or ECM functional descriptors missing [ 1129.437483][T16588] cdc_ncm 8-1:1.0: bind() failure [ 1129.691314][T16588] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1129.890622][T16588] usb 6-1: Using ep0 maxpacket: 8 [ 1129.939850][T16588] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1129.952718][T16588] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1129.990405][T16588] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1130.025058][T16588] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1130.078713][T16588] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1130.129748][T16588] usb 6-1: Manufacturer: ೵侻ਙȯﺨ╹沛ꁋ [ 1130.309413][ T30] audit: type=1400 audit(2000000661.680:1574): avc: denied { getopt } for pid=20933 comm="syz.4.3510" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1130.346385][T16588] usb 6-1: 0:2 : does not exist [ 1130.383600][T16588] usb 6-1: USB disconnect, device number 72 [ 1131.562853][T16143] usb 8-1: USB disconnect, device number 4 [ 1132.650585][T20962] fuse: Bad value for 'fd' [ 1133.456948][T20966] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3517'. [ 1133.574754][T20968] validate_nla: 6 callbacks suppressed [ 1133.574766][T20968] netlink: 'syz.3.3518': attribute type 10 has an invalid length. [ 1133.589738][T20968] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3518'. [ 1133.680957][T20966] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3517'. [ 1133.681549][T20970] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 1133.765690][T18792] netdevsim netdevsim6 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1133.880266][T20966] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 1133.922655][T20970] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 1134.369719][T20966] bond1 (unregistering): Released all slaves [ 1134.634685][T18792] netdevsim netdevsim6 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1134.705561][T20987] netlink: 'syz.4.3522': attribute type 4 has an invalid length. [ 1136.370909][T21008] fuse: Bad value for 'fd' [ 1136.973545][T21017] netlink: 'syz.3.3530': attribute type 1 has an invalid length. [ 1136.982874][T21017] netlink: 'syz.3.3530': attribute type 2 has an invalid length. [ 1136.990825][T21017] netlink: 'syz.3.3530': attribute type 2 has an invalid length. [ 1136.998704][T21017] netlink: 'syz.3.3530': attribute type 1 has an invalid length. [ 1137.007837][T21017] netlink: 'syz.3.3530': attribute type 1 has an invalid length. [ 1137.254838][ T5819] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1137.300077][ T5819] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1137.308568][ T5819] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1137.321099][ T5819] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1137.339707][ T5819] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1137.515516][T21018] lo speed is unknown, defaulting to 1000 [ 1138.337131][T21028] syzkaller1: entered promiscuous mode [ 1138.369852][T21028] syzkaller1: entered allmulticast mode [ 1138.482446][T21042] net_ratelimit: 66 callbacks suppressed [ 1138.482489][T21042] netlink: zone id is out of range [ 1138.493665][T21042] netlink: zone id is out of range [ 1138.498891][T21042] netlink: zone id is out of range [ 1138.504227][T21042] netlink: zone id is out of range [ 1138.510426][T21042] netlink: zone id is out of range [ 1138.515622][T21042] netlink: zone id is out of range [ 1138.522367][T21042] netlink: zone id is out of range [ 1138.528467][T21042] netlink: zone id is out of range [ 1138.533912][T21042] netlink: zone id is out of range [ 1138.539381][T21042] netlink: zone id is out of range [ 1138.864366][T16538] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1139.369682][T17499] Bluetooth: hci5: command tx timeout [ 1140.359594][T16538] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1140.850599][T16538] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1140.975518][ T31] INFO: task syz.1.3054:18748 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1141.071769][ T31] Tainted: G L syzkaller #0 [ 1141.394631][T19856] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1141.467741][T17499] Bluetooth: hci5: command tx timeout [ 1141.522585][ T31] Blocked by coredump. [ 1141.527295][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1141.578910][ T31] task:syz.1.3054 state:D stack:25592 pid:18748 tgid:18744 ppid:5820 task_flags:0x400548 flags:0x00080007 [ 1141.710005][T19856] usb 4-1: Using ep0 maxpacket: 32 [ 1141.781534][T19856] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1141.824344][ T31] Call Trace: [ 1141.827978][ T31] [ 1141.867823][T19856] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1141.898680][ T31] ? __schedule+0xf65/0x5e10 [ 1141.949642][ T31] __schedule+0xfe4/0x5e10 [ 1141.956479][T19856] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1141.969609][ T31] ? __lock_acquire+0x4a5/0x2630 [ 1141.974613][ T31] ? __pfx___schedule+0x10/0x10 [ 1141.979464][ T31] ? find_held_lock+0x2b/0x80 [ 1141.992074][T19856] usb 4-1: Product: syz [ 1141.996323][T19856] usb 4-1: Manufacturer: syz [ 1142.010276][ T31] ? schedule+0x2bf/0x390 [ 1142.014663][ T31] schedule+0xdd/0x390 [ 1142.018752][ T31] schedule_timeout+0x1b2/0x280 [ 1142.023735][T19856] usb 4-1: SerialNumber: syz [ 1142.031065][T19856] usb 4-1: config 0 descriptor?? [ 1142.051327][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1142.056809][ T31] ? __wait_for_common+0x2da/0x4c0 [ 1142.068979][ T31] ? __wait_for_common+0x2da/0x4c0 [ 1142.075571][ T31] ? rcu_is_watching+0x12/0xc0 [ 1142.080726][ T31] __wait_for_common+0x2e7/0x4c0 [ 1142.085700][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1142.092316][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 1142.097819][ T31] ? find_held_lock+0x2b/0x80 [ 1142.105575][ T31] ? io_wq_put_and_exit+0x233/0x8b0 [ 1142.111110][ T31] ? io_wq_put_and_exit+0x233/0x8b0 [ 1142.116356][ T31] io_wq_put_and_exit+0x27b/0x8b0 [ 1142.121862][ T31] ? __pfx_xa_find_after+0x10/0x10 [ 1142.127039][ T31] ? __pfx_io_wq_put_and_exit+0x10/0x10 [ 1142.139629][ T31] ? __pfx___might_resched+0x10/0x10 [ 1142.144990][ T31] ? io_uring_del_tctx_node+0x2aa/0x2c0 [ 1142.173385][ T31] io_uring_clean_tctx+0x114/0x180 [ 1142.178600][ T31] ? __pfx_io_uring_clean_tctx+0x10/0x10 [ 1142.199628][ T31] ? percpu_counter_add_batch+0xb9/0x230 [ 1142.206646][ T31] ? __refcount_sub_and_test.constprop.0+0x82/0x90 [ 1142.219641][ T31] io_uring_cancel_generic+0x7b9/0x810 [ 1142.225181][ T31] ? __pfx_io_uring_cancel_generic+0x10/0x10 [ 1142.251403][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1142.257577][ T31] ? do_exit+0x234/0x2a30 [ 1142.269609][ T31] ? do_exit+0x234/0x2a30 [ 1142.274003][ T31] ? rcu_is_watching+0x12/0xc0 [ 1142.278793][ T31] ? io_uring_unreg_ringfd+0xca/0x140 [ 1142.308539][ T31] do_exit+0x2be/0x2a30 [ 1142.319561][ T31] ? __pfx_do_exit+0x10/0x10 [ 1142.324242][ T31] ? do_raw_spin_lock+0x128/0x260 [ 1142.329303][ T31] ? find_held_lock+0x2b/0x80 [ 1142.349644][ T31] ? get_signal+0x7e0/0x21e0 [ 1142.354312][ T31] do_group_exit+0xd5/0x2a0 [ 1142.358831][ T31] get_signal+0x1ec7/0x21e0 [ 1142.380015][ T31] ? __pfx_get_signal+0x10/0x10 [ 1142.384978][ T31] ? fput+0x79/0x100 [ 1142.388905][ T31] arch_do_signal_or_restart+0x91/0x7a0 [ 1142.419692][ T31] ? find_held_lock+0x2b/0x80 [ 1142.424479][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1142.449623][ T31] ? xfd_validate_state+0x129/0x190 [ 1142.455098][ T31] exit_to_user_mode_loop+0x86/0x4b0 [ 1142.460636][ T31] ? rcu_is_watching+0x12/0xc0 [ 1142.465414][ T31] do_syscall_64+0x4fe/0xf80 [ 1142.470497][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1142.476400][ T31] RIP: 0033:0x7f0b21d9acb9 [ 1142.481213][ T31] RSP: 002b:00007f0b22c4f028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1142.493597][ T31] RAX: 0000000000008000 RBX: 00007f0b22015fa0 RCX: 00007f0b21d9acb9 [ 1142.501987][ T31] RDX: 0000000000000000 RSI: 00000000000847ba RDI: 0000000000000009 [ 1142.513647][ T31] RBP: 00007f0b21e08bf7 R08: 0000000000000000 R09: 0000000000000000 [ 1142.522082][ T31] R10: 000000000000000e R11: 0000000000000246 R12: 0000000000000000 [ 1142.530302][ T31] R13: 00007f0b22016038 R14: 00007f0b22015fa0 R15: 00007ffe513b1e08 [ 1142.538332][ T31] [ 1142.544643][ T31] [ 1142.544643][ T31] Showing all locks held in the system: [ 1142.709811][ T31] 3 locks held by kworker/u8:0/12: [ 1142.714993][ T31] 1 lock held by khungtaskd/31: [ 1142.731400][ T31] #0: ffffffff8e5e3360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 1142.749570][ T31] 4 locks held by kworker/u8:6/1002: [ 1142.754976][ T31] 2 locks held by getty/5579: [ 1142.769609][ T31] #0: ffff88814e0900a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1142.779483][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 1142.809576][ T31] 8 locks held by kworker/u8:7/16538: [ 1142.814991][ T31] #0: ffff88801c2dc948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 [ 1142.849601][ T31] #1: ffffc9000dc17c98 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 [ 1142.860046][ T31] #2: ffffffff903d95d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xab/0x830 [ 1142.869448][ T31] #3: ffff888058a740e8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x185/0x330 [ 1142.883153][ T31] #4: ffff888020308250 (&devlink->lock_key#6){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x18f/0x330 [ 1142.894449][ T31] #5: ffffffff903f1f28 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x108/0x830 [ 1142.903799][ T31] #6: ffff88807a23cd38 (&dev_instance_lock_key#24){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x47f/0x2580 [ 1142.916354][ T31] #7: ffffffff8e5efb38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 1142.928314][ T31] 1 lock held by syz-executor/18103: [ 1142.934041][ T31] #0: ffffffff903f1f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 1142.943413][ T31] 3 locks held by syz-executor/18944: [ 1142.948892][ T31] #0: ffff88802ff54ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 1142.961495][ T31] #1: ffff88802ff540c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 [ 1142.971787][ T31] #2: ffffffff9068afe8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 [ 1142.982231][ T31] 5 locks held by kworker/1:6/19856: [ 1142.987541][ T31] #0: ffff888142aa7148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 [ 1143.000300][ T31] #1: ffffc90004bafc98 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 [ 1143.012025][ T31] #2: ffff88802a258198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 [ 1143.021284][ T31] #3: ffff888068d27198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 [ 1143.032312][ T31] #4: ffff888141753968 (hcd->bandwidth_mutex){+.+.}-{4:4}, at: usb_set_configuration+0x23d/0x1c60 [ 1143.043499][ T31] 3 locks held by kworker/u8:23/19902: [ 1143.048984][ T31] #0: ffff88813fe69948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 [ 1143.060888][ T31] #1: ffffc900046bfc98 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 [ 1143.073276][ T31] #2: ffffffff903f1f28 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 [ 1143.083898][ T31] 4 locks held by udevd/20016: [ 1143.088683][ T31] #0: ffff888083b5f0a0 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 [ 1143.098016][ T31] #1: ffff88806a5c4088 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 [ 1143.107823][ T31] #2: ffff88802c7a03c8 (kn->active#23){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 [ 1143.118071][ T31] #3: ffff888068d27198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 1143.130907][ T31] 2 locks held by kworker/0:5/20867: [ 1143.136232][ T31] #0: ffff88813fe51948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 [ 1143.147285][ T31] #1: ffffc9000e217c98 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 [ 1143.157314][ T31] 1 lock held by syz-executor/21018: [ 1143.162934][ T31] #0: ffffffff903f1f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8bb/0x2380 [ 1143.172289][ T31] 4 locks held by syz.3.3540/21064: [ 1143.177500][ T31] #0: ffff88808f028ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 [ 1143.187878][ T31] #1: ffff88808f0280c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 [ 1143.198257][ T31] #2: ffffffff9068afe8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 [ 1143.208848][ T31] #3: ffff88806a517338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x760 [ 1143.219420][ T31] 2 locks held by syz.7.3541/21068: [ 1143.225336][ T31] #0: ffff8880592b06f0 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: __netlink_dump_start+0x150/0x990 [ 1143.237691][ T31] #1: ffffffff903f1f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x18f/0x1f0 [ 1143.248430][ T31] [ 1143.252161][ T31] ============================================= [ 1143.252161][ T31] [ 1143.268034][ T31] NMI backtrace for cpu 1 [ 1143.268058][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1143.268085][ T31] Tainted: [L]=SOFTLOCKUP [ 1143.268090][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1143.268099][ T31] Call Trace: [ 1143.268106][ T31] [ 1143.268113][ T31] dump_stack_lvl+0x100/0x190 [ 1143.268141][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 1143.268166][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1143.268183][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 1143.268208][ T31] sys_info+0x141/0x190 [ 1143.268227][ T31] watchdog+0xcc3/0xfe0 [ 1143.268257][ T31] ? __pfx_watchdog+0x10/0x10 [ 1143.268278][ T31] ? __kthread_parkme+0x18c/0x230 [ 1143.268303][ T31] ? __pfx_watchdog+0x10/0x10 [ 1143.268328][ T31] ? __pfx_watchdog+0x10/0x10 [ 1143.268351][ T31] kthread+0x3b3/0x730 [ 1143.268370][ T31] ? __pfx_kthread+0x10/0x10 [ 1143.268385][ T31] ? ret_from_fork+0x79/0xaf0 [ 1143.268404][ T31] ? ret_from_fork+0x79/0xaf0 [ 1143.268423][ T31] ? rcu_is_watching+0x12/0xc0 [ 1143.268446][ T31] ? __pfx_kthread+0x10/0x10 [ 1143.268463][ T31] ret_from_fork+0x754/0xaf0 [ 1143.268478][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1143.268498][ T31] ? __switch_to+0x7b9/0x10c0 [ 1143.268519][ T31] ? __pfx_kthread+0x10/0x10 [ 1143.268538][ T31] ret_from_fork_asm+0x1a/0x30 [ 1143.268566][ T31] [ 1143.268591][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1143.418199][ C0] NMI backtrace for cpu 0 [ 1143.418218][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1143.418239][ C0] Tainted: [L]=SOFTLOCKUP [ 1143.418244][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1143.418252][ C0] RIP: 0010:__lock_acquire+0x79f/0x2630 [ 1143.418272][ C0] Code: f6 e9 90 fb ff ff 48 89 04 24 e9 9a f9 ff ff 44 8b b5 14 0b 00 00 45 85 f6 0f 85 35 fb ff ff 41 bf 05 00 00 00 e9 30 fb ff ff <45> 31 c9 e9 f9 fa ff ff 44 8b 15 d2 bd 10 19 45 85 d2 0f 84 3b 08 [ 1143.418285][ C0] RSP: 0018:ffffc90000147658 EFLAGS: 00000046 [ 1143.418298][ C0] RAX: 00000000ffffffff RBX: ffff88801e69d4d8 RCX: 0000000000000001 [ 1143.418307][ C0] RDX: 0000000000000001 RSI: ffff88801e69d488 RDI: 0000000000000000 [ 1143.418316][ C0] RBP: ffff88801e69c980 R08: 0000000000000000 R09: 0000000000000020 [ 1143.418324][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 1143.418332][ C0] R13: 0000000000000007 R14: 0000000000020000 R15: 0000000000000000 [ 1143.418342][ C0] FS: 0000000000000000(0000) GS:ffff8881245dc000(0000) knlGS:0000000000000000 [ 1143.418356][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1143.418365][ C0] CR2: 0000001b2f7ffff8 CR3: 000000001feec000 CR4: 00000000003526f0 [ 1143.418375][ C0] Call Trace: [ 1143.418380][ C0] [ 1143.418388][ C0] ? lock_acquire+0x17c/0x330 [ 1143.418403][ C0] lock_acquire+0x17c/0x330 [ 1143.418415][ C0] ? unwind_next_frame+0xbd/0x1ea0 [ 1143.418433][ C0] ? unwind_next_frame+0x3be/0x1ea0 [ 1143.418450][ C0] ? unwind_next_frame+0x3be/0x1ea0 [ 1143.418467][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1143.418488][ C0] unwind_next_frame+0xd1/0x1ea0 [ 1143.418504][ C0] ? unwind_next_frame+0xbd/0x1ea0 [ 1143.418520][ C0] ? kasan_save_free_info+0x3b/0x70 [ 1143.418535][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1143.418553][ C0] arch_stack_walk+0x94/0xf0 [ 1143.418572][ C0] ? kasan_save_free_info+0x3b/0x70 [ 1143.418585][ C0] ? rcu_core+0x7bb/0x15c0 [ 1143.418600][ C0] stack_trace_save+0x8e/0xc0 [ 1143.418617][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1143.418636][ C0] ? __lock_acquire+0x4a5/0x2630 [ 1143.418649][ C0] ? kthread+0x3b3/0x730 [ 1143.418662][ C0] ? ret_from_fork+0x754/0xaf0 [ 1143.418677][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 1143.418689][ C0] kasan_save_stack+0x30/0x50 [ 1143.418704][ C0] ? kasan_save_stack+0x30/0x50 [ 1143.418718][ C0] ? kasan_save_track+0x14/0x30 [ 1143.418732][ C0] ? kasan_save_free_info+0x3b/0x70 [ 1143.418754][ C0] kasan_save_track+0x14/0x30 [ 1143.418768][ C0] kasan_save_free_info+0x3b/0x70 [ 1143.418780][ C0] __kasan_slab_free+0x5f/0x80 [ 1143.418796][ C0] slab_free_after_rcu_debug+0xe5/0x1c0 [ 1143.418817][ C0] rcu_core+0x7c0/0x15c0 [ 1143.418833][ C0] ? __pfx_rcu_core+0x10/0x10 [ 1143.418851][ C0] handle_softirqs+0x1ea/0x910 [ 1143.418870][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 1143.418888][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 1143.418905][ C0] run_ksoftirqd+0x38/0x60 [ 1143.418921][ C0] smpboot_thread_fn+0x3d3/0xaa0 [ 1143.418935][ C0] ? kthread+0x17d/0x730 [ 1143.418948][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 1143.418959][ C0] kthread+0x3b3/0x730 [ 1143.418973][ C0] ? __pfx_kthread+0x10/0x10 [ 1143.418985][ C0] ? ret_from_fork+0x79/0xaf0 [ 1143.418999][ C0] ? ret_from_fork+0x79/0xaf0 [ 1143.419013][ C0] ? rcu_is_watching+0x12/0xc0 [ 1143.419029][ C0] ? __pfx_kthread+0x10/0x10 [ 1143.419043][ C0] ret_from_fork+0x754/0xaf0 [ 1143.419058][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1143.419073][ C0] ? __switch_to+0x7b9/0x10c0 [ 1143.419090][ C0] ? __pfx_kthread+0x10/0x10 [ 1143.419104][ C0] ret_from_fork_asm+0x1a/0x30 [ 1143.419120][ C0] [ 1143.538177][T17499] Bluetooth: hci5: command tx timeout [ 1143.796041][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1143.802924][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1143.813615][ T31] Tainted: [L]=SOFTLOCKUP [ 1143.817961][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1143.828035][ T31] Call Trace: [ 1143.831325][ T31] [ 1143.834246][ T31] dump_stack_lvl+0x100/0x190 [ 1143.838915][ T31] vpanic+0x20d/0x630 [ 1143.842879][ T31] panic+0xd1/0xd1 [ 1143.846580][ T31] ? __pfx_panic+0x10/0x10 [ 1143.850978][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 1143.857119][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 1143.863287][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 1143.869440][ T31] ? watchdog.cold+0x198/0x1ca [ 1143.874185][ T31] ? watchdog+0xcd3/0xfe0 [ 1143.878502][ T31] watchdog.cold+0x1a9/0x1ca [ 1143.883080][ T31] ? __pfx_watchdog+0x10/0x10 [ 1143.887748][ T31] ? __kthread_parkme+0x18c/0x230 [ 1143.892765][ T31] ? __pfx_watchdog+0x10/0x10 [ 1143.897429][ T31] ? __pfx_watchdog+0x10/0x10 [ 1143.902098][ T31] kthread+0x3b3/0x730 [ 1143.906152][ T31] ? __pfx_kthread+0x10/0x10 [ 1143.910720][ T31] ? ret_from_fork+0x79/0xaf0 [ 1143.915382][ T31] ? ret_from_fork+0x79/0xaf0 [ 1143.920044][ T31] ? rcu_is_watching+0x12/0xc0 [ 1143.924797][ T31] ? __pfx_kthread+0x10/0x10 [ 1143.929369][ T31] ret_from_fork+0x754/0xaf0 [ 1143.933941][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1143.939037][ T31] ? __switch_to+0x7b9/0x10c0 [ 1143.943704][ T31] ? __pfx_kthread+0x10/0x10 [ 1143.948277][ T31] ret_from_fork_asm+0x1a/0x30 [ 1143.953048][ T31] [ 1143.956352][ T31] Kernel Offset: disabled [ 1143.960665][ T31] Rebooting in 86400 seconds..