last executing test programs: 15m15.417478535s ago: executing program 32 (id=162): inotify_init() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = io_uring_setup(0x76b0, &(0x7f00000000c0)={0x0, 0x1947c, 0x1}) io_uring_enter(r0, 0x0, 0x2, 0xf, 0x0, 0x0) r1 = io_uring_setup(0xc01, &(0x7f00000003c0)={0x0, 0xf3f0, 0x2, 0x2, 0x20b, 0x0, r0}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000000380), 0x0) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r1, 0x1e, &(0x7f00000000c0)={0xffffffffffffffff, 0x2, 0x69, 0x6, 0x4f}, 0x1) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) getpgrp(0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x88802, 0x0) socket(0x2b, 0x1, 0x1) syz_open_dev$vim2m(&(0x7f0000000100), 0x6, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x50ef, 0x0, 0x8000, 0x4, 0x1}, 0x0, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r3, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) 14m27.623088942s ago: executing program 33 (id=365): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4f28, 0x3, 'nq\x00', 0x5, 0x8, 0x78}, {@dev={0xac, 0x14, 0x14, 0x30}, 0x4e23, 0x10003, 0xcd, 0x1}}, 0x44) r1 = socket(0x1e, 0x805, 0x0) r2 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) write$proc_mixer(r2, &(0x7f0000000380)=ANY=[], 0x4000) close(r2) connect$tipc(r1, 0x0, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000100)={0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000600)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560602000fff07006706000020000000170200000ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffbd35010000000000840400000000000014000000100000009500000000000000db13d5d8b741f2cdaabc8383c8f56b8c2b848b00ea6553f304000000815dcf00c3ee7b042d1937ba52037fdedb2150e1918c30b6301f0212feb0cff9fc56357d81b2cc1a9e37d7b75c020b070000003eb22062bafaca036d9cc7db6671573e202e0a92ee4ba12b064981cc32d1ac0b9ecc8f604dcac2563e1c1e7624cc3b88b330ad416c4c1d8c60589b6045a4ffff50df4d34bc5847bebb943a84cb56956931ba9cc39c4a9deea5d77aa843a40000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) close(r3) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) close(r5) setsockopt$sock_attach_bpf(r6, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1400000039000107000000000000000010"], 0x14}}, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ipv6_route\x00') getpid() r9 = bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={r9, 0x0, 0x0}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect(r7, &(0x7f00000001c0)=@phonet={0x23, 0x9, 0x8, 0x40}, 0x80) r10 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r10, &(0x7f0000019680)=""/102392, 0x18ff8) preadv(r8, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x40000000, 0x0) 13m47.749035735s ago: executing program 34 (id=491): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r0, @ANYRES32=0x0, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028008000300741900000800090002000000"], 0x44}}, 0x0) 13m37.05318743s ago: executing program 35 (id=614): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0xb89046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) dup(0xffffffffffffffff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d6000) readv(0xffffffffffffffff, &(0x7f0000000980)=[{&(0x7f0000000000)=""/58, 0x3a}], 0x1) r1 = fanotify_init(0x1a, 0x800) fanotify_mark(r1, 0x229, 0x4800001a, 0xffffffffffffffff, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) 12m2.193536419s ago: executing program 36 (id=1064): setns(0xc9, 0x0) r0 = socket(0x2a, 0x2, 0x9) bind$inet(r0, &(0x7f0000000180)={0x2a, 0x4e23, @empty=0x1000000}, 0x10) recvmsg(r0, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) accept4$unix(r0, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e, 0x0) r1 = getpgid(0xffffffffffffffff) ptrace$ARCH_SHSTK_DISABLE(0x1e, r1, 0x3, 0x5002) 11m4.439614518s ago: executing program 37 (id=1280): syz_usb_connect$uac2(0x5, 0x81, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00'}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x9}}, './my_configfs/usb_gadget/g1/functions/uvc.usb0\x00'}) ioctl$VIDIOC_S_EDID(r2, 0xc0245629, 0x0) prlimit64(0xffffffffffffffff, 0x6, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r4 = syz_open_dev$sndmidi(&(0x7f0000000000), 0x2, 0x141102) r5 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7fce1dca24e3ee4c89a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d83104000000fda542e718f94b929ade", 0x55}], 0x1}, 0x20048000) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r6, 0x0, 0x13, &(0x7f0000000040)=0x8001, 0x4) write(r5, &(0x7f0000000040)="2400000021002551241c0165ff00fc020200000003100f000ee1000c08000b0000000000", 0x24) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0700000004000000080000000102020000000000", @ANYRES32, @ANYBLOB="0000007ced0628db0000000000000000000000a9c23f880000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000100"/28], 0x50) writev(0xffffffffffffffff, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000240)={0x2679, 0xffffffffffffffff, 0x10, {0x9, 0x21d}, 0x4}, 0x1) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) symlink(&(0x7f0000001600)='streaming/header/h\x00', &(0x7f0000001700)='streaming/class/fs/h\x00') close(r3) 5m9.037410062s ago: executing program 7 (id=2615): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = memfd_secret(0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) r4 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000040), 0x208e24b) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000000400)={r5, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0x0, 0x2]}}) ioctl$LOOP_SET_CAPACITY(r4, 0x4c07) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x2c, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xd, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x7}]}, 0x2c}}, 0x20000000) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1e000000fdffffff0e000000b400000088450000", @ANYRES32=0x1, @ANYBLOB='\a\x00'/20, @ANYRES32=r2, @ANYRES32, @ANYBLOB="0500000002040000020000000800000000000000000000000000fdff"], 0x50) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0xffffc000) ftruncate(r0, 0x3) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{}], 0x1, 0x40800) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@rights={{0x10}}], 0x10}, 0x12061) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2b0, 0x320, 0x18c, 0x203, 0x0, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x100002, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x1000b, 'syz0\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, &(0x7f0000000280), &(0x7f00000002c0)) syz_ublk_setup_io_uring(0x2e13, &(0x7f0000000000)={0x0, 0x91da, 0x401, 0x0, 0x346}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) 5m6.968505937s ago: executing program 7 (id=2622): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000880)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000701"], 0x30}}, 0x0) 5m3.789189168s ago: executing program 7 (id=2627): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='wwnn=0x1111111111111111,wwpn=0x2222222222222222', 0x2f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$kcm(0xa, 0x1, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r3, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0x600, 0x1}}, 0x20) sendmsg$kcm(r2, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) write(r1, &(0x7f0000000600)='wwnn=0x3333333333333333,wwpn=0x4444444444444444,roles=32,lpwwnn=0x1111111111111111,lpwwpn=0x2222222222222222', 0x6c) r4 = openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r4, &(0x7f0000000a00), 0x0) 5m2.81179682s ago: executing program 7 (id=2630): r0 = memfd_create(&(0x7f0000000000)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) r1 = dup(r0) r2 = fanotify_init(0x2, 0x101000) fanotify_mark(r2, 0x1, 0x1b, r1, 0x0) ftruncate(r0, 0x3) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) socket$nl_route(0x10, 0x3, 0x0) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x7) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000040)={0x0, 0x2000, 0x3, {0x0, 0xa}, {0x1, 0x3cc}, @const={0x0, {0x0, 0x8, 0x2, 0x81}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4808000010001fff3a4ee9bfd5c3a3696c40af0b", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e"], 0x3}}, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000940), r6) sendmsg$GTP_CMD_NEWPDP(r6, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000980)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010027bd810000a7d960673400", @ANYRES32=0x0, @ANYBLOB="080002000100000008000800000000000800090000000000"], 0x34}, 0x1, 0x0, 0x0, 0x24000004}, 0x24040810) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4890) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x10000007, 0xffffffff, 0x1) syz_genetlink_get_family_id$tipc2(0x0, r6) sendmsg$TIPC_NL_SOCK_GET(r6, 0x0, 0x0) write$binfmt_misc(r4, &(0x7f0000000000), 0xfffffecc) splice(r3, 0x0, r5, 0x0, 0x4ffe4, 0x8) r8 = io_uring_setup(0x54a0, &(0x7f0000000000)={0x0, 0x70e6, 0x2, 0x3, 0xf2}) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r8, 0x12, 0x0, 0x0) 5m1.793482772s ago: executing program 7 (id=2636): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newtaction={0x18, 0x30, 0x25, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}, {0x6, 0xffe0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x8, 0x2, 0x5, 0x787, 0x3, 0x9}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x8000000000000001}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'veth1_to_bridge\x00'}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200), 0x6000) syz_open_dev$audion(&(0x7f0000000000), 0xffffffff00000000, 0x10b00) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) close(0x4) r5 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007c, 0x80001) ioctl$MON_IOCG_STATS(r5, 0x80089203, &(0x7f0000002300)) syz_usb_connect$uac1(0x2, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="120101020000004035121c8240000102030109026000030101005c0904000000010100000a2401f97b0a0002"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) 4m59.705212688s ago: executing program 7 (id=2642): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) r0 = socket(0xa, 0x2400000001, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f00000000c0)={0x1d, r3}, 0x18) connect$can_j1939(r2, &(0x7f0000000140)={0x1d, r3}, 0x18) writev(r2, &(0x7f0000000400)=[{&(0x7f0000000440)="b47b693fb8be1e856e", 0x9}], 0x1) recvmmsg(r2, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000040), 0x10, &(0x7f0000000480)=""/230}, 0x10000000}], 0x2, 0x0, 0x0) shmat(0x0, &(0x7f0000f35000/0x1000)=nil, 0x4000) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000008e80)="0e24ac7705237246fc1db898fda0c7f95d375ea7f4bc7a07517a51095880f2219d9e4329f6c4e734f2bb34564a1c2e298d7eb8844d8af7b30e1a71750a2511e44b368fc6e9ae65e40e64e4b5fd3d0f87009b5727519df1ddbcbb38ef00871f00ed2543b7f2990a44482bf3d7478c3c2799dd8120fc3258cfeccf648fe15128c54d1d4272bfd44950915afd3aa0abb5b04d4dbec287df0816c3e43c2503cac6e95041aa205c5958f51a9c4c8214ae2108401b08ae7ff8440988c93424422f06c628077d767432521fefa0f8d0f387e685e4af54bdd7f931c3eace52ca7a6ba2d0fd701e5d77393e6268f52e68d97087f87edd2ae49180028bf08ab7e02c3ef12aec2f286d1bf40fd3a5f337b0f0b63d701c60bae36a5e1644bc90f34165049ac5c4fc8a0ada90e345df1420a58c92cfcc6973d3fa532b8b4088592e0f2c36f7e756139b272fc99104a93c5cf2599c683b60910af98a55b17bf646ddddb13e73d0bfdcfb3e3d261d84f83270832708f6e5b3fd2bb98e135b914e21681b409d717afa8f65dc9d3ab6a78b9b026b6aa1f1ee5872426b4bd4fd652072f86dfb96ef79649396a0f19239b0ce6ba9a8ff49f8f4820579a3169fe54b6f060a69236d57a1a13f033054fb22dbfb3f72861acc7ed51ebed60a8a03c3e16030e7a114d0690c268713d8206b34a005fb89d5123103d36ab57594fc731e8a6353ab3be3af22faa6f85b54ba78b90aba30e17dad90c31a20cc5f39c8ff50097bb310535efd6ecbc49dfc2d547bee78d5c5ebfe0d4bd3c093413e12cfefbfdb5f38c437ce831b209f3337979f6e0c46d8bf272a3ac6076c7940f905536167d2285d2a7d0e75f1765f0c080f1dfd9bae98afdfda7e7837d1081d83effab72e6eff493cc9031a299383f726227d75474e4c8378b2376fc7fef8b213b26794edc4c2fc110d917b863d25e7382b19b1b90cc90428f6aa0b1df015bcbbe83de36ff56c065ba92f1f49e61ac6bc6b3c20e42e7763dd52f66095f07e235f0062accb0eab60ce54d84391cbf2613096ded353543b5d6a884cc981b759e4499ab72881f88542208c9fd81b541514d6d2ed54683926b0d6bfe904b76215aea6db4cff8242d3ee5524acb456ec219e42d46c1b1e3fa9748404db4583537b195ad326853ed9472790656ab01bd031b19fb64b0e5227d18ea09ea7557c9afdc918c918a1fafdd18f9f54682bf0f49ba2ae14f963340dc6600e1b344ce50ed61af0726e3441583f8cf045df193dfbce93285d7fddfc0d831fefc85cd3e7920757f27a4e09b5cfa77b93a5e82f571d1293d9437cf89997011eee6ba9f9b7e6ce2fe1c381cb2db053a6e2d9351edbddcc10faf80f5b686727dd8982b12604fde3467f4a7e98b13250df7e1eef67da8f7fe3fffd3a185457aaaecb38f5ca31ea3e35cc7c6adc3873c734cb661e3c43e64bf0843b2cf1d950642eeb20d698cc9e598eb7ec71d3a0d83f311afa2d40a659a219defad76fdb7e8146756ff02a8a74abf8a8ccd72ffd7f70911698d54552aada8ef27b3f5b2644d4d0fda2976d838686a7469b296a98b67b7cc9834dc94f2292581dd242d1abb42db30d4de42c4611c0fbdc77134a6cb0c0d7b36d18a217aaabd34744ed5cac171e2a8bfe90b2dad03d0ca5f74d3eb95c454757be4c77f386c63fee91e95a508d8fcea5cd6bef9bd05e0b992da4e4cbc2f52c9cfde09b6f17f3d73fffc01d7ac55f328061516cf0e4fa50fff5b03dca67b163a68d9ddbb988f50a68fdbfc6e6feb6c892b58eb766d3429396669228dd1653bcbb5cb47c0857d27660e62d23e90178ef2b75713c2c58a207d8c21e9ce64556bfd71b40207ee76416f9f40c5601173b1d84105ac331247c021941a6a27e86de4f9a4db382f67dd6dc8e86a02a8438ddda1a636256fcac8e2328aaa3c054ab86f55c9d7bb2c2999a5c7933f092a3bf66523cb388052c65d138346ad1c5137fa383d7b9023b1868af02cf48923289162544db8fb29cf592c306a76ec92b35f33fae90f5aeac830b82dcc3f0069f668aebe6e5fe13c811f150de080632e357221d2f220ef95ce436730d1f9390d9f192220347d04ac5a94631e349ad330276b9524f775f7a8f68be7823ad7ed3ac4b4d87a12c0261846ec1dfe785b60675968e79496d7ae4e5d478661bd7125f2cc0de35422764556b63d687b339e2b25ad43ca85bc861944d19f9689dffe71d87030d23e0428942441d622de361778cbe8952f7b93c74783552b0087bff535afaf92935aa889018e46d34b2a258f863d89e4b6da841389fa63d489d135e559b7d11b8d97215323548501c275248eb07916ae3f0814c6af32f5ece7eb0330bdaac4394c518f3c8e48cafc36057cfa7788fb2f9a73bddb1d40546cf21b681e6c9ef6f0ac43c512762323209b2c878ed5a9f55e207b56a33c863eaa34a6eb14ad8de9885d52a7c073a406ea4324f8433ddfd89b269d6716072627054197928370ae01a94e3dd4d07125560a5cb1d1bfbbd8c099194de5f787a550a3400ce796e115702255d1f17d96a7fb63384ff497cf72beeb50bd24008ffc58256aec6b2faff2c20336e29bc1acd853214496893af25e8efb571c96edf64fbcd136c95e1213e73bc3f1a896fca2bde0894449ee2927c38114de5f1063d0c203c3fab1389861c4cda173a991eb275ccffe04f75d67df181c26777b18e5552b42fb4332046554109a9a6007592a62d2553dbd098f1daae593322e45f66a64bdb09869feede70d1fcc88fd4c19f4008d1b1d5f34a6025a71d9bf6ff20daccda25cbcc662cfc687ffe5ebc344468f338f4c9bbdc7ed9820feb5e3b09ace47f4253a81da7029816656613aef7456524fc68f4345bc0e7f26240d4594374d2fcb39560e2828e0e219b2417f5787add73418b465b1308d5ac5169791f55802d11354eb62940a492d955e8bd11b952a28acea90cb43af774e6fc75e57383e68937aa3643aa37f7e7665c703576579dcccf63d2bdadfbf14be796d4023689880453b0ff576fb01bb141be3c17478f0d555ca96ff7c3f3e4f53be1f088827203fab2008ec6687e4f5df305f58fe647b93ad09a70165c989498d313ca5ba05f3ce90adc80d55b56d0ec4cd5a78268cc6def7e8bb810bc29f8e742487048363815fa3fe645194ee8529ffba2b8d6756915530f142b42f31eae1703faeae14f3d81ae5c2297c3476b0f89b32f53802453fc74c80bf217097577a910a51860bbead4f73a29423816eadca7b1e2d24a9895949b352fe59f13abfa7b69c0f0061eaae2ada6d72b2f90c9c553ad8be9ee4e4ad2876851a3f3e979c4d770d7df9a27e72ab215ec3efd252d622e7ec6160ac951d1ee9b8c0adc0fc853f2a4f36602c955b61646246e07bd7b745f5d3e99f95f55a1616ed36633db6efa97a96dacf12219cf1555222cc6a589a6def5680124f7ac2f1ec83832a30fd011ff02dbf4ab01afb5989fcc678383f179b5d647cf0a762acf0714e9e4151afa39626884e6f56859d3aafc9fc7f7bbcfb27e038e238783cf56c86f0be52568c4bed0917d651f4d26f76ba6c343e075146504590da391e1c4d028dc81767294df5de9370d62756584baa3bfa31578b6f754e77b0d6ea7357d8915ff0bda182b604b014ecf7dc94ab97061765bfab2053fa863fb671fad3b6312d6e59ba0e70b0ea2476399e925f8fa2e51c9bbfac19aeb11db3dd6ea8d916c4d4eae7de17259e6155591be9b704d3e24cda131eded5e9dd6758dc90a5c7a43332957d26ac91bc65120b1c6b7b94fdf83b397bd8990747f01d3ed912abeab74bb5ae3ff2ee0009cfe8cdb6b4e75a7de3566c8ff7bdddb06b7775cf3116b029e7c85fb7189147e753d614caa490594ff2e22b7144153c635ac7b20a49c2d8575af2f546b968bea9fc4ee5ff417a6fa86ca09c8fed14ea4b721b2d5870d4b670761c70516daa07809ac3817246844f01eadda045c57d1c864cbaabedf90cb42d374392e77b3d1a1afdf962feb55a4e04a77c8fb452429007e0046a406a5f2325f0c7f75a19deed1b456ac5de6486eebbc126ff97c5ee8531a975676b61a0d79f56ff75cbcd20337119422815537a57766648777f1b5f75d358dc63764083406e2d95afd87d00099581940367ed029065df0d9008301fb92e019feac9bb406032167eb053ab07309385771aacc2c52a5d526d14721fd530e63cb7c53f27518c679ccd0f3d2db8aa52ef95c6ac3f5dac0b9b5c3a96a794690f3d49aa0e5a4a95b36609cf61d471cc2c0cd55e8cd96be47558b055280313b15907eba5761180f5229a59341faa1e11eb5b6a48ec9320efb1d9f00936d9a5d91f2bf837fe72edf6ec025c1c4e87171cc02c7342fa5d4f825157d70d8f66f6fa0542de2255373d8743612e7d4e16b8ceebf4e92c40926f21929cab343b981120236b8b0b900772a33bbe4eef06feff3c7b104cf63d92c7f9233982f9b713489fb8bf80f2feffd6c22007b63925209e158a837dc95b42d52ed764350b5f83ad54041bc15a7552c0b8c1933d674a16b0c0934277d9895c1ad01327231a7fffc4b5e1a1495489559bebff324d54f2894563a23b85d3bef62c356eb476e01e0c039287ca38626751f701ef4e20d951433940ce1138660589ff389dee9f85a7faebb9cc494bbe7138b413303af6e05806032d8131d5a25a5d7c0ed87906d92bdd87ce7d62c13989f3435ad77a29b721d8219d2cf530c2ec9edc3de9ce2dcd5053c38a6797de8d8cbd3596ed545d2dc6f825a0e65428dd73df96d5f3e40dbe5a62f0f440f712419d1558ef97bf1d0ca1d59fa1caf6ed0d422456848e196e94b4741b757935bc3aef3a46f53066dc7a74f42d539da2228fb8593ddb79ac977a8b67c0a6058efdbe23ba75fb2faf5b9f152e60b8a96ee19fbf0c417c89f882c53d389bf27a18b9e34b2a33aa27029cfed7a03335cf33d95ea803ad125237a9cc70520f18bc7e9f0c1432368a5304544f5d1e1599242bcd905f69f25cd0fcde391960fc57426e0bf22155ea315f0caee330bf3b7f4f4363f87146531175ad4f69002d46e95a48f714c9bbd9e39b95783406d477dabe03397d68e7af5ee623b4c05eb64120ca76af4f1d37348f93f39d8fa1d22fef874ce65b66f8a1aaff9db97520dab97eb8d1f99efef4d4c9704d181d687874ec4fbb400ed4ce050ac997c843e647bebeddc33eeb70201b3286ea25ad1bdb80dba1fc78a6883ecca84d17645be16bee32967bd487c6f5e0714ca819d5913436ac9aeeab4e5092ec1897dad39737365e8414246a81a731bf7d3ad8d789b42c651702b70ee786032356e3b9fc4402104ffbe55026c84e8ec5dd2a1860cefd0e7789ac2a47fa5ee9610dee980fa3c2fa7219b4e57642f31012b3e00e64285fda219fa9ca37955e3c25fd5872172ed2f5651d208897ed4e1d224243b2f241f24580e924e02cb60af5e14898028596400a770f94e67590df5fe99e9d170d061397f71f4202eca4c91c7fc27e2379358a8d9bfc28c2fb67842b0bd1e5e68e017b34084aa08e7453fc6b03bd42772643eae036f25f10e4da022818dc84f35eea2c07e4dbb41e861b8a4c6df4f0b4b785f0df55f863707a0563cdd5b9fcaa352b54071cd486cf4948575ddbe4654a566438922887a3bd304853a98283c7a4d7757cc6e8298b0121aca5fdb64d86996d8c0ddfa1ee4ccef1ee21dcf853bdb02471383f73ddae17dfef217c6a3f79b182fc36bdb47d1899e87bb4c4e490ad4a2724d223b31b889685355f349ca8bc62d39150ebccaba863bd72bf91d65cffe560eecf162b2440f9d74fe0fb3f8479fd8f6293f16e4d67b3ec30e83180444cec51d2b455a3ab2b6286d4fac1acba8b7b5026671fef497d5e050e0aa34dcecf2d06a9e4b60cdb3f9cbb7cadd73c817f255f8e2eb22d6283a7934e0fd64eaf52caab2d1862baf505889e4db1a1870f0049b3ada06d38af52535da352bedbf1e88e34595820cedd4559cbe0fe0578c557a62f56060d75c5a6806e384d3c274c218d57beecbd8e7832f3cc050668b44c1b8ff8cdcd2b85b5ecb9eca1dcc1204d27bc3689578eab43dac5658a1cfe75456b221c15ed26720a49829f96d501fda6d7839724207d6a5f6bb3d8390e90dd7c6b80e15e6b20b7c74ff3282c770eb1c77583fc97bdb5f2df62a74b3385e2e8ba06fc39730f1f02107477c215deb6c8599cdacc7c710b7b1a77afbe3b2a593f6eec5c8014dd366f5890a1a579e51d858cc8ef93aff098af9903b4e3633a3090a630e64be99f49d32d63d779f989d0198044717741d3bfab4242a05dae33f11ed6b1d850fb379f725fdb7b296d9d9b3024160d4fd735a77c8ab23f0816bfc2715a2561c3cee6e41cf79030c1500c09e75ebbd5a7aa8a0e4826542ad46a9350e969b357c142af13afdd8927cdce3d1f35493f6a7a14c5a20739d462d566fe3ab620f1ef323768bd871eb454dad947f2a871efa05d601cf9fb08d992caf6f4b0f652e13df7dfc658f50e0c9bfc3bf28114a51142f65e25435a32c8719fde2a3d5c4850e31ffa675fa44f9e54957d108e46a67a3b7d71b272ecb0385466e39238f6421b2fd6f33a258883a4501b63001ee9ecb9137162488051f7ff15e6f4be81ca31ffac70f48bcd3457fcb137a2f5108d908ba1d51b0fca7e14273b176af4b954837dc3d40b4341fd03063ee145dfc4456bb303bb0540db3aadb26240242f4a55cb9f6623b6e724e0f9d8b73d02c9fd9140873c0bb884e3cf4c844bad6f27388b56840b63d65ca760dbddf778e430e1f03c246e74e9b56a08a56617658f7fc42e3582f3181a720e51598d22062815ca3caebf36389a58278acc788035d8deb0b800180ef6537d92bfa18947cb18232bfd27e048fcd49d44c137f1d8a10294a6dd20251a00c379bb0936fcb5137c9f5a7a7404976c778912a37f1503deb27b85d3b1d886415a98348d3632c7eb4bf58fdfddd5b24407709474e4478c991a03ed8b456d9a71ec82f05791eb17425e0360493fb5ec343eba7e9c970f47f4cd85edda849cc524d42a11eaf29be950e621cd12e16e3a304516ce5c74a2b47a1baf1f3321b84318883bb023cb5f67dc3541a4d72ebb3316244f96cde4aebc1a77336a93d226c315ab02581123140e45373f40c8cfc7fb5d478607f9b38c2b95bcd55fb8a2047569ac7927b9e4208f75032abfe83442d2ca5db1ee8903888548b5fa9724520083052f8e652f1b0d39d031d2c61f63e5cfb98061b5b913dc6da26e690c85b07fa19b9bf83d124a5fcf96de21d9f00c9aaf2ec66580e4dd99c21c01b7557b7c6336cec525003157d3efdd16a52407b35225f65e44933d56c90dbeeffcfbe2b10bdd921a507592817043c88bab1882ac8863f8a73fed3310138ae56c9b5fb8aa22d5d6ab9e5ece2afb94c5054bdc8444b00a46d74716c21346f2dce31f180f3e01453d7a7aaf4200c4be278a2a88fbec4529a551189da822d1365c8ac70bd6c6cb3c3791e183eeba95e65f1f87c10b2f740bee2575807c486e3b7939f093d44693ac069089830afff26d7165712abb7ba5bf8aaa87a3d57c5670b3a45d707b87aa7689b18292d851cac59802b38bd7ab8e1c3b8a134db1a366aaa8f77a6e2c937f49961637d291970b4541e3405948ba2ef49b40f600e28861c54f06a2400f82ffb2b9a0d4c6da720f9fea31dbe3f42aa29bd126fcbfccb9d809c8bbd76d241fc2588963f10434b69e9415d20bea13c30a08b22f5f21bd945a11466d228848b7b68927725239142fc536f784b705d3bd318f5d5fce31ddd32eca57309b1f9e5cdb0164df0bc45d04db323ed272fef5e4e0554cbe0eef83999d6dd82b67a5de6986b7063851602f833a23946ffb004b9cb30f6af2108e2aee029aa3e4fd525597f4a8d0184750731821bf21aaf703753270d3f12d5ed5f7bdb47c891074a44c63bebe47c66aab7f24e422b5f549249f26cab0aac9484087871de53cdb6d575e0e7ea3c73de23460c5b1bbe1e838433de48ecc812c1e21861dc290f22733090b5d3f88910478bff51307e6d869b68a745255ca007b9f5dda63074845d4d8f03604ada7cb5f8c1bcad9f3a84bab71e6c109ef7bd8eb29ba18011430f28eee91aa83749594aa5c717c0d53e0ff68372284e356e55f9cf33716ade1e148beda327236f4005472600f99a1c2fbe10c5492d2e082d15fa962492b16029a222bce55a001b2726fad239160f3ed55e98343fa5266cd7f5e36158480430e2f802fbfa3aa6e7299ab0940eea91682c79fffb171a705a23b70173f0973ca0b0ea230b306418677be4e6bcca0e6cc7bdbf6a3a96090819d541f505402ce505b40bd7d012ffb6a62f2528c5d370b2d6d6cf4b49c6886d20a5cc94cbe5e7cdf012af5d27c0c89c190956d1aaf1911888b33f67341fe74a10cba3328b84e3c4b83bb8b25da32122ed8df7b831e77bf9528af4b0960a0abb420e931eead4dcf31849cafc6099e8a3053758200bdbb411346662442e8274bc9780fd69abb4ef9ddd292f791b846a5849610862453cdb9263ddc232492de5d24c2c52751223cb961bb9ba7c86988b2a5490c3540ada6ffb9ba287c3e15d228aa0a6491ceced135cb1533b31c0b8ca218ffe4e1a07f29b4557a05b447358350ebfdcff9793b2eb1d7e0ea082b1f4fde8207071a8beb8c1e5efc49e1153fb8fb21ebc46c4d5b404a743a54076e4987da1748a39c70c083960873ffa0b88d4cccae69cdf4630a78250db81141e216e2007b7aea7500ad3176ae8e22c5fce5f14f0aa581bbe520a6d6c5f504547b178e62236f54809dd43763107e49b0d44a7968dcdf73a8c3c395fecd8a557ab850bebf1a67e82714131e0380fd6684e8094783190ce491a03243d903b4488d574be3847b4219145f5aa05201b4bafcbe2c2c98fb4e968c15822e20c06e83b0fc24d8d30acc9e24b36cfd06ad1a073719bf3a92922111e76efac5a813faaca76acfb065ad4faf1efe403aee89bc149bfa4e907008fe5f81d4e795c7a646c2b48e79b7ba54ec42425978c4d084c3c1f66ccdf230515366b08cd506a210e92e75bf7adfbaada44b619feecc4427ca23e74b68abfe9796a6e9a1f540d6a438042f506c27bb4f4814c73541b38eb7d548010363cdf7b2b6faf1a41a10fb71bd206388f32777c6b8e3fd7f6cd76342a1fba80deba8100f878eb4e4a09287ce513bb6b1f445e3cbdf220ff5faceb36c3a7f1a1710e780b9772124e5728fed14bbe348f0f4831913ae69ff40c953cc6447babbcf55b08491357531dc9d86fbe5cd4fd0d6e03e5b71daca299a8d31c3596fb98d21acc09d03e3fe7cc1f13c3e8b49b9dd40b8397ae617b322951a4bd8fe8a1eff9f920b79ddad1639da4d4a18c12ca3b65430e41506198483d5a2a0bc058269e7575cd6dc8d1a0393748622369c107b8a5fe570a7795d98b75e23d4c05c39655c8b81a389b512461a20711487695b8d4ff2d81ab4fe8c884768cbb99640a9ec5b54d3cd13a90f318e0264038b7f91dd73205342400eb9d186ed30286ff7cb9e459341ee59638b253148cfa74bada6b959f185b5cf68a313ff757836aafbbdf1f4440ec0f44d99c3950a6e2fdc6b7d8c6120f921630b93ec31c216e93e6b3781d02ef2339dbea56125ffe79019b1689c25d35db7d3f3e5c613060400977a2f7e142b50591b2ae5738dfd208c0f4daeda71edd05beaf4fc0b128fd004bd2bf1cea1d6883b4287cab96354e8f34f9d3707763b731686cbe6c175848a9f4bdd7c2961d270d9ef63ac95aa0603d3612a8933660c303fd1a91b3eb700718cdf40a34795399a7812c89b44f7b223dbe8bb08e0c01c4bf740c95431445a6b6fae337df7778e834813b34e0e6d3f0e935fdd136e6ac50c8e11fffb518b06c734985f31884a411293a3a3757a6e5be3d2495916314dc072fc9c0dbefcb5100513df15c18e04b2ad744d660f9cb5f4c64eead30fdd52507bba003c625108e6cdfcd7a1b38e8fd4fef0d419f695904be3026aeb9bab1ad3566a0a46a2a2d092c75ae2cbad109a117b7db76b729aaab3a89bcef8a5e63008613414fa5ce56988bbe3e839ccb8e192c56115522620e0851fbd19790f3acf9669915ef0f1ca0a2ca8a5578747f2d6cbec07a7bc4128ae131b7685191d5cf05210cc4bca2dc6303747c72cc0e4165512cccd43c5a79800b84ca018190a70984d73056e2a8bbdea91fdfcda72d9f8705227c5c4fdef9e0b81948420cae7344ba872a85e2d47c1e40fefcaa8d246fac5c7abe90b2bf39ec601390dd0a8cacbe82fc1ba0cf13c3cd89220a42e82ce62ccdf63fcb1be53c91d36349c7d3aa30170dccd5262d9ee570581ae5c9f84cf5b32261d8f531f6df0636cea496c698f36aee3274f0f9dfb7d72c074530a2679d13e5cc1bfcd957be3eba04a12f8897507122fc74ad66a7f621012ea43878cfa9a2a3ed95581aebdf1ffd7a8985f65c63de9eab4286cb94e57e3076e4e2850faef69b1d9f75ff45227b9e1bcc256c0236dc63483cffb8d72543eb213b2e0a487217850ab3bf7213dabb360c35714dbab5604357ea7b23fc0ba27d0bd09dc09e7ac471088c58d28e3ef12c3054d8a017a5023f378ae81bbbf55228620e061ace44906cc82520bfac2e1d7f7e340f53215bcf6f6078d82266abaaf479e084e73f0600572a7d482a84633eefc6e196f27638e8f08c6a4c615ef98238895d2cffb221a800424e115b0e84b960424fe39a2f33a203eb42f7f5e70e8f73aa172a8adf1d977b176cae2750859c96692bdac1067b7a1b1496dbd7c8220f3f0b42938ba0779c9bfa414a0e6073556d651d526875a4cfa95e8e981f40fc6d8bdd4704a12f44612e8eb8842535edea3d609d929b3fc05c2b02bd44e02a732ba814caf9e03e0bd7f41a24b3b6e282d07d74de2ab968ac739e994c0265416a7347f44bb80d1948cf8c9a69409e850b13f379dd672eb34a732b0b1d7b67ef2ee1bcb686cc4d1f4512c1ffb105ad2e46d783e0ca5f97ef9e4ab2798ce1c29b0f3292fbf1001d9487adfc3b34b4329be6b72ebf7a62158e488bd7888060f1e562045ecf9388c492fe3e0a6ce9b92b5a3eb29c80cc69da72f7dc2f2ac730e5d82cc5b75cecdd0809db8f1cc17bf5b72ed46fa3038722b6369d9f9497b83cc2ea1d0ebea0ac1306a83249705ae0b1c0145af67388d2153dbcb8856971216ee8f3d0cc6f532f159e5e28c6308154bf8efe46333b30740e9d94993393a27eb263dc0d19f182913ffa3953a52847fe979b9e682d304944529131b02ed468c88b5aac0483ff22ad56f9630b4f6134f266ee446068edd079411571f7e77acf2035d483043b8ad85b6277dca9e590ca801dc1896acdfc88dcf3cf83fca85afefe6addd27131f8be0fd5a80a0723556639fff59d56453ec76d3ebad3f5cb04e7b758b13e3d64c2ff5c3b018f52ba9363e053ee2fd78e35b2a834a069953e759455047521ad6615ab87e6381f0363a4554b86dd14f5ab43eb6b3fff64d94af0949a9e5c63d8c8e883886e61bd36f5ca11dfe2c025290cd49f369f8a3f9023d5daa7410fba96927fd0b5d2c75e", 0x2000, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) 4m56.338229468s ago: executing program 2 (id=2653): socket$inet6(0xa, 0x3, 0x800101) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, 0x0, 0x2b) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000000904"], 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$netlink(0x10, 0x3, 0x15) sendmmsg(r3, &(0x7f0000000180), 0x4000190, 0xc03e) 4m52.504436003s ago: executing program 2 (id=2665): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0xa4e4, 0x14b302) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) mq_open(&(0x7f00000013c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5\x00\x02\x00\x00\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x00\x00\x00\x00\x00\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\xac8t\xc5\xd7Q?\xb4\xeex@\xe4\xcc\xfe\x98\xf63\xde\xcd\x1841\x93\xe5\xb7D\xd49\"\f<\x8d\xa5m\x883\xcf\xc7\xe5Y\xb6H\xa4\xc4_Q|\v\x06:\xdap48T\xa6\xcb:+\x7f\x9771fK=\xc2)\xa60\x1d>\xd2\xe8\xc0\x03\xa7e\xbeo\x8d\xe3\x854\x11\xc5d\xcb\x82', 0x42, 0x48, 0x0) r2 = open(&(0x7f0000000380)='./bus\x00', 0x109240, 0x145) r3 = creat(&(0x7f0000000200)='./bus\x00', 0x48) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$FUSE_NOTIFY_STORE(r3, 0x0, 0x2b) sendfile(r4, r2, 0x0, 0x4000000053d2) syz_emit_ethernet(0x0, 0x0, 0x0) close(r0) sendmmsg(r1, &(0x7f0000000500)=[{{&(0x7f0000000380)=@generic={0x23, "57815cdeea606aeb193b04509c20a908416a6894dbcdedc04f4d1740915255ea7a525fcd051c2baeb891b39db12ae77e3dfdd8c494ebcd1924887a8d717e043c45f092fef269b355c4b3e1e009c70eb8ba22fc3ea5c2b1cdc7d01c9a2b2014472ea26339286f4a71b524f572bb370fb8389d0305cd38f475d64c33b51d23"}, 0x80, 0x0}}], 0x1, 0x4000000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) ioctl$TIOCVHANGUP(r5, 0x5437, 0x300000000000000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) clock_settime(0x8d71ca88fffffffd, 0x0) 4m51.137824525s ago: executing program 2 (id=2667): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x9) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x60402, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x37ad37ca69a5fd92, 0x41000, 0x8, 0x7f, 0x3, 0x1, 0x40, 0x3, 0x0, 0x20, 0x19}, {0x41000, 0xa000, 0xa, 0x4, 0x40, 0x5, 0x7d, 0x9, 0x58, 0x3, 0xff}, {0xc000, 0x4000, 0xb, 0x5, 0x3, 0x9, 0xfe, 0x89, 0x1, 0xab, 0x5, 0x81}, {0xdddd0000, 0x9000, 0x3, 0x40, 0x5, 0x43, 0x9, 0xfa, 0x80, 0x6, 0xe}, {0xdddd0000, 0x26000, 0x10, 0x2d, 0x3, 0x7, 0x80, 0x7f, 0x47, 0x83, 0xf9, 0x2}, {0x1000, 0x80a0000, 0x8, 0x7, 0xb5, 0x8, 0x1, 0xd, 0x88, 0xf, 0x1, 0xfd}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x7e, 0xef, 0x70}, {0xffff1000, 0xb000, 0x10, 0x5, 0xf, 0x7, 0x1, 0x16, 0x2, 0x0, 0x7, 0x9}, {0xb000, 0x2d}, {0x1, 0x3fe}, 0x80000031, 0x0, 0x5000, 0x42024, 0xb, 0x4501, 0x3000, [0xe840000000000002, 0x7, 0x91, 0xff]}) ioctl$KVM_GET_REGS(0xffffffffffffffff, 0x8090ae81, &(0x7f0000000480)) syz_clone(0x2280700, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[], 0x32600) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000003, 0x10, r1, 0xec772000) fremovexattr(r3, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x100010, r4, 0x0) ioctl$TIOCSPGRP(r4, 0x5410, &(0x7f0000000000)=r0) syz_open_procfs(0x0, &(0x7f0000002040)='net/tcp\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 4m47.379668432s ago: executing program 2 (id=2676): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000200)="2e9b5b00ace03dd65193dfb6c561963d86", 0x11}, {&(0x7f0000000380)="a1c6757dfaadb021e548300000000000006cf0c0a8", 0x15}, {&(0x7f0000000100)="3cd61eba910358f711cfacd43195f2b73f4dcc0000000000", 0x18}], 0x3) 4m45.052448498s ago: executing program 2 (id=2683): socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee3, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x2, @local}]}, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000280)={r4}, &(0x7f0000000040)=0x8) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = add_key$user(&(0x7f0000000000), 0x0, &(0x7f0000000540)="7e51126c2b98e96c1872d1a776885818026fba000000000000000000000000000000f9d2cfec1fb75ea6acd8b10195fc43159a129dbb31ae93b028a9397be8562f4e3cfd5a8f6159f7de25329c51ef34b9b5f326e06c9ba0d8635dc56c03f26b4a9f8ed755a6ef54b060839b83239f43c9583da17d4e4a31e831b386b8249a3459fc96058f4d08aadc3057a92b72c25dc43e2f237880cab74092a00d8298e503c5ba16cd", 0x46, 0xfffffffffffffffe) r6 = add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000140)={r5, r6, r5}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r8 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r7, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) bind$unix(r9, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r7, 0xffffffffffffffff) 4m43.940943715s ago: executing program 38 (id=2642): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) r0 = socket(0xa, 0x2400000001, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f00000000c0)={0x1d, r3}, 0x18) connect$can_j1939(r2, &(0x7f0000000140)={0x1d, r3}, 0x18) writev(r2, &(0x7f0000000400)=[{&(0x7f0000000440)="b47b693fb8be1e856e", 0x9}], 0x1) recvmmsg(r2, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000040), 0x10, &(0x7f0000000480)=""/230}, 0x10000000}], 0x2, 0x0, 0x0) shmat(0x0, &(0x7f0000f35000/0x1000)=nil, 0x4000) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000008e80)="0e24ac7705237246fc1db898fda0c7f95d375ea7f4bc7a07517a51095880f2219d9e4329f6c4e734f2bb34564a1c2e298d7eb8844d8af7b30e1a71750a2511e44b368fc6e9ae65e40e64e4b5fd3d0f87009b5727519df1ddbcbb38ef00871f00ed2543b7f2990a44482bf3d7478c3c2799dd8120fc3258cfeccf648fe15128c54d1d4272bfd44950915afd3aa0abb5b04d4dbec287df0816c3e43c2503cac6e95041aa205c5958f51a9c4c8214ae2108401b08ae7ff8440988c93424422f06c628077d767432521fefa0f8d0f387e685e4af54bdd7f931c3eace52ca7a6ba2d0fd701e5d77393e6268f52e68d97087f87edd2ae49180028bf08ab7e02c3ef12aec2f286d1bf40fd3a5f337b0f0b63d701c60bae36a5e1644bc90f34165049ac5c4fc8a0ada90e345df1420a58c92cfcc6973d3fa532b8b4088592e0f2c36f7e756139b272fc99104a93c5cf2599c683b60910af98a55b17bf646ddddb13e73d0bfdcfb3e3d261d84f83270832708f6e5b3fd2bb98e135b914e21681b409d717afa8f65dc9d3ab6a78b9b026b6aa1f1ee5872426b4bd4fd652072f86dfb96ef79649396a0f19239b0ce6ba9a8ff49f8f4820579a3169fe54b6f060a69236d57a1a13f033054fb22dbfb3f72861acc7ed51ebed60a8a03c3e16030e7a114d0690c268713d8206b34a005fb89d5123103d36ab57594fc731e8a6353ab3be3af22faa6f85b54ba78b90aba30e17dad90c31a20cc5f39c8ff50097bb310535efd6ecbc49dfc2d547bee78d5c5ebfe0d4bd3c093413e12cfefbfdb5f38c437ce831b209f3337979f6e0c46d8bf272a3ac6076c7940f905536167d2285d2a7d0e75f1765f0c080f1dfd9bae98afdfda7e7837d1081d83effab72e6eff493cc9031a299383f726227d75474e4c8378b2376fc7fef8b213b26794edc4c2fc110d917b863d25e7382b19b1b90cc90428f6aa0b1df015bcbbe83de36ff56c065ba92f1f49e61ac6bc6b3c20e42e7763dd52f66095f07e235f0062accb0eab60ce54d84391cbf2613096ded353543b5d6a884cc981b759e4499ab72881f88542208c9fd81b541514d6d2ed54683926b0d6bfe904b76215aea6db4cff8242d3ee5524acb456ec219e42d46c1b1e3fa9748404db4583537b195ad326853ed9472790656ab01bd031b19fb64b0e5227d18ea09ea7557c9afdc918c918a1fafdd18f9f54682bf0f49ba2ae14f963340dc6600e1b344ce50ed61af0726e3441583f8cf045df193dfbce93285d7fddfc0d831fefc85cd3e7920757f27a4e09b5cfa77b93a5e82f571d1293d9437cf89997011eee6ba9f9b7e6ce2fe1c381cb2db053a6e2d9351edbddcc10faf80f5b686727dd8982b12604fde3467f4a7e98b13250df7e1eef67da8f7fe3fffd3a185457aaaecb38f5ca31ea3e35cc7c6adc3873c734cb661e3c43e64bf0843b2cf1d950642eeb20d698cc9e598eb7ec71d3a0d83f311afa2d40a659a219defad76fdb7e8146756ff02a8a74abf8a8ccd72ffd7f70911698d54552aada8ef27b3f5b2644d4d0fda2976d838686a7469b296a98b67b7cc9834dc94f2292581dd242d1abb42db30d4de42c4611c0fbdc77134a6cb0c0d7b36d18a217aaabd34744ed5cac171e2a8bfe90b2dad03d0ca5f74d3eb95c454757be4c77f386c63fee91e95a508d8fcea5cd6bef9bd05e0b992da4e4cbc2f52c9cfde09b6f17f3d73fffc01d7ac55f328061516cf0e4fa50fff5b03dca67b163a68d9ddbb988f50a68fdbfc6e6feb6c892b58eb766d3429396669228dd1653bcbb5cb47c0857d27660e62d23e90178ef2b75713c2c58a207d8c21e9ce64556bfd71b40207ee76416f9f40c5601173b1d84105ac331247c021941a6a27e86de4f9a4db382f67dd6dc8e86a02a8438ddda1a636256fcac8e2328aaa3c054ab86f55c9d7bb2c2999a5c7933f092a3bf66523cb388052c65d138346ad1c5137fa383d7b9023b1868af02cf48923289162544db8fb29cf592c306a76ec92b35f33fae90f5aeac830b82dcc3f0069f668aebe6e5fe13c811f150de080632e357221d2f220ef95ce436730d1f9390d9f192220347d04ac5a94631e349ad330276b9524f775f7a8f68be7823ad7ed3ac4b4d87a12c0261846ec1dfe785b60675968e79496d7ae4e5d478661bd7125f2cc0de35422764556b63d687b339e2b25ad43ca85bc861944d19f9689dffe71d87030d23e0428942441d622de361778cbe8952f7b93c74783552b0087bff535afaf92935aa889018e46d34b2a258f863d89e4b6da841389fa63d489d135e559b7d11b8d97215323548501c275248eb07916ae3f0814c6af32f5ece7eb0330bdaac4394c518f3c8e48cafc36057cfa7788fb2f9a73bddb1d40546cf21b681e6c9ef6f0ac43c512762323209b2c878ed5a9f55e207b56a33c863eaa34a6eb14ad8de9885d52a7c073a406ea4324f8433ddfd89b269d6716072627054197928370ae01a94e3dd4d07125560a5cb1d1bfbbd8c099194de5f787a550a3400ce796e115702255d1f17d96a7fb63384ff497cf72beeb50bd24008ffc58256aec6b2faff2c20336e29bc1acd853214496893af25e8efb571c96edf64fbcd136c95e1213e73bc3f1a896fca2bde0894449ee2927c38114de5f1063d0c203c3fab1389861c4cda173a991eb275ccffe04f75d67df181c26777b18e5552b42fb4332046554109a9a6007592a62d2553dbd098f1daae593322e45f66a64bdb09869feede70d1fcc88fd4c19f4008d1b1d5f34a6025a71d9bf6ff20daccda25cbcc662cfc687ffe5ebc344468f338f4c9bbdc7ed9820feb5e3b09ace47f4253a81da7029816656613aef7456524fc68f4345bc0e7f26240d4594374d2fcb39560e2828e0e219b2417f5787add73418b465b1308d5ac5169791f55802d11354eb62940a492d955e8bd11b952a28acea90cb43af774e6fc75e57383e68937aa3643aa37f7e7665c703576579dcccf63d2bdadfbf14be796d4023689880453b0ff576fb01bb141be3c17478f0d555ca96ff7c3f3e4f53be1f088827203fab2008ec6687e4f5df305f58fe647b93ad09a70165c989498d313ca5ba05f3ce90adc80d55b56d0ec4cd5a78268cc6def7e8bb810bc29f8e742487048363815fa3fe645194ee8529ffba2b8d6756915530f142b42f31eae1703faeae14f3d81ae5c2297c3476b0f89b32f53802453fc74c80bf217097577a910a51860bbead4f73a29423816eadca7b1e2d24a9895949b352fe59f13abfa7b69c0f0061eaae2ada6d72b2f90c9c553ad8be9ee4e4ad2876851a3f3e979c4d770d7df9a27e72ab215ec3efd252d622e7ec6160ac951d1ee9b8c0adc0fc853f2a4f36602c955b61646246e07bd7b745f5d3e99f95f55a1616ed36633db6efa97a96dacf12219cf1555222cc6a589a6def5680124f7ac2f1ec83832a30fd011ff02dbf4ab01afb5989fcc678383f179b5d647cf0a762acf0714e9e4151afa39626884e6f56859d3aafc9fc7f7bbcfb27e038e238783cf56c86f0be52568c4bed0917d651f4d26f76ba6c343e075146504590da391e1c4d028dc81767294df5de9370d62756584baa3bfa31578b6f754e77b0d6ea7357d8915ff0bda182b604b014ecf7dc94ab97061765bfab2053fa863fb671fad3b6312d6e59ba0e70b0ea2476399e925f8fa2e51c9bbfac19aeb11db3dd6ea8d916c4d4eae7de17259e6155591be9b704d3e24cda131eded5e9dd6758dc90a5c7a43332957d26ac91bc65120b1c6b7b94fdf83b397bd8990747f01d3ed912abeab74bb5ae3ff2ee0009cfe8cdb6b4e75a7de3566c8ff7bdddb06b7775cf3116b029e7c85fb7189147e753d614caa490594ff2e22b7144153c635ac7b20a49c2d8575af2f546b968bea9fc4ee5ff417a6fa86ca09c8fed14ea4b721b2d5870d4b670761c70516daa07809ac3817246844f01eadda045c57d1c864cbaabedf90cb42d374392e77b3d1a1afdf962feb55a4e04a77c8fb452429007e0046a406a5f2325f0c7f75a19deed1b456ac5de6486eebbc126ff97c5ee8531a975676b61a0d79f56ff75cbcd20337119422815537a57766648777f1b5f75d358dc63764083406e2d95afd87d00099581940367ed029065df0d9008301fb92e019feac9bb406032167eb053ab07309385771aacc2c52a5d526d14721fd530e63cb7c53f27518c679ccd0f3d2db8aa52ef95c6ac3f5dac0b9b5c3a96a794690f3d49aa0e5a4a95b36609cf61d471cc2c0cd55e8cd96be47558b055280313b15907eba5761180f5229a59341faa1e11eb5b6a48ec9320efb1d9f00936d9a5d91f2bf837fe72edf6ec025c1c4e87171cc02c7342fa5d4f825157d70d8f66f6fa0542de2255373d8743612e7d4e16b8ceebf4e92c40926f21929cab343b981120236b8b0b900772a33bbe4eef06feff3c7b104cf63d92c7f9233982f9b713489fb8bf80f2feffd6c22007b63925209e158a837dc95b42d52ed764350b5f83ad54041bc15a7552c0b8c1933d674a16b0c0934277d9895c1ad01327231a7fffc4b5e1a1495489559bebff324d54f2894563a23b85d3bef62c356eb476e01e0c039287ca38626751f701ef4e20d951433940ce1138660589ff389dee9f85a7faebb9cc494bbe7138b413303af6e05806032d8131d5a25a5d7c0ed87906d92bdd87ce7d62c13989f3435ad77a29b721d8219d2cf530c2ec9edc3de9ce2dcd5053c38a6797de8d8cbd3596ed545d2dc6f825a0e65428dd73df96d5f3e40dbe5a62f0f440f712419d1558ef97bf1d0ca1d59fa1caf6ed0d422456848e196e94b4741b757935bc3aef3a46f53066dc7a74f42d539da2228fb8593ddb79ac977a8b67c0a6058efdbe23ba75fb2faf5b9f152e60b8a96ee19fbf0c417c89f882c53d389bf27a18b9e34b2a33aa27029cfed7a03335cf33d95ea803ad125237a9cc70520f18bc7e9f0c1432368a5304544f5d1e1599242bcd905f69f25cd0fcde391960fc57426e0bf22155ea315f0caee330bf3b7f4f4363f87146531175ad4f69002d46e95a48f714c9bbd9e39b95783406d477dabe03397d68e7af5ee623b4c05eb64120ca76af4f1d37348f93f39d8fa1d22fef874ce65b66f8a1aaff9db97520dab97eb8d1f99efef4d4c9704d181d687874ec4fbb400ed4ce050ac997c843e647bebeddc33eeb70201b3286ea25ad1bdb80dba1fc78a6883ecca84d17645be16bee32967bd487c6f5e0714ca819d5913436ac9aeeab4e5092ec1897dad39737365e8414246a81a731bf7d3ad8d789b42c651702b70ee786032356e3b9fc4402104ffbe55026c84e8ec5dd2a1860cefd0e7789ac2a47fa5ee9610dee980fa3c2fa7219b4e57642f31012b3e00e64285fda219fa9ca37955e3c25fd5872172ed2f5651d208897ed4e1d224243b2f241f24580e924e02cb60af5e14898028596400a770f94e67590df5fe99e9d170d061397f71f4202eca4c91c7fc27e2379358a8d9bfc28c2fb67842b0bd1e5e68e017b34084aa08e7453fc6b03bd42772643eae036f25f10e4da022818dc84f35eea2c07e4dbb41e861b8a4c6df4f0b4b785f0df55f863707a0563cdd5b9fcaa352b54071cd486cf4948575ddbe4654a566438922887a3bd304853a98283c7a4d7757cc6e8298b0121aca5fdb64d86996d8c0ddfa1ee4ccef1ee21dcf853bdb02471383f73ddae17dfef217c6a3f79b182fc36bdb47d1899e87bb4c4e490ad4a2724d223b31b889685355f349ca8bc62d39150ebccaba863bd72bf91d65cffe560eecf162b2440f9d74fe0fb3f8479fd8f6293f16e4d67b3ec30e83180444cec51d2b455a3ab2b6286d4fac1acba8b7b5026671fef497d5e050e0aa34dcecf2d06a9e4b60cdb3f9cbb7cadd73c817f255f8e2eb22d6283a7934e0fd64eaf52caab2d1862baf505889e4db1a1870f0049b3ada06d38af52535da352bedbf1e88e34595820cedd4559cbe0fe0578c557a62f56060d75c5a6806e384d3c274c218d57beecbd8e7832f3cc050668b44c1b8ff8cdcd2b85b5ecb9eca1dcc1204d27bc3689578eab43dac5658a1cfe75456b221c15ed26720a49829f96d501fda6d7839724207d6a5f6bb3d8390e90dd7c6b80e15e6b20b7c74ff3282c770eb1c77583fc97bdb5f2df62a74b3385e2e8ba06fc39730f1f02107477c215deb6c8599cdacc7c710b7b1a77afbe3b2a593f6eec5c8014dd366f5890a1a579e51d858cc8ef93aff098af9903b4e3633a3090a630e64be99f49d32d63d779f989d0198044717741d3bfab4242a05dae33f11ed6b1d850fb379f725fdb7b296d9d9b3024160d4fd735a77c8ab23f0816bfc2715a2561c3cee6e41cf79030c1500c09e75ebbd5a7aa8a0e4826542ad46a9350e969b357c142af13afdd8927cdce3d1f35493f6a7a14c5a20739d462d566fe3ab620f1ef323768bd871eb454dad947f2a871efa05d601cf9fb08d992caf6f4b0f652e13df7dfc658f50e0c9bfc3bf28114a51142f65e25435a32c8719fde2a3d5c4850e31ffa675fa44f9e54957d108e46a67a3b7d71b272ecb0385466e39238f6421b2fd6f33a258883a4501b63001ee9ecb9137162488051f7ff15e6f4be81ca31ffac70f48bcd3457fcb137a2f5108d908ba1d51b0fca7e14273b176af4b954837dc3d40b4341fd03063ee145dfc4456bb303bb0540db3aadb26240242f4a55cb9f6623b6e724e0f9d8b73d02c9fd9140873c0bb884e3cf4c844bad6f27388b56840b63d65ca760dbddf778e430e1f03c246e74e9b56a08a56617658f7fc42e3582f3181a720e51598d22062815ca3caebf36389a58278acc788035d8deb0b800180ef6537d92bfa18947cb18232bfd27e048fcd49d44c137f1d8a10294a6dd20251a00c379bb0936fcb5137c9f5a7a7404976c778912a37f1503deb27b85d3b1d886415a98348d3632c7eb4bf58fdfddd5b24407709474e4478c991a03ed8b456d9a71ec82f05791eb17425e0360493fb5ec343eba7e9c970f47f4cd85edda849cc524d42a11eaf29be950e621cd12e16e3a304516ce5c74a2b47a1baf1f3321b84318883bb023cb5f67dc3541a4d72ebb3316244f96cde4aebc1a77336a93d226c315ab02581123140e45373f40c8cfc7fb5d478607f9b38c2b95bcd55fb8a2047569ac7927b9e4208f75032abfe83442d2ca5db1ee8903888548b5fa9724520083052f8e652f1b0d39d031d2c61f63e5cfb98061b5b913dc6da26e690c85b07fa19b9bf83d124a5fcf96de21d9f00c9aaf2ec66580e4dd99c21c01b7557b7c6336cec525003157d3efdd16a52407b35225f65e44933d56c90dbeeffcfbe2b10bdd921a507592817043c88bab1882ac8863f8a73fed3310138ae56c9b5fb8aa22d5d6ab9e5ece2afb94c5054bdc8444b00a46d74716c21346f2dce31f180f3e01453d7a7aaf4200c4be278a2a88fbec4529a551189da822d1365c8ac70bd6c6cb3c3791e183eeba95e65f1f87c10b2f740bee2575807c486e3b7939f093d44693ac069089830afff26d7165712abb7ba5bf8aaa87a3d57c5670b3a45d707b87aa7689b18292d851cac59802b38bd7ab8e1c3b8a134db1a366aaa8f77a6e2c937f49961637d291970b4541e3405948ba2ef49b40f600e28861c54f06a2400f82ffb2b9a0d4c6da720f9fea31dbe3f42aa29bd126fcbfccb9d809c8bbd76d241fc2588963f10434b69e9415d20bea13c30a08b22f5f21bd945a11466d228848b7b68927725239142fc536f784b705d3bd318f5d5fce31ddd32eca57309b1f9e5cdb0164df0bc45d04db323ed272fef5e4e0554cbe0eef83999d6dd82b67a5de6986b7063851602f833a23946ffb004b9cb30f6af2108e2aee029aa3e4fd525597f4a8d0184750731821bf21aaf703753270d3f12d5ed5f7bdb47c891074a44c63bebe47c66aab7f24e422b5f549249f26cab0aac9484087871de53cdb6d575e0e7ea3c73de23460c5b1bbe1e838433de48ecc812c1e21861dc290f22733090b5d3f88910478bff51307e6d869b68a745255ca007b9f5dda63074845d4d8f03604ada7cb5f8c1bcad9f3a84bab71e6c109ef7bd8eb29ba18011430f28eee91aa83749594aa5c717c0d53e0ff68372284e356e55f9cf33716ade1e148beda327236f4005472600f99a1c2fbe10c5492d2e082d15fa962492b16029a222bce55a001b2726fad239160f3ed55e98343fa5266cd7f5e36158480430e2f802fbfa3aa6e7299ab0940eea91682c79fffb171a705a23b70173f0973ca0b0ea230b306418677be4e6bcca0e6cc7bdbf6a3a96090819d541f505402ce505b40bd7d012ffb6a62f2528c5d370b2d6d6cf4b49c6886d20a5cc94cbe5e7cdf012af5d27c0c89c190956d1aaf1911888b33f67341fe74a10cba3328b84e3c4b83bb8b25da32122ed8df7b831e77bf9528af4b0960a0abb420e931eead4dcf31849cafc6099e8a3053758200bdbb411346662442e8274bc9780fd69abb4ef9ddd292f791b846a5849610862453cdb9263ddc232492de5d24c2c52751223cb961bb9ba7c86988b2a5490c3540ada6ffb9ba287c3e15d228aa0a6491ceced135cb1533b31c0b8ca218ffe4e1a07f29b4557a05b447358350ebfdcff9793b2eb1d7e0ea082b1f4fde8207071a8beb8c1e5efc49e1153fb8fb21ebc46c4d5b404a743a54076e4987da1748a39c70c083960873ffa0b88d4cccae69cdf4630a78250db81141e216e2007b7aea7500ad3176ae8e22c5fce5f14f0aa581bbe520a6d6c5f504547b178e62236f54809dd43763107e49b0d44a7968dcdf73a8c3c395fecd8a557ab850bebf1a67e82714131e0380fd6684e8094783190ce491a03243d903b4488d574be3847b4219145f5aa05201b4bafcbe2c2c98fb4e968c15822e20c06e83b0fc24d8d30acc9e24b36cfd06ad1a073719bf3a92922111e76efac5a813faaca76acfb065ad4faf1efe403aee89bc149bfa4e907008fe5f81d4e795c7a646c2b48e79b7ba54ec42425978c4d084c3c1f66ccdf230515366b08cd506a210e92e75bf7adfbaada44b619feecc4427ca23e74b68abfe9796a6e9a1f540d6a438042f506c27bb4f4814c73541b38eb7d548010363cdf7b2b6faf1a41a10fb71bd206388f32777c6b8e3fd7f6cd76342a1fba80deba8100f878eb4e4a09287ce513bb6b1f445e3cbdf220ff5faceb36c3a7f1a1710e780b9772124e5728fed14bbe348f0f4831913ae69ff40c953cc6447babbcf55b08491357531dc9d86fbe5cd4fd0d6e03e5b71daca299a8d31c3596fb98d21acc09d03e3fe7cc1f13c3e8b49b9dd40b8397ae617b322951a4bd8fe8a1eff9f920b79ddad1639da4d4a18c12ca3b65430e41506198483d5a2a0bc058269e7575cd6dc8d1a0393748622369c107b8a5fe570a7795d98b75e23d4c05c39655c8b81a389b512461a20711487695b8d4ff2d81ab4fe8c884768cbb99640a9ec5b54d3cd13a90f318e0264038b7f91dd73205342400eb9d186ed30286ff7cb9e459341ee59638b253148cfa74bada6b959f185b5cf68a313ff757836aafbbdf1f4440ec0f44d99c3950a6e2fdc6b7d8c6120f921630b93ec31c216e93e6b3781d02ef2339dbea56125ffe79019b1689c25d35db7d3f3e5c613060400977a2f7e142b50591b2ae5738dfd208c0f4daeda71edd05beaf4fc0b128fd004bd2bf1cea1d6883b4287cab96354e8f34f9d3707763b731686cbe6c175848a9f4bdd7c2961d270d9ef63ac95aa0603d3612a8933660c303fd1a91b3eb700718cdf40a34795399a7812c89b44f7b223dbe8bb08e0c01c4bf740c95431445a6b6fae337df7778e834813b34e0e6d3f0e935fdd136e6ac50c8e11fffb518b06c734985f31884a411293a3a3757a6e5be3d2495916314dc072fc9c0dbefcb5100513df15c18e04b2ad744d660f9cb5f4c64eead30fdd52507bba003c625108e6cdfcd7a1b38e8fd4fef0d419f695904be3026aeb9bab1ad3566a0a46a2a2d092c75ae2cbad109a117b7db76b729aaab3a89bcef8a5e63008613414fa5ce56988bbe3e839ccb8e192c56115522620e0851fbd19790f3acf9669915ef0f1ca0a2ca8a5578747f2d6cbec07a7bc4128ae131b7685191d5cf05210cc4bca2dc6303747c72cc0e4165512cccd43c5a79800b84ca018190a70984d73056e2a8bbdea91fdfcda72d9f8705227c5c4fdef9e0b81948420cae7344ba872a85e2d47c1e40fefcaa8d246fac5c7abe90b2bf39ec601390dd0a8cacbe82fc1ba0cf13c3cd89220a42e82ce62ccdf63fcb1be53c91d36349c7d3aa30170dccd5262d9ee570581ae5c9f84cf5b32261d8f531f6df0636cea496c698f36aee3274f0f9dfb7d72c074530a2679d13e5cc1bfcd957be3eba04a12f8897507122fc74ad66a7f621012ea43878cfa9a2a3ed95581aebdf1ffd7a8985f65c63de9eab4286cb94e57e3076e4e2850faef69b1d9f75ff45227b9e1bcc256c0236dc63483cffb8d72543eb213b2e0a487217850ab3bf7213dabb360c35714dbab5604357ea7b23fc0ba27d0bd09dc09e7ac471088c58d28e3ef12c3054d8a017a5023f378ae81bbbf55228620e061ace44906cc82520bfac2e1d7f7e340f53215bcf6f6078d82266abaaf479e084e73f0600572a7d482a84633eefc6e196f27638e8f08c6a4c615ef98238895d2cffb221a800424e115b0e84b960424fe39a2f33a203eb42f7f5e70e8f73aa172a8adf1d977b176cae2750859c96692bdac1067b7a1b1496dbd7c8220f3f0b42938ba0779c9bfa414a0e6073556d651d526875a4cfa95e8e981f40fc6d8bdd4704a12f44612e8eb8842535edea3d609d929b3fc05c2b02bd44e02a732ba814caf9e03e0bd7f41a24b3b6e282d07d74de2ab968ac739e994c0265416a7347f44bb80d1948cf8c9a69409e850b13f379dd672eb34a732b0b1d7b67ef2ee1bcb686cc4d1f4512c1ffb105ad2e46d783e0ca5f97ef9e4ab2798ce1c29b0f3292fbf1001d9487adfc3b34b4329be6b72ebf7a62158e488bd7888060f1e562045ecf9388c492fe3e0a6ce9b92b5a3eb29c80cc69da72f7dc2f2ac730e5d82cc5b75cecdd0809db8f1cc17bf5b72ed46fa3038722b6369d9f9497b83cc2ea1d0ebea0ac1306a83249705ae0b1c0145af67388d2153dbcb8856971216ee8f3d0cc6f532f159e5e28c6308154bf8efe46333b30740e9d94993393a27eb263dc0d19f182913ffa3953a52847fe979b9e682d304944529131b02ed468c88b5aac0483ff22ad56f9630b4f6134f266ee446068edd079411571f7e77acf2035d483043b8ad85b6277dca9e590ca801dc1896acdfc88dcf3cf83fca85afefe6addd27131f8be0fd5a80a0723556639fff59d56453ec76d3ebad3f5cb04e7b758b13e3d64c2ff5c3b018f52ba9363e053ee2fd78e35b2a834a069953e759455047521ad6615ab87e6381f0363a4554b86dd14f5ab43eb6b3fff64d94af0949a9e5c63d8c8e883886e61bd36f5ca11dfe2c025290cd49f369f8a3f9023d5daa7410fba96927fd0b5d2c75e", 0x2000, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) 4m43.923683901s ago: executing program 2 (id=2685): mmap$IORING_OFF_SQ_RING(0x0, 0x648, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000003040), 0x802, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xf100}) syz_usb_connect(0x5, 0x36, 0x0, 0x0) syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(0x0, 0x7, 0xb, 0x401d031, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0105500, &(0x7f0000000180)={0x60, 0x15, 0x302, 0xb91, 0x0, 0xdaa, 0x0}) socket$unix(0x1, 0x1, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x4688da4246680c77, 0x0) socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) sendmsg$unix(r6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x18, 0x4000}, 0x880) 4m28.903760469s ago: executing program 39 (id=2685): mmap$IORING_OFF_SQ_RING(0x0, 0x648, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000003040), 0x802, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xf100}) syz_usb_connect(0x5, 0x36, 0x0, 0x0) syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(0x0, 0x7, 0xb, 0x401d031, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0105500, &(0x7f0000000180)={0x60, 0x15, 0x302, 0xb91, 0x0, 0xdaa, 0x0}) socket$unix(0x1, 0x1, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x4688da4246680c77, 0x0) socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) sendmsg$unix(r6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x18, 0x4000}, 0x880) 2m56.121777011s ago: executing program 1 (id=2922): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x2, 0x25dfdbfb, {{@in=@multicast1=0xe0000002, @in=@rand_addr=0x64010102, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x6}, {0x0, 0x0, 0x1abe1019, 0x0, 0x0, 0x8, 0x0, 0xfffffffffffffffd}, {}, 0x0, 0x6e6bb8, 0x0, 0x1, 0x0, 0x3}}, 0xb8}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e2404000200000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e"], 0xd4}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) ioctl$F2FS_IOC_FLUSH_DEVICE(r1, 0x4008f50a, &(0x7f00000001c0)={0x80, 0x4}) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="653a6d796d737231206d73722f722d3bd4d6706a2fa295b11af47d3507f2997fd66d8a793d86ebce6cf76325bdc4f6326007e352cf34a7ca3f1f978c1ff0ed91381e8da7c17e4e6b3f58af24c7", 0x4d) getdents64(0xffffffffffffffff, 0x0, 0x0) socket(0x1e, 0x805, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) prlimit64(r3, 0xe, &(0x7f0000000040)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f0000001840)=[{{&(0x7f0000000280)=@rc={0x1f, @none}, 0x80, &(0x7f0000001700)=[{&(0x7f0000000300)=""/44, 0x2c}, {&(0x7f0000000480)=""/163, 0xa3}, {&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/235, 0xeb}, {&(0x7f0000001880)=""/173, 0xad}], 0x5, &(0x7f0000001780)=""/137, 0x89}}], 0x1, 0x40000160, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) connect$unix(r6, &(0x7f0000001640)=@abs={0x1, 0x0, 0x4e24}, 0x6e) shmget(0x1, 0x2000, 0x54000000, &(0x7f00009d2000/0x2000)=nil) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001000000"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r7, r7}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x11, &(0x7f0000000540)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m55.022990568s ago: executing program 1 (id=2925): r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000009968810524711004f320102030109021b0001000000000904000001ff01320009050d03"], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$vim2m(0x0, 0x8000000800, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, &(0x7f0000000100)={0x2}, 0x0) read$eventfd(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) unshare(0x28000600) syz_open_dev$video4linux(0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_SETINTERFACE(r4, 0x80085504, &(0x7f0000000180)) 2m49.951770812s ago: executing program 1 (id=2938): mlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) map_shadow_stack(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0xc, 0x6, 0x301, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x200040c0) r0 = userfaultfd(0x0) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa07, &(0x7f0000000180)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0xb49}}, './file0\x00'}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r2 = syz_clone3(&(0x7f0000000440)={0x8804e00, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0, {0x18}, &(0x7f0000000300)=""/181, 0xb5, &(0x7f00000003c0)=""/46, &(0x7f0000000400)=[0xffffffffffffffff, 0x0, 0x0], 0x3, {r1}}, 0x58) prlimit64(r2, 0x9, &(0x7f00000004c0)={0x2, 0x8}, 0x0) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000500)={'\x00', 0x4, 0xa, 0x1b, 0x0, 0x1, 0xffff1000, 0x50000, '\x00', 0x8}) mlockall(0x3) socket$nl_route(0x10, 0x3, 0x0) r4 = accept4$unix(r1, &(0x7f00000006c0), &(0x7f0000000740)=0x6e, 0x80000) bind$unix(r4, &(0x7f0000000780)=@file={0x1, './file0/file0\x00'}, 0x6e) mmap$snddsp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000001, 0x40010, r1, 0x2000) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000000840)={'sit0\x00', &(0x7f0000000800)={@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1, 0x0, 0x20, 0x0, [{@dev}, {@private}]}}) mincore(&(0x7f0000ffb000/0x4000)=nil, 0x4000, &(0x7f0000000880)) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f00000008c0)) r5 = shmget$private(0x0, 0x1000, 0x800, &(0x7f0000ffc000/0x1000)=nil) shmat(r5, &(0x7f0000ffb000/0x4000)=nil, 0x7000) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000940)={&(0x7f0000000900)=""/23, 0x10000, 0x1800, 0x0, 0x1}, 0x20) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_LBT_MODE(r6, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x40, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x6}]}, 0x40}, 0x1, 0x0, 0x0, 0x8014}, 0x400c000) bind$inet6(r1, &(0x7f0000000a80)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x5202}, 0x1c) ioprio_get$pid(0x3, r2) socket$inet6_udp(0xa, 0x2, 0x0) syz_open_procfs(r3, &(0x7f0000000ac0)='attr\x00') epoll_pwait2(r0, &(0x7f0000000b00)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, &(0x7f0000000b80)={0x77359400}, &(0x7f0000000bc0)={[0xfffffffffffffffe]}, 0x8) setxattr$security_ima(&(0x7f0000000c00)='./file0\x00', &(0x7f0000000c40), &(0x7f0000000c80)=@md5={0x1, "2d03bb12fcc113df1237152ccf9c872d"}, 0x11, 0x0) 2m48.023097078s ago: executing program 1 (id=2945): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) prlimit64(r0, 0x6, &(0x7f00000000c0)={0x3, 0xef7}, &(0x7f0000000100)) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = memfd_create(0x0, 0x2) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x7) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000080)=0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 2m47.027560889s ago: executing program 1 (id=2946): bpf$PROG_LOAD(0x5, &(0x7f0000003a40)={0x1c, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000100000000000000040000001811"], 0x0, 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4000002}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019440)=""/102400, 0x19000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newtaction={0x6c, 0x30, 0x1, 0x300, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0xd34, 0x0, 0x8}, 0x4}}, @TCA_MPLS_BOS={0x5}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r5, 0x0, 0x0) r6 = memfd_create(&(0x7f0000000640)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc9\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\xa4(V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93i|\xc0\x00\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\xfd\x89\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\xb5\x13^\x13\xcb\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0) (async) socket(0x10, 0x3, 0x0) (async) signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x1003ffffffc]}, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_route(0x10, 0x3, 0x0) (async) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mountinfo\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0xc0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = dup(r2) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYRES8=r0]) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) r4 = syz_open_dev$sg(&(0x7f0000000140), 0xa, 0x28102) ioctl$SG_GET_SG_TABLESIZE(r4, 0x227f, &(0x7f0000000080)) (async) writev(r4, &(0x7f0000000340)=[{&(0x7f0000000100)="717a7c4c2ff921a9e69795dfa20a1622a05cac4a60986f0470ea0f91121fc2006729efcf075abb3df497cf0fdbd0799da52dfe9f8e5baeb243238aaf4ce0c0b1a555510affd1726405797def561ab980f4735b0782c3ae0235d16aba9c8f2dff24b78f7c0ea58d77f0398c552171e2499f75eb9c39673e845789c92bcabc2c65d12d0e6afc024dbc8bba71442b975332c41af65eef20492c2ec34e086b981012f42198cf7e66437a5ebf29888a1d9d5a2d809e6d9ed387ad37fa1b99e36027ca2d17995a59b9ae50cc00fe32578deba6ce402e725657d397199b876cfcb19aa7c722341251b246adf59fcbe0dbede230a6d708b294b8", 0xf6}, {&(0x7f0000000200)="bec4a56f4c40d9b3bada0dc0af3abd2c6f77c6f08af3484bb511b14faece61153a1c15afebec22a883d8108afe819fa342850b40b61926c6bcba1eab310af8d90ddb4cc8e340ea3802b44a8f0436efaadcb1d04103419fa46eef992da441df017b4cde1b4d7c6cfb6cf9101e4ab1ff27a1eb190e71c8bcc247cd117f43dece3e59679aac0100defa4e02af7ee3322eac85067981ef220d74e1c7c69fa458381118d33781c8437aa7ae8c8a2c9b843e6178f1def5efc52343b7a87e182c4896d4", 0xc0}, {&(0x7f00000002c0)="f3f4ada5906009e1e17beb29991a7c936a4400d8b94bca74b854968509e6a5e3e6712c5f22048aab9195f1", 0x2b}], 0x3) (async) r5 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0x2c, &(0x7f0000000300)={0x0, 0x1, 0x3}) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000380)={0xfffffffc}, 0x4) (async) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r6, 0x40045612, 0x0) (async) ioctl$vim2m_VIDIOC_G_FMT(r6, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x7, 0x4, 0x9, 0x4}, 0x2, 0x401a, &(0x7f00000021c0)={{0x6, 0x2, 0x5, 0x40}}, 0x3317, 0x0, 0x8}}) (async) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) (async) mq_timedsend(r5, 0x0, 0x0, 0xa, 0x0) 2m41.400157887s ago: executing program 0 (id=2956): socket$alg(0x26, 0x5, 0x0) r0 = socket(0x1d, 0x2, 0x6) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x6a, 0x3, 0xfffffff4, 0xb5a3664e6e5b4adc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x5, 0x3}, 0x0) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) close_range(r3, r3, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000060000000300000002000013"], 0x0, 0x42}, 0x28) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) preadv(r4, &(0x7f0000000700)=[{&(0x7f0000000140)=""/185, 0xb9}, {&(0x7f00000002c0)=""/236, 0xec}, {&(0x7f00000003c0)=""/208, 0xd0}, {&(0x7f00000004c0)=""/146, 0x92}, {&(0x7f0000000580)=""/5, 0x5}, {&(0x7f00000005c0)=""/64, 0x40}, {&(0x7f0000000600)=""/30, 0x1e}, {&(0x7f0000000640)=""/59, 0x3b}, {&(0x7f0000000680)=""/91, 0x5b}], 0x9, 0xf0, 0x3) bind$inet(r5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) connect$inet(r5, &(0x7f0000000280)={0x2, 0x4, @remote}, 0x10) sendmmsg$inet(r5, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) 2m38.225853261s ago: executing program 0 (id=2964): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000ffdbdf25010000004c0002803c00018008000100040000000800010002000000080001000600000008000100070000000800010006000000080001000700000008000100080000000c000180"], 0x70}, 0x1, 0x0, 0x0, 0x40005}, 0x40) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="1801000030"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x4) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./bus\x00', 0x11d) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1a2) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x1009088, &(0x7f0000000000)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200004, 0x200004, 0x3}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xa, &(0x7f0000000000)=0x8, 0x4) sendmsg$NL80211_CMD_SET_MAC_ACL(0xffffffffffffffff, 0x0, 0x1) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20041090}, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0x38) 2m34.973803574s ago: executing program 0 (id=2969): socket$inet6(0xa, 0x3, 0x800101) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, 0x0, 0x2b) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) ioctl$EVIOCRMFF(r1, 0x550c, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = socket$netlink(0x10, 0x3, 0x15) getsockname$netlink(r3, &(0x7f0000000000), &(0x7f0000000140)=0xc) sendmmsg(r2, &(0x7f0000000180), 0x4000190, 0xc03e) 2m34.610199689s ago: executing program 0 (id=2971): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0xa, 0x40000000088}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x20, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000ea8f0000000000000500000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000100b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x67a021c03d2005e9, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r5, 0x0, 0x2d, 0x0, @void}, 0x10) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast1, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) writev(r3, &(0x7f0000002a00)=[{&(0x7f0000001880)="fd", 0x1}], 0x1) 2m33.081805836s ago: executing program 0 (id=2975): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1c0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/kmsg\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0xefd, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0xfffffffd, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) r4 = socket(0x1, 0x1, 0x0) ioctl$sock_ifreq(r4, 0x89f2, &(0x7f0000000040)={'bond0\x00', @ifru_names='bond_slave_1\x00'}) io_uring_enter(r0, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 2m32.981519244s ago: executing program 0 (id=2976): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='proc/sys/net/ipv4/conf/default/forwarding\x00', 0x1, 0xb0) write(r1, &(0x7f0000000280)='1', 0x1) fcntl$getownex(r0, 0x10, &(0x7f0000000340)={0x0, 0x0}) sched_setattr(r2, &(0x7f00000003c0)={0x38, 0x5, 0x10000004, 0x7, 0xfff, 0x6d, 0x3, 0x26, 0x6, 0x101}, 0x0) socket$netlink(0x10, 0x3, 0x9) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) ioctl$SNDCTL_DSP_GETBLKSIZE(r3, 0xc0045004, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) io_uring_setup(0x3274, &(0x7f0000000200)={0x0, 0xc685, 0x14, 0x3, 0x10000002, 0x0, r1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 2m29.462863924s ago: executing program 40 (id=2947): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) (async) socket(0x10, 0x3, 0x0) (async) signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x1003ffffffc]}, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_route(0x10, 0x3, 0x0) (async) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mountinfo\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0xc0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = dup(r2) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYRES8=r0]) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) r4 = syz_open_dev$sg(&(0x7f0000000140), 0xa, 0x28102) ioctl$SG_GET_SG_TABLESIZE(r4, 0x227f, &(0x7f0000000080)) (async) writev(r4, &(0x7f0000000340)=[{&(0x7f0000000100)="717a7c4c2ff921a9e69795dfa20a1622a05cac4a60986f0470ea0f91121fc2006729efcf075abb3df497cf0fdbd0799da52dfe9f8e5baeb243238aaf4ce0c0b1a555510affd1726405797def561ab980f4735b0782c3ae0235d16aba9c8f2dff24b78f7c0ea58d77f0398c552171e2499f75eb9c39673e845789c92bcabc2c65d12d0e6afc024dbc8bba71442b975332c41af65eef20492c2ec34e086b981012f42198cf7e66437a5ebf29888a1d9d5a2d809e6d9ed387ad37fa1b99e36027ca2d17995a59b9ae50cc00fe32578deba6ce402e725657d397199b876cfcb19aa7c722341251b246adf59fcbe0dbede230a6d708b294b8", 0xf6}, {&(0x7f0000000200)="bec4a56f4c40d9b3bada0dc0af3abd2c6f77c6f08af3484bb511b14faece61153a1c15afebec22a883d8108afe819fa342850b40b61926c6bcba1eab310af8d90ddb4cc8e340ea3802b44a8f0436efaadcb1d04103419fa46eef992da441df017b4cde1b4d7c6cfb6cf9101e4ab1ff27a1eb190e71c8bcc247cd117f43dece3e59679aac0100defa4e02af7ee3322eac85067981ef220d74e1c7c69fa458381118d33781c8437aa7ae8c8a2c9b843e6178f1def5efc52343b7a87e182c4896d4", 0xc0}, {&(0x7f00000002c0)="f3f4ada5906009e1e17beb29991a7c936a4400d8b94bca74b854968509e6a5e3e6712c5f22048aab9195f1", 0x2b}], 0x3) (async) r5 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0x2c, &(0x7f0000000300)={0x0, 0x1, 0x3}) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000380)={0xfffffffc}, 0x4) (async) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r6, 0x40045612, 0x0) (async) ioctl$vim2m_VIDIOC_G_FMT(r6, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x7, 0x4, 0x9, 0x4}, 0x2, 0x401a, &(0x7f00000021c0)={{0x6, 0x2, 0x5, 0x40}}, 0x3317, 0x0, 0x8}}) (async) mq_timedsend(r5, 0x0, 0x0, 0x0, 0x0) (async) mq_timedsend(r5, 0x0, 0x0, 0xa, 0x0) 2m17.730274974s ago: executing program 41 (id=2976): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='proc/sys/net/ipv4/conf/default/forwarding\x00', 0x1, 0xb0) write(r1, &(0x7f0000000280)='1', 0x1) fcntl$getownex(r0, 0x10, &(0x7f0000000340)={0x0, 0x0}) sched_setattr(r2, &(0x7f00000003c0)={0x38, 0x5, 0x10000004, 0x7, 0xfff, 0x6d, 0x3, 0x26, 0x6, 0x101}, 0x0) socket$netlink(0x10, 0x3, 0x9) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) ioctl$SNDCTL_DSP_GETBLKSIZE(r3, 0xc0045004, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) io_uring_setup(0x3274, &(0x7f0000000200)={0x0, 0xc685, 0x14, 0x3, 0x10000002, 0x0, r1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 1m46.730760718s ago: executing program 9 (id=3070): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r1) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x2c, r2, 0x601, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0xa}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x2c}}, 0x0) (fail_nth: 5) 1m45.241482169s ago: executing program 9 (id=3075): socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x80042, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x40047438, &(0x7f0000000180)=""/246) mprotect(&(0x7f0000001000/0x400000)=nil, 0x400000, 0x4) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2400, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x403, 0x2, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_HASH_MAX={0x8, 0x1b, 0xfffffffb}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x8044) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0f000000040000000800000001"], 0x50) close(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x3ff}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0xe, 0xe, &(0x7f0000001440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000001800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x6}, 0x94) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000240)) syz_usb_connect(0x3, 0x39, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0xfce1) 1m43.433553329s ago: executing program 9 (id=3079): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x11e) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) fspick(0xffffffffffffffff, &(0x7f00000000c0)='.\x00', 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000640)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54, 0x4, 0x73}, 0x9c) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x2b, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpgrp(0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) 1m39.900814517s ago: executing program 9 (id=3084): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r1, &(0x7f0000001c00)={&(0x7f0000000140)={0xa, 0xa, 0x7, @mcast2, 0x1000000}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000100)="671723d7c6012c", 0x7}, {&(0x7f0000000180)="9e91d91a92dc7c8f06c24fbe79d9284d0c66c92c658bb539e2ffb332c99223a7df", 0x21}], 0x2}, 0x20008b88) 1m39.521925743s ago: executing program 9 (id=3085): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs(0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) mkdir(0x0, 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x101, 0x0) writev(r1, &(0x7f0000000540), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='1\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv6/conf/default/forwarding\x00', 0x1, 0x0) write(r3, &(0x7f0000000200)='1\x00', 0x1) syz_emit_ethernet(0x50, &(0x7f0000000880)=ANY=[@ANYBLOB="0180c200c100aaaaaaaaaa3afffe880000000000000000000000000001fe80000000000000000000000000000000904a1df30000fb080b980473da00037800000069dce72799ee"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r5 = syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0xb4) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000005c0)=r5, 0x12) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080), 0xc) 1m34.229969071s ago: executing program 9 (id=3092): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0xfd8e, 0x5}) r0 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$video4linux(0x0, 0x4b, 0x20080) tkill(r0, 0x13) waitid(0x1, r0, 0x0, 0x2, 0x0) waitid(0x0, r0, 0x0, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) socket$kcm(0x1e, 0x5, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000100002020207b1af8ff00000000bf86a26db8000000070100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7b}]}, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000d40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000000000000000000000000085000000500000001801000020696c2500000000002020207b1af8ff00000000bfa1000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount(0x0, 0x0, 0x0, 0x0, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0xe) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0400000004000000040000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000005391ba13b34073703e0abe9c06000000000000000000"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="18120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000008000023bfa400000000000007040000f8ffffffb705000008000000850000001900000095"], &(0x7f00000002c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x0, 0xe, 0x0, &(0x7f0000000500)="11223344556677889900aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m18.079288855s ago: executing program 42 (id=3092): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0xfd8e, 0x5}) r0 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$video4linux(0x0, 0x4b, 0x20080) tkill(r0, 0x13) waitid(0x1, r0, 0x0, 0x2, 0x0) waitid(0x0, r0, 0x0, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) socket$kcm(0x1e, 0x5, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000100002020207b1af8ff00000000bf86a26db8000000070100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7b}]}, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000d40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000000000000000000000000085000000500000001801000020696c2500000000002020207b1af8ff00000000bfa1000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount(0x0, 0x0, 0x0, 0x0, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0xe) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0400000004000000040000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000005391ba13b34073703e0abe9c06000000000000000000"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="18120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000008000023bfa400000000000007040000f8ffffffb705000008000000850000001900000095"], &(0x7f00000002c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x0, 0xe, 0x0, &(0x7f0000000500)="11223344556677889900aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 11.119722016s ago: executing program 4 (id=3258): getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r0, 0x4, 0x20, 0x100000000, 0x5}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffd}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x62], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000000380)={0xa, 0x14e24, 0x0, @loopback}, 0x1c) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r5, &(0x7f00000092c0), 0x4ff, 0xbb8) 9.798104782s ago: executing program 4 (id=3260): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='proc/sys/net/ipv4/conf/default/forwarding\x00', 0x1, 0xb0) fcntl$getownex(r0, 0x10, &(0x7f0000000340)={0x0, 0x0}) sched_setattr(r2, &(0x7f00000003c0)={0x38, 0x5, 0x10000004, 0x7, 0xfff, 0x6d, 0x3, 0x26, 0x6, 0x101}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x20, 0x5, 0x2, 0xfffff038}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10) socket$netlink(0x10, 0x3, 0x9) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) ioctl$SNDCTL_DSP_GETBLKSIZE(r3, 0xc0045004, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) io_uring_setup(0x3274, &(0x7f0000000200)={0x0, 0xc685, 0x14, 0x3, 0x10000002, 0x0, r1}) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCSETSF2(r5, 0x402c542d, &(0x7f0000000040)={0x9, 0x7, 0x66e7, 0xfff, 0x7, "8c0dc77e87de5ff6eb07c5109a38666f222caf", 0x5988, 0x1}) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7ffff000, 0xd) 8.694738847s ago: executing program 3 (id=3262): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, 0x0, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8b07, &(0x7f0000000240)={'wlan1\x00', @random="8dffffffebff"}) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) syz_ublk_setup_queues(r8, r6, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 8.348104221s ago: executing program 4 (id=3264): openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="1f003300d0000000080211000001080211000000505050505050"], 0x3c}, 0x1, 0x0, 0x0, 0x2400c881}, 0x2040000) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlockall(0x2) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f00000001c0)=@assoc_value, &(0x7f0000000280)=0x8) r4 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) mlockall(0x7) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @broadcast}, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x8000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000), 0x20000328) shmctl$SHM_LOCK(r4, 0xb) shmat(r4, &(0x7f0000103000/0x4000)=nil, 0x7000) shmctl$SHM_UNLOCK(r4, 0xc) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) read$FUSE(r6, &(0x7f0000003380)={0x2020}, 0x2020) 7.354862697s ago: executing program 5 (id=3266): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000380)={0xa, 0x14e24, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) 7.254865974s ago: executing program 3 (id=3267): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet(0x2, 0x5, 0x9) setsockopt$inet_buf(r0, 0x0, 0x2c, &(0x7f0000000000)="1dc577b5af4a180f2ef97031612900", 0xf) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c000000020601080000000000000000000000001400078008000840000000000800174000000004050005000a000000050001000700000005000400000000000900020073513d31000000000d0003006c6973743a736574"], 0x5c}, 0x1, 0x0, 0x0, 0x20004000}, 0x4008114) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000340)=ANY=[], 0x60}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000100)='adfs\x00', 0x2000010, 0x0) sendto$inet6(r2, &(0x7f0000000100)='X', 0x1, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000001c0)={0x0, 0xfc00, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x4, 0x6, 0x5, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x58010}, 0x800) 7.059459229s ago: executing program 5 (id=3268): pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141b42, 0x8) splice(r0, 0x0, r2, 0x0, 0x402000784853bb, 0x0) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000004) r3 = io_uring_setup(0x17ce, &(0x7f0000000140)={0x0, 0x52c0, 0x2, 0xfffffffe, 0x31d}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000001c0)='local_lock\x00', &(0x7f0000000200)='all\x00', 0x0) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000040)={0x10001, 0xc}, 0x8) shutdown(r4, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000200)="d80000001e0081054e81f782db020000001d080006007c09e8fe08a104000e000a00142603600e1208000fc01e000406a80016c008000e400400027c035c0461c1967f6f94007134cff6d26efb8000a0ffa290457f01895416277ce06bba0000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d25ccca95c9757c01deeb12c0e440f57d6cf23b1900360db7e5167fda40fad956d809d5e12a9ecbee5de6ccd40dd6e4edef3d93452a92950b0000000000000023f9a941000000000000000000007d59ef7e1359485303f720a1ed469c778f", 0xd8}], 0x1}, 0x804) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x4, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b704000006000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001bc0)={r8, 0x2f000000, 0x138, 0x4c, &(0x7f0000001cc0)="633268f83ca3000000a2029e3815bb2fa117d8326687688b2c969fd7267d546214af00d1ca2524d00f9e4d9555f3ab381b5d44fd6bda8c509e66101d296f10c805252e7c5d48d9814f46db8f07441878734b13270fe47fba418b7358984b9a61c2bbf964a520459fd0d90590b46cf1677d580a26933b6e35aee75996b73a15a25aa8ae2f1f9bc9699a505c0dc4050ab2255fc35f508ccc52f10ac12febf28652fe36f725714868675ca2a7042ab4b26904b2f000589694f69ab0b22a5aec72c5036ce1c8974690045e4ab412a70336b4c65b2dfc8121af4143c2e10a0e5632bcd44e0b000029da424d86f298656822dae2c002e289fbfa6fe0dfb2fd57713a7684dc166c628dc45027ac174c5db54f22e409eb4e94263dbc9919f90f1af3290918b9824c3e0268b300bf69cc2eb3fc58f655439bdbe2b905", &(0x7f0000001c40)=""/76, 0x4000, 0x0, 0x47, 0x50, &(0x7f0000001ac0)="9c01bd6f9a6028c80d7364240fd78867d9d62eca43c565f2c5ac65dd4a0fadceb6c65dcb07f2421e69087e0f17b4eb709e4805f2722709c46bef17c4cb9aed9fb1c342179ea349", &(0x7f0000001a40)="408fd0050dc7945b483103067eca9bd26ffbe35abf0f88a103f6893dc2b1d1cdc2195d4ae89abc04ff5fe5d2466892c81015df835a7d47be4f852161bc4015e7564b08584290fe1762f943a653008ac5", 0x1, 0x8000000, 0x13}, 0x22) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0xffffffffffffff8e, &(0x7f0000000740)=[{&(0x7f0000000040)="d80000001c0081030081f782db44b904021d080201000000040000a118000c000600141a62600e1208000f0100810401a8001600200001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x4001) r9 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r9, &(0x7f0000000040)=ANY=[], 0xfe33) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000000040)='d', 0x1}], 0x1, 0xf) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000080)=0x0) sendmsg$sock(r4, &(0x7f0000000640)={&(0x7f00000000c0)=@nfc={0x27, r10, 0x0, 0x3}, 0x80, &(0x7f0000000500)=[{&(0x7f00000002c0)="6ee88ecb0586e97618e7f86e2d35feda4f84c7b3a4eb43033ec9652e37c0de9c48d3a4e40c6ec9c83ba1ee73805055d59e571f5f13f9d9941fc453ec75eaa210005f1bfcb0667d9247804105683a7d926aed7c0f346d777880d002464c953ace49fade22b1018cfc6e671fd5c0bc76aebcfd7466adbf281ba6a37898b37ae12d2efaf38f4f431b4eea08fd666f0322e25c5b0b2b71b6a20e1f155e464ca09c5b06f8bf2a7466d308dca196569c04ae2fc85446f6bd003758b3f24a4ec72cd72af9ddd2d01ee9da21", 0xc8}, {&(0x7f00000003c0)="c4cf885dc69b01b015e029fc19fea6194e5457598ed1f86087d8ec3fb20f420a6e9b9ca7b78000518f5efda00268785fb3ce22680b22f7e6f4c9308ce51c7c6c02f5d9b6c59f8e85951dd3265c80a0152679df9b8b00000000000000", 0x5c}, {&(0x7f0000000440)="08f35fec7664cc19ad08a44fbb8890cc030d667e483d6c5412b00d76263cd40fddf86fd754edd44c206ea08c5b9c0410f99b11c3769a78c41e8a1339d2149bc7b5ea01675b205c13044b14ef3492f60a5ff4c0c21c0f9d941407b459e186ac14eedb539cc3a222330cf66ea45983f73943ef425a02a272b834abe64edfe461b741376413a00c060c45b9173b1ca02de4d5eb8a99550b571e95", 0x99}], 0x3, &(0x7f0000000540)=[@timestamping={{0x14, 0x1, 0x25, 0x9}}, @mark={{0x14, 0x1, 0x24, 0xfffffffa}}, @mark={{0x14, 0x1, 0x24, 0x81}}, @mark={{0x14, 0x1, 0x24, 0x2}}, @mark={{0x14, 0x1, 0x24, 0x40}}, @timestamping={{0x14, 0x1, 0x25, 0x69e}}, @txtime={{0x18}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @mark={{0x14, 0x1, 0x24, 0x8000}}], 0xd8}, 0x2000004) 6.806634815s ago: executing program 4 (id=3270): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0xa01}, @val={0x1, 0x80, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x13, {[@window={0x9, 0x3}, @timestamp={0x5, 0xa, 0x1008}, @generic={0x22, 0x8, "d58838000391"}]}}}}}}, 0x4e) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000003bc0)={0x64, 0x19, 0x1, 0x40000, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x50, 0x11, 0x0, 0x1, [@nested={0x4c, 0x31, 0x0, 0x1, [@generic="c40be4f2edb5020cac4b1336", @nested={0x3c, 0xc8, 0x0, 0x1, [@nested={0x4, 0xc3}, @typed={0x9, 0x61, 0x0, 0x0, @str='hash\x00'}, @typed={0x14, 0x91, 0x0, 0x0, @ipv6=@local}, @nested={0x4, 0x124}, @typed={0xd, 0x48, 0x0, 0x0, @binary="a1f7c32dbcf2cba90f"}]}]}]}]}, 0x64}}, 0x0) syz_emit_vhci(&(0x7f00000001c0)=ANY=[@ANYRESDEC=r0, @ANYRESDEC=r0, @ANYRESHEX], 0x7) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x2, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x2}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x80c1}, 0x0) ioctl$OCFS2_IOC_GROUP_EXTEND(r2, 0x40046f01, &(0x7f0000000180)=0x5) r3 = openat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x440002, 0x1d4, 0x8}, 0x18) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000100)=0x10008, 0x4) 6.506930541s ago: executing program 5 (id=3271): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'ip6_vti0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x40}, @remote, @remote, 0x3, 0x2, 0x5, 0x0, 0xb7, 0xc20020, r2}) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x4, [@enum={0x6, 0x2, 0x0, 0x6, 0x4, [{0x3, 0x1}, {0x1, 0x9}]}]}, {0x0, [0x2e, 0x2e]}}, &(0x7f0000000240)=""/237, 0x38, 0xed, 0x1, 0x30a4}, 0x28) r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000004c0), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x8, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8001}, [@map_idx={0x18, 0xa, 0x5, 0x0, 0x7}, @jmp={0x5, 0x1, 0xa, 0x6, 0xa, 0x50, 0x10}, @initr0={0x18, 0x0, 0x0, 0x0, 0xf361, 0x0, 0x0, 0x0, 0x40000000}]}, &(0x7f00000000c0)='syzkaller\x00', 0x8000, 0x24, &(0x7f0000000100)=""/36, 0x41000, 0x1e, '\x00', r2, @cgroup_skb=0x1, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x3, 0x0, 0x9, 0xfffffffc}, 0x10, 0x0, r4, 0x7, 0x0, &(0x7f0000000500)=[{0x4, 0x4, 0xc, 0xa}, {0x2, 0x2, 0x7, 0x1}, {0x0, 0x4, 0x0, 0x6}, {0x0, 0x5, 0x7, 0x5}, {0x2, 0x1, 0x1, 0x6}, {0x4, 0x1, 0xd, 0x6}, {0x5, 0x2, 0x7, 0xa}], 0x10, 0xe}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) 6.285396103s ago: executing program 8 (id=3272): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x107e02) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000040)=""/59) r1 = syz_clone(0x20040000, &(0x7f0000000080)="e056703746faf5ebe74606b7b0ac5a07cdb21de9a349e4aab847db4da92676fc5bdc57e1f116967c62c39e11197d036f422eda9325b9715548928f116816ae4f", 0x40, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="2f7379de4ed26bce42c690d508bca303fe42c37bffbcbf761fbb2e47c4") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{0x304}, "a80d77436826cf99", "57c7fa419642297b634ab8ac9ddd0264", "4fd3deb1", "772f0ef68a182f1a"}, 0x28) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@private}, 0x0, @in=@dev}}, &(0x7f00000002c0)=0xe8) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) r6 = geteuid() read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f00000023c0)={{0x2, r3, r5, r6, r7, 0x158, 0x8}, 0x7, 0xde94, 0x8, 0x4, r1, r1, 0xc9dd}) quotactl$Q_QUOTAON(0xffffffff80000202, &(0x7f0000002440)=@loop={'/dev/loop', 0x0}, r4, &(0x7f0000002480)='./file0\x00') ioctl$XFS_IOC_FSGETXATTRA(r2, 0x801c582d, &(0x7f00000024c0)) r8 = openat$audio1(0xffffffffffffff9c, &(0x7f0000002500), 0x2, 0x0) open_by_handle_at(r8, &(0x7f0000002540)=@FILEID_NILFS_WITHOUT_PARENT={0x20, 0x61, {0x3a58, 0x8, 0x5, 0xf, 0x2}}, 0x30202) r9 = fcntl$dupfd(r0, 0x406, r0) ioctl$LOOP_SET_BLOCK_SIZE(r9, 0x4c09, 0x4) ioctl$PTP_EXTTS_REQUEST2(r9, 0x40103d0b, &(0x7f0000002580)={0x4, 0x1}) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r9, 0x8982, &(0x7f00000025c0)) landlock_create_ruleset(&(0x7f0000002600)={0x0, 0x2, 0x1, 0x800, 0x8}, 0x30, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000002640)='./file0\x00', 0x1a5802, 0x0) socket$can_raw(0x1d, 0x3, 0x1) ioctl$TIOCL_SETSEL(r9, 0x541c, &(0x7f0000002680)={0x2, {0x2, 0x4, 0x9, 0x4200, 0x7ff, 0x11}}) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000002700), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r9, &(0x7f00000027c0)={&(0x7f00000026c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002780)={&(0x7f0000002740)={0x2c, r10, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x8) getpid() getsockopt$packet_buf(r9, 0x107, 0x16, &(0x7f0000002800)=""/115, &(0x7f0000002880)=0x73) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r9, 0x84, 0x7c, &(0x7f00000028c0)={0x0, 0x72, 0x7}, &(0x7f0000002900)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r9, 0x84, 0x1, &(0x7f0000002940)={r11, 0x2, 0x2, 0xc1c1, 0x1, 0xffff}, 0x14) r12 = openat$mice(0xffffffffffffff9c, &(0x7f0000002980), 0x8400) sendto$inet6(r12, &(0x7f00000029c0)="2784d84b06d7771af5f1721c367ed7000fe1bde88f97488f9cc131c08014077319689f64acf53a90e6353bfaa2023f928425a0a9c94e43ad9b80bc4c6faed662af3068eff21c141840ce7bcbd654d88536fbcac273922df5267cf9bde23a0ddc397ce2792b7719b78984668612d3a31530a3", 0x72, 0x0, &(0x7f0000002a40)={0xa, 0x4e21, 0x9, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xb}, 0x1c) 6.199114312s ago: executing program 3 (id=3273): socket$inet6(0xa, 0x3, 0x800101) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x23, 0x0, 0x2b) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$netlink(0x10, 0x3, 0x15) sendmmsg(r1, &(0x7f0000000180), 0x4000190, 0xc03e) 6.11103435s ago: executing program 5 (id=3274): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000002000)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000500)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r1, &(0x7f0000000f80)=""/4096, 0x1000) openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/module/ueagle_atm/parameters/altsetting\x00', 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') read$FUSE(r2, 0x0, 0xeffd) ftruncate(r0, 0x8008976) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @private1={0xfc, 0x1, '\x00', 0x1}}}}, 0x32) sendmmsg(r5, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) r6 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="18"], 0x18}], 0x1, 0x0) recvmsg(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xe, &(0x7f0000002640)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f2ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000052000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d6200100000000000000ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a0932f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c43ff010000000000000128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee99367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57d31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e4a9f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10}, 0x94) 5.8859609s ago: executing program 4 (id=3275): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, 0x0, &(0x7f0000000080)) r1 = socket(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x2) sendmsg$NL80211_CMD_DEL_PMKSA(r1, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x24004001) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) ioctl$sock_SIOCDELRT(r3, 0x890c, &(0x7f0000000480)={0x0, @vsock={0x28, 0x0, 0x2710}, @l2={0x1f, 0xfffb, @none, 0x8, 0x2}, @ethernet={0x6, @broadcast}, 0x65, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000440)='bridge_slave_1\x00', 0xc, 0x5, 0x9}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0xfffffffe, 0x8}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4005}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtfilter={0x68, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff1, 0x4}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34}]}}]}, 0x68}}, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000001340)) syz_usb_connect(0x6, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000180)=0x6f) r6 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) read$dsp(r6, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(r5, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xfff2, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0xffff, 0xb}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x24, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x3}, @TCA_CODEL_ECN={0x8, 0x4, 0x1}, @TCA_CODEL_TARGET={0x8, 0x1, 0x2}, @TCA_CODEL_TARGET={0x8, 0x1, 0x9}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0xc890) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$packet(0x11, 0x3, 0x300) 5.549563963s ago: executing program 8 (id=3276): syz_open_dev$dri(0x0, 0x1, 0xc0400) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x840}, 0x84) r0 = open(&(0x7f0000000140)='.\x00', 0x0, 0x112) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r1, &(0x7f0000000080)={'#! ', './file0'}, 0xb) close(r1) write$6lowpan_control(r0, &(0x7f0000000200)='connect aa:aa:aa:aa:aa:10 1', 0x1b) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x73, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x1f, &(0x7f0000000480)=@raw=[@btf_id={0x18, 0xb, 0x3, 0x0, 0x2}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffd}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x6}, @cb_func={0x18, 0xe, 0x4, 0x0, 0x3}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @map_fd={0x18, 0x4, 0x1, 0x0, r2}, @exit], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x7, 0x6, 0x9, 0x0, 0xffffffffffffffff, 0x100}, 0x50) pipe2$watch_queue(&(0x7f00000000c0), 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) timer_create(0x0, &(0x7f0000001980)={0x0, 0x24, 0x1, @thr={&(0x7f0000000880)="2b4c89a18766e782cc87573da42d65ac848912e6c5a2e266855869e13b7133e43fcc18a65a6604769590355a91736c26e5062c54e2ac823e0f28a87e919ef4d4fa178c5d983f763aab977fb36b0c5028e7f59ad96aa3d19a049d986f6168141dd16a143e9b16ce5172d52d701c2aa11d6a7a262a5c5d458287e5792e7f6c5cbb1a4241ef7b43fb773b601846669c052f48a9b6e148078d7a27964f076de4e1bcb0ee2aca42f507cd77231c76325dcfda7363ac7eebdb5c1f47a43d0a27661b0eaa48bced2f88ee3c87a75d2a49757ff59b45f4eaf61423542ffb1eb8d23a9702a8e3657923df049905000f9178d96f3d1a6a8273662a86a66a709fd225b581a7076b11e96675386f27153a34568b3fa1b9a73da99061563e94c22463c1f4e71715ff5b69e2b74794a33ea75d17b583a067f419b7c86d26b86fa083d8325b1d2c0ba3a7abb7372652fc9eaca67e665c56ebe8699be9a9fbac7ed24bf22b0781d9d9d9c1d1e2e2c257f7fe0321b81164fdfc4214fd42d72e91071a5332f644b25377ed4a39fe2e49b9fe12ff8c3658c61dcb632174247d7837e0c822653c310db2b5679150651c0b9fa1485cbde474da11fb2c0a09344414967c65892c363eb21c14a117dbe9b0393a3916fd73d02a19c9d408196a0ba8571d9c68485f77db7a4055e82240101eb03310e9a03377ae96471ee459e7ab365e53e0f64a390bd4b1bb175fb99509087fbff331f6ae925ef84579acb6876e4ff4003ad10f77967bad54943a2f9248c67a12dfdbf0163d50a9444ba27714362adae27c6ebfce26950001e78c13ce34b80c6ae4a9d5bb6c5f5c0db0e1a13221016e6711c18cb062a38688a2748af001d02bc833d60fef1f91b30662ecbf8673c44948b060e03e92ecf6a4c915e96f64474ec3213c75e4a5626a975aa3412ce6816c59e1a790912a2b2dc13457c0bab39ab823ce5f7c8d728d59f4a75040fcf337b6103d3ab8be25f891ac7b106aa61f0295876ba9d5a556d75b1c963acc74392f33c11fb2457cdf2ce5330b16f794ad061f937db4aeaefc7c0bc2e90bc96b479e99d7c960f00e18586b473549ae9bdcb203d677fd6c7d97daaf241ec4dea5716528c763303c1e14ad6da28d3599e5105d8c7ca797fc58ed16704899892425a76c1aa90dfd94c251d4525127b01c9af33ac3dfe28b0038a796d31b6b69ff7af8bb5e76db847bfb70ee066379c1cb08a75971957d4cf6e33ca2454030e01e1b52580ec08a5839d1e407a9c905be55a13eba58ed8657bef7f3168c5d98e3ccb1dc8a00be64a515a840c28e763b014ef8640cd469f88e4d0ff7878118aa9df3a963af4736f51952a795f36733ce692123deb68fae0f405b71cf8af68dee900ead7e4d949da2bedccbea092bd20ae174cba282e931d31f3e7bd5a649b1962c8a1b12253dff5ba01aebe0092ec0297b5c2f87533e3b20261dd582f26a67734052e3dff148803c002aa2bb4af6c3c636a0c756aaa061dd60a30d482d7642aba6a0a48d687a28e5eff773346756c631bcca3544589f2b93ae300b71e71c71358197c7d0528ea4d52dc50b0c5951ea7b25ff0882787b51a8d1320e5a6933800f2f4839579c59ab678cc48c5eeaf6da7a5f7367e1cc6aed9c7a6e77228d4bf46c7cd28ccc199dd45b4626e58df41773e9acb10169e8f5e4683a6081079cd03e57dd3470fad274e62a843fafb37e10248d348ef57a8f787b0c0509723849f9ca1f8def95e727fe3f0fef7fee5dc62ebfa2d70072f5cc11b6da17a3812e54a186764c0e5a4d0fdbcad863b169a602677d0957e63eb6ca490b5fd82e8c793afed6116a774f663e637b75d8e442cd149fe677dee771e67579b42a11a6817a17678dfe93aad9f7896bc01323dd83392d618258a23b4eaaadfbf7dc939ef3f03f2940d2fb2812d4de30698b83bc4963dc2e51bae41d747ad42905a242ab5ce6bb7e6faf5aca706eaa3fde81e5ef47bbc70bc0b6a8145996e318014363e5b2a2cf3390649f851ad4fc7678eb303dc04b74df73a48817c5c78ff880605b7ece7b601083dde926aabdc85fd069e335d16f0e00490022e6dbca6b68f13321677b52f8be4005ac50e04d895002d346d6ee79e113fe88752f2d503f148597cde77304e924c7a36f89dcfdf58a765cefbfe344bccadd88c54572672178d3592573a9f0281a111bfc004aedfd013e25b17fc37fe06ecc3f328d5605f5ec73bbd149b4cdc3a18e77858b65bf7a131b7306dd908aa6ea716f725e4c5ce0bb3edf529fb22983dff7aee3be4d74e7ac5797f77f7efc1f0053bc2e2ab0651219508fa8593f3bcd43a2920dc7fd65c2556606cce567a7dd7f44a54f22201a0e0b1c3f25f23775320ab766574ca1c1110cfdf13ad71a19f995644d2ed4c972732709261c3baea767e614f43c50e8185534ceae26668b28cc4b8ca8dcf2a922381908a29bf28f3aa38f0f79495c3d782416d07df8adc66548d3399f781332adb877ec7d42bdf87cc5d67f7b5a02fb46ed1470cbbeb374681b5d0e745571f2c5f2daf2b0bc71c78014fb22babc363f45db08a35898d52627004da746a9f17bda66780d442e23b80c79ab8d592fc8757e0435fc633bbfa67afc83446577f78132d031ed3316870ce42c2c60bd7dcdab5c38ab93a291bb45b49101e84f95217418bdf30c2fc583f9b8faf611bd337d91eec98d8e2973eb2653dbb3ba807a7fad72df777f78ac4d607e0e6b7ed74f2819a986ce1f3f1da82b65d6b46259a1a5f74ebc08e9918f2ec859433a675f7540a8a7a2ddb28de2659f8bd6b9a1f911b0cabc425bd61159834c47a63bfae6724c605461179bed92e2ad57466345b88da2f3219126593363aa509598d937d82492e72e2430621cbb02096d5b387b089320c98b3f6d74cb4a8c2ed5789f3af79aff2ebb25c343d6e68de1d5805efb44a09800abadcc3bc4bf13281fe640525397893f042a684c541a1d9d9a1f783303895d18b49289ccca4aaec4909ec426b3ef53f477bd478dddf3f9ccc9af09b52603f034cdd50c04b9163aac6ecfa31ce450e00f7119fc18beaf8903d926c736444b8a8387db3c495f7327b9e9f5692a400be03e2886fbea85553dd806687fdaf0369c85f965c5ae71decfd2af45ce634517ef19defb14a0e0110e2ae85a97f6968a26a5bbc1f36c5be622a16ccf784caec00e168d11a862a3f7c02a2ac6ebe1490892676f5f7e56c1dfca57e061fdca9c052f63042d8f17940b7dc44a2afc2765adee055b562e567f576aaa7154702cb7587b391fc00e1b9a32d5b4fa20054716e9432167d42d65dec876c8846490d744a1de1025c17d4a3372867870f21fe0ca67c936f77b16e68e11139962709ff48e0584a306c902558a7dbf16e0edac387b25e119e751b0f74a4eba79e1c5d1c4715c42350fd579649c8f3c62acbb77eac6d6cbba75ea274047e267957c84b420650dc00887bcd89f841f1aa2b56c39cfa2388d120f59742e000c62220432c93d57bde2f9bda4f968402d248464b12d1df8678c07d7d1084366640ac725de6c552a141b156f484f1ce0470d757c208af8c62d6e81f50490200ff1573f389545c33172223cee3e7fbe736a0b302e95c4576c42fc7e200d1620a6c2d4d70884925c9da65696a83809bc39e4f7f5802bf5693e6823387b7b9720751d7f1d5b361aebb9634a97837e701bf7c176cd0ee8aa4865e79500a14b1bb1adddc21b114a2af8055d4ff85b27de33a2911b81f59aeba787aecf0fe3733ecea017ab958f7f27a4d37b539d3eaa9587ddd72f8ffa3fc11664095cede3dc103e24afb75b49ed0ecb814f15cfe5de367b5b647f02b5f5b8b8a9c225759b1189a2ea32e3aa417993edbef62d04cf56e75121fad92bd10ee8ef4048f2afcecaa9b37e7bd9935408cd126dd877fe21d3eac6f2f067e4eeec14b1a0b497a2f1ac91af8f0701f66ae64bca04a66c9607f0ef16764cc95da8b76f36f9cef71ba1b3edf19d433dbb75fcf8096f5b5cdb7a34aef732b5edbc329f7b29e6c34b11579ca465a35b8663c5f977a32a4d7eb04923dd3a173648a9e4461863f44ccabaf702d531fac119572f0bb2474e944a992d3162afbd2ba20d460e718fa5f363aa4f897e5d8b0c3b8cd565c7a30002e8efd0f28fd80076cca6b594c63e8e179cbb716c107450549fb4f38a1705b8431a82af612644b0aa28284e68ced8324b860d4bfcc5c58d6ffee17254e946be2e662b3e9d67141faa49c398edb10f12a00f1456804e31a0dc74baf0a3d2594c837d0185482e4542badd864fcbf294e83993ece8481332a85a85e469a30d7abe60bc1f5ec94c16cfa9aab663a4b5ee0291b97bf07c1fef23d86ece9072f5c7f4dbc7b5c09b1b2d1ec2c8a16ca21af171fb6333ad8277155b3c7d129b9ef4a53d01d8bb5aa7b885adb0d102844ff13ed198ce74b5da43ec2b6e75803e290949d61689b8f877c0499c06f247ecf3631f894b136aa7445209729102aa91d86a0e35fb890ce25845b7418202bcb8cace050b233a636a671205f67f9327dccf8080a1d9af2039e2880835c722ae9c9ed37ced4d43bccdcb13d42273c53a737860d3368144e234292f6756a9f0f37c5efc70f58e3e4a9f7c6c072cca40d842bf92858a663d4ebfeb072c09cf6c6efab1b93763a87061dd958653f5fa1626745d9674e4fe0978cb1fc46e97275c3bda215cb73ce4d65730e86b3749b254eb2ff69273e42f9689d2d7cd41eafc0440dd78613510e68b967f694e9aa8f7551da939b588cae8f9850697486a05c3206bffb0509559d4a4c967eb56488caea63ce9d019f6e53d2ed665a4f1ba39f5cc1e38ae5f0317cd322b6ce5685e8dd9c16744e5fdd27be5268d9f553b84bf5f4e344a0c0251d1810de0a887bde813c7e6c7b5306ef8538ad3848748a22a3b3f28776ef53374cc6b93a6220f1483ca4f1e51ba4ee5211137e671ed2f7bd000c4800b48e40806c6992c936bb386ba739136c6584302fd72dd7d0e3c2f556c7df870f56c08fe209c2722afbbcf5f5780a9835ff911b7727a7d2b20c204da36fd1d23658f4236c9c06b0c547490e452dd9509cf90c3671ae5a30f14f597fc8ae29276ecd9e105a414f344ec0920086d1d5fb6f4e3afd2adb88de710deaeaf9154867ea5e89cce9ec15dd5e2cd1ac9f1c48ba8890f0d2a0ef615f30392b30226f237640ae19ebe1c889eb91e5284941492a7c45d902d7653dfdf83f3c687138620557a2d0a5fd76fcddf18d30f176a97c03c72e9d33eb23f52aa3d6788610c6b98e5ca6b16a76e3f9121fe885fca35ce99b1bf67a0783e098b55248b1ee358b089bc970b451d6e6e6c24a28eb53f39ed62026e12e4b3f33e0150a50eecb06ac83d764eee9027490d20ad41e8754f344cec10204dc5ec889ff94b475b9143d8951fa25720fdcc8ea4bfbe3af8ebd5d9fca9c35896def0156d4b054d407ea4f83afbce88852d8c335da823edaf91619e2854226ab8ac6b678f0b514203d8114c113d89ceb0a69de6355629eec5a66401a48b6badf2037f11b29ccbd5a1029288611920c682ab6bc467f3cc6d23ebfdeb4bd8462294017312a34c1e278bf520c67e1096e7a1d5f26386396a75025d1421bb7e76722467bfe7a157c7641f6a5881705ae1a8719923d40b13f773a453dea999193f21b33b309d547dbff8632d50856ec465cff815007c56d7bd8090718641e5894b23dbf143efe95493b242e4f1c4f84cb037b91ee604c5c00e314e96aa987e8f233d031eff209c97f432c8301779708b14888f42f96155", &(0x7f0000001880)="6a6ba6c6a2e43ef4116fe3eea0dca52f282866a6d9c02acfa07ae6f6dc067798b8f3045e6ccc3194e1c8308aa63b26322adee7ce1c21c517d7c1aa8c03b62d00fdd33769ccbac1e9c7c25e0f61b3824ab1c9809bffc2aed03c343949d11da81f4a32e6e466f622f056451386aa0a02e062bbe888cddd4f33fb7606182696900b31acfe8ee4dec68bcb51a8a01c14217a53b00ca57642fc1b5bc0355da9fe2daa3239344a46fb026bb77ec332ca2107fa065855049cd07e490252fa4d26f336dd4be8c164171588c35f268c535b355ab14618850c623b04782d3bc8b2bdc86c66c2594f888534be990af7d126576ffd75b9af"}}, &(0x7f00000019c0)) read$msr(r4, &(0x7f0000019680)=""/102387, 0x18ff3) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0x20000000}, {0x66, 0x0, 0x0, 0x256c6c64}}, [@printk={@ld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$alg(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000002380)={0x50, 0x0, 0x0, {0x7, 0x2d, 0x3, 0x200000, 0xfffa, 0x1000, 0x53d, 0x3, 0x0, 0x0, 0x80, 0x5}}, 0x50) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40800) recvmsg(0xffffffffffffffff, 0x0, 0x0) 5.117355071s ago: executing program 3 (id=3279): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='proc/sys/net/ipv4/conf/default/forwarding\x00', 0x1, 0xb0) write(r2, &(0x7f0000000280)='1', 0x1) fcntl$getownex(r0, 0x10, &(0x7f0000000340)={0x0, 0x0}) sched_setattr(r3, &(0x7f00000003c0)={0x38, 0x5, 0x10000004, 0x7, 0xfff, 0x6d, 0x3, 0x26, 0x6, 0x101}, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x20, 0x5, 0x2, 0xfffff038}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10) socket$netlink(0x10, 0x3, 0x9) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) ioctl$SNDCTL_DSP_GETBLKSIZE(r4, 0xc0045004, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) io_uring_setup(0x3274, &(0x7f0000000200)={0x0, 0xc685, 0x14, 0x3, 0x10000002, 0x0, r2}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 5.002204667s ago: executing program 8 (id=3280): dup(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) creat(&(0x7f0000000200)='./file0\x00', 0x109) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x24000000) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r2 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, 0x0) 4.961461993s ago: executing program 6 (id=3281): r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, &(0x7f00000004c0)={0x0, 0x3, 0x14, 0x3}, 0x8, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=@delchain={0x24, 0x66, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xf, 0x6}, {0xa, 0xfff1}, {0xc, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000881}, 0x49090) write$tun(r1, &(0x7f0000000180)={@void, @void, @llc={@snap={0x0, 0x71d7b3bbe23a0f9c, "3011", "c01344", 0x8809, "b46cc0d34f61b6afcbdd937a9c72790bbd5783557a6f1f0d9a1a7cd0ce61fd2df028961a4dd900f58d5da7f8439caddc2c82bf6eeeac37ba479e6326c797ebb90a85c64bba8dcff298436119ab4041029802caa6710c29175f05f119b9a51c7d07109c549a9cbf64030648d7ec902ac5f5ff3941ca36801d9ebea3844479f0d37174"}}}, 0x8b) ioctl$USBDEVFS_REAPURB(r0, 0x4004550d, &(0x7f0000001080)) 3.667327121s ago: executing program 5 (id=3282): mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000)='gfs2meta\x00', 0x8018, 0x0) 3.575347059s ago: executing program 3 (id=3283): r0 = memfd_create(0x0, 0x0) pwrite64(r0, 0x0, 0x0, 0x0) symlink(0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000, 0x0, &(0x7f00008b5000/0x1000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./debug\x00', &(0x7f0000000280)='debugfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r4, &(0x7f0000000340)="0200000000000038", 0x8) 3.393903956s ago: executing program 6 (id=3284): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getrlimit(0xb, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3f, 0x4, 0x0, 0xfffffffe}, 0x10) r4 = socket(0x1e, 0x4, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, 0x3, 0x2, 0x401, 0x0, 0x0, {0x3, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x1) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r3, &(0x7f0000003240), 0x4000000000000e4, 0x0) 3.376616882s ago: executing program 8 (id=3285): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x2900, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'rti800\x00', [0x140, 0x0, 0x9, 0x2, 0x10000007, 0x1, 0x7fff, 0x30000002, 0x7, 0xc72d, 0x0, 0x7, 0x3, 0x8, 0x29, 0x72f0, 0x101, 0x6, 0x6, 0x401, 0x4, 0x484, 0xa2d8, 0x9, 0x1000, 0x80000001, 0xa, 0x0, 0x383, 0x8001, 0x4]}) 3.312559957s ago: executing program 5 (id=3286): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, 0x0, &(0x7f0000000080)) r1 = socket(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x2) sendmsg$NL80211_CMD_DEL_PMKSA(r1, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x24004001) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) ioctl$sock_SIOCDELRT(r3, 0x890c, &(0x7f0000000480)={0x0, @vsock={0x28, 0x0, 0x2710}, @l2={0x1f, 0xfffb, @none, 0x8, 0x2}, @ethernet={0x6, @broadcast}, 0x65, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000440)='bridge_slave_1\x00', 0xc, 0x5, 0x9}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0xfffffffe, 0x8}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4005}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtfilter={0x68, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff1, 0x4}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34}]}}]}, 0x68}}, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000001340)) syz_usb_connect(0x6, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000180)=0x6f) r6 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) read$dsp(r6, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(r5, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffffff}, [@jmp={0x5, 0x0, 0xc, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f00000000c0)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xfff2, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0xffff, 0xb}, {0xffff, 0xe}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x24, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x3}, @TCA_CODEL_ECN={0x8, 0x4, 0x1}, @TCA_CODEL_TARGET={0x8, 0x1, 0x2}, @TCA_CODEL_TARGET={0x8, 0x1, 0x9}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0xc890) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$packet(0x11, 0x3, 0x300) 2.008791772s ago: executing program 6 (id=3287): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080)={0x1, 0xa, 0x4, 0x1, 0x4, 0x0, 0x0, 0x8, 0xba, 0x8, 0x0, 0x0, 0x0, 0x14}, 0xe) shutdown(r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() (async) r1 = getpid() socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r2) (async) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100), r2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000380)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_socket_connect_nvme_tcp() setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, 0x0, 0xffffffffffffff3d) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)}, &(0x7f0000000440)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000001c0)={r5, 0x2}, &(0x7f0000000340)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x0, [0x806f, 0x0, 0x2d5, 0x5, 0x6], [0x9d8, 0x5, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x3, 0xc3c, 0x3, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x4, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x1, 0x8, 0x8, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0x0, 0x4, 0x5, 0x8, 0x8000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0x14, 0x5bc, 0x36d, 0x7ffffffb, 0x4, 0x8000, 0xc9, 0x7, 0x2000006, 0x9, 0x82c, 0x7ff, 0xe000000000000, 0xe4, 0xf, 0x0, 0x8, 0x22, 0xffffffffffffffff, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x1, 0x0, 0x6, 0x6, 0xb, 0x100000002, 0x4, 0x4, 0x7, 0x7, 0x7, 0x8, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x100000003, 0x4, 0x7, 0x406, 0x3, 0x6, 0x2, 0x0, 0x3, 0x40, 0x7fffffff, 0x7, 0xe, 0x3]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r6 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x973, 0x4000, 0x0, 0x44a}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x2f) 2.006872866s ago: executing program 4 (id=3288): r0 = socket$nl_crypto(0x10, 0x3, 0x15) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0x12) syz_clone(0x800500, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x8040480) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$igmp6(0xa, 0x3, 0x2) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x2000, 0x10000004, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0xc0, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x800, 0x1, 0x0, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x1, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x81000fff, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400"], 0x7c}}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="e0000000100001002dbd7000fddbdf257874732874776f66697328"], 0xe0}, 0x1, 0x0, 0x0, 0x44}, 0x80) 1.886378545s ago: executing program 8 (id=3289): socket$inet6(0xa, 0x3, 0x800101) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x23, 0x0, 0x2b) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$netlink(0x10, 0x3, 0x15) sendmmsg(r1, &(0x7f0000000180), 0x4000190, 0xc03e) 1.361351152s ago: executing program 6 (id=3290): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x4, 0x2, 0x2, 0x0, {0xa, 0x4e23, 0x200, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x97}}}, 0x80, 0x0}, 0x200477e5) ioctl$SIOCSIFHWADDR(r0, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @random="030000000018"}) lseek(r0, 0x5, 0x3) setitimer(0x2, 0x0, 0x0) 1.069888516s ago: executing program 6 (id=3291): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000380)={0xa, 0x14e24, 0x0, @loopback}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) 786.26384ms ago: executing program 6 (id=3292): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='proc/sys/net/ipv4/conf/default/forwarding\x00', 0x1, 0xb0) write(r2, &(0x7f0000000280)='1', 0x1) fcntl$getownex(r0, 0x10, &(0x7f0000000340)={0x0, 0x0}) sched_setattr(r3, &(0x7f00000003c0)={0x38, 0x5, 0x10000004, 0x7, 0xfff, 0x6d, 0x3, 0x26, 0x6, 0x101}, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x20, 0x5, 0x2, 0xfffff038}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10) socket$netlink(0x10, 0x3, 0x9) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) ioctl$SNDCTL_DSP_GETBLKSIZE(r4, 0xc0045004, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) io_uring_setup(0x3274, &(0x7f0000000200)={0x0, 0xc685, 0x14, 0x3, 0x10000002, 0x0, r2}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 1.080569ms ago: executing program 3 (id=3293): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0x3}) ioctl$TIOCOUTQ(r0, 0x4bfb, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='coredump_filter\x00') write$cgroup_int(r2, &(0x7f0000000080)=0x7, 0x12) r3 = fanotify_init(0x10, 0x8000) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x42, 0x84) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) unlinkat(r2, &(0x7f0000000240)='./file0\x00', 0x0) write$sysctl(r5, &(0x7f0000000140)='1\x00', 0x2) fallocate(r4, 0x0, 0x1000000, 0x3) socket$rds(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r4, 0x0) dup(r1) clock_settime(0x0, &(0x7f0000000040)={0x77359400}) fanotify_mark(r3, 0x1, 0x8001033, r4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x1, 0x0) r7 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_int(r7, 0x29, 0x3, &(0x7f0000000280)=0x3, 0x4) pwritev2(r6, &(0x7f0000000980)=[{&(0x7f0000000340)="a8fc7b04bd136c6034ef8b52a07de93f4aae2bb70f8def645700d786be6bbd390d220c500382eaa77810676321558e9227902ac6be257070d6b540a1d33553433de13a00"/77, 0x6a45f49d603bce7a}], 0x1, 0x6, 0x203, 0x0) r8 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r8, &(0x7f0000001a40)=""/102392, 0x18ff8) sendmmsg$unix(r1, 0x0, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xc8, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 0s ago: executing program 8 (id=3294): sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="00082dbd7000fbd8df25"], 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0xa4) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x0, 'syzkaller0\x00', {0x102}, 0xd}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x48) pwrite64(r3, &(0x7f0000000140)="10", 0xda0443d9, 0xfff) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000180)="66baa000ecc744240011000000c7442402b16e0000ff2c2443f466baf80cb8f2c96789ef66bafc0c66ed0f072e0f01c248b820450000000000000f23d00f21f835000000010f23f8c46289900cabb9f9080000b8c93c0000ba000000000f30c4816857a601000000", 0x68}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000880)={0x1, 0x0, @pic={0x8, 0x7, 0x8, 0x3, 0x2, 0x1, 0xc5, 0x9, 0x28, 0x2, 0x1, 0x95, 0xb, 0x8, 0x7f, 0x7}}) ioctl$KVM_RUN(r2, 0xae80, 0x300) kernel console output (not intermixed with test programs): qe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 862.299914][T17760] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 862.357618][ T29] audit: type=1400 audit(1785710052.304:3137): avc: denied { write } for pid=17744 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 862.383838][T17763] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 862.391340][T17763] IPv6: NLM_F_CREATE should be set when creating new route [ 862.402342][T17763] IPv6: NLM_F_CREATE should be set when creating new route [ 862.993775][T17760] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 863.081153][T17755] bridge3: entered promiscuous mode [ 863.171663][ T29] audit: type=1400 audit(1785710053.085:3138): avc: denied { write } for pid=17771 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 863.548090][T17787] netlink: 199836 bytes leftover after parsing attributes in process `syz.8.2953'. [ 863.986312][T17594] usb 10-1: new high-speed USB device number 40 using dummy_hcd [ 864.069207][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 864.096007][ T5720] usb 9-1: new high-speed USB device number 55 using dummy_hcd [ 864.153275][ T29] audit: type=1400 audit(1785710054.106:3139): avc: denied { write } for pid=17781 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 864.186107][T17594] usb 10-1: Using ep0 maxpacket: 8 [ 864.217994][T17594] usb 10-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 864.253349][T17594] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.284680][T17594] usb 10-1: Product: syz [ 864.290248][ T5720] usb 9-1: Using ep0 maxpacket: 8 [ 864.320375][ T5720] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 864.332203][T17594] usb 10-1: Manufacturer: syz [ 864.342363][T17594] usb 10-1: SerialNumber: syz [ 864.347289][ T5720] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.361083][T17594] usb 10-1: config 0 descriptor?? [ 864.374047][ T5720] usb 9-1: Product: syz [ 864.389923][ T5720] usb 9-1: Manufacturer: syz [ 864.404790][ T5720] usb 9-1: SerialNumber: syz [ 864.412071][ T5720] usb 9-1: config 0 descriptor?? [ 864.485083][ T29] audit: type=1400 audit(1785710054.436:3140): avc: denied { write } for pid=17799 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 864.625603][T17594] dvb_usb_rtl28xxu 10-1:0.0: chip type detection failed -71 [ 864.662359][T17594] dvb_usb_rtl28xxu 10-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 864.676038][ T29] audit: type=1400 audit(1785710054.626:3141): avc: denied { read } for pid=17800 comm="syz.0.2955" name="iface_name" dev="configfs" ino=60213 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 864.737745][ T29] audit: type=1800 audit(1785710054.656:3142): pid=17802 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2955" name="iface_name" dev="configfs" ino=60213 res=0 errno=0 [ 864.790391][ T5720] dvb_usb_rtl28xxu 9-1:0.0: chip type detection failed -71 [ 864.805110][T17594] usb 10-1: USB disconnect, device number 40 [ 864.811769][ T5720] dvb_usb_rtl28xxu 9-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 864.873174][ T5720] usb 9-1: USB disconnect, device number 55 [ 865.252440][T17816] CIFS: Attempting to mount //127.0.0.1/share [ 865.314820][T17816] CIFS: VFS: \\127.0.0.1 Error -104 sending data on socket to server [ 865.338446][T17816] CIFS: VFS: cifs_mount failed w/return code = -103 [ 865.370876][T17823] FAULT_INJECTION: forcing a failure. [ 865.370876][T17823] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 865.460887][T17823] CPU: 0 UID: 0 PID: 17823 Comm: syz.3.2958 Tainted: G L syzkaller #0 PREEMPT(full) [ 865.460919][T17823] Tainted: [L]=SOFTLOCKUP [ 865.460925][T17823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 865.460936][T17823] Call Trace: [ 865.460942][T17823] [ 865.460949][T17823] dump_stack_lvl+0x100/0x190 [ 865.460978][T17823] should_fail_ex.cold+0x5/0xa [ 865.461002][T17823] _copy_to_user+0x32/0xd0 [ 865.461028][T17823] simple_read_from_buffer+0xcb/0x170 [ 865.461057][T17823] proc_fail_nth_read+0x1af/0x230 [ 865.461084][T17823] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 865.461113][T17823] ? rw_verify_area+0xce/0x6d0 [ 865.461136][T17823] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 865.461161][T17823] vfs_read+0x1e4/0xb40 [ 865.461189][T17823] ? __pfx_vfs_read+0x10/0x10 [ 865.461213][T17823] ? __fget_files+0x215/0x3d0 [ 865.461237][T17823] ? __fget_files+0x21f/0x3d0 [ 865.461261][T17823] ksys_read+0x12a/0x250 [ 865.461276][T17823] ? __pfx_ksys_read+0x10/0x10 [ 865.461297][T17823] do_syscall_64+0x115/0x870 [ 865.461318][T17823] ? clear_bhb_loop+0x70/0xc0 [ 865.461340][T17823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 865.461364][T17823] RIP: 0033:0x7fc33af5e90e [ 865.461378][T17823] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 865.461394][T17823] RSP: 002b:00007fc33be21fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 865.461413][T17823] RAX: ffffffffffffffda RBX: 00007fc33be226c0 RCX: 00007fc33af5e90e [ 865.461424][T17823] RDX: 000000000000000f RSI: 00007fc33be220a0 RDI: 0000000000000003 [ 865.461434][T17823] RBP: 00007fc33be22090 R08: 0000000000000000 R09: 0000000000000000 [ 865.461445][T17823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 865.461455][T17823] R13: 00007fc33b226038 R14: 00007fc33b225fa0 R15: 00007ffe0098f8d8 [ 865.461475][T17823] [ 866.144498][ T49] Bluetooth: hci3: command 0x0406 tx timeout [ 866.823545][ T29] audit: type=1400 audit(1785710056.778:3143): avc: denied { write } for pid=17806 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 866.957216][T17841] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 866.957216][T17841] The task syz.3.2961 (17841) triggered the difference, watch for misbehavior. [ 867.227155][ T29] audit: type=1400 audit(1785710057.188:3144): avc: denied { write } for pid=17842 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 868.123600][T17857] netlink: 'syz.0.2964': attribute type 1 has an invalid length. [ 868.131430][T17857] netlink: 248 bytes leftover after parsing attributes in process `syz.0.2964'. [ 868.149881][T17857] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 868.159332][T17857] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 868.169900][T17857] overlayfs: failed to get uuid (/file0, err=-95); falling back to uuid=null. [ 868.675765][ T29] audit: type=1400 audit(1785710058.629:3145): avc: denied { write } for pid=17848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 868.959935][T17867] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2965'. [ 868.972466][ T29] audit: type=1400 audit(1785710058.929:3146): avc: denied { write } for pid=17865 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 869.689397][T17867] syzkaller0: entered promiscuous mode [ 869.716713][T17867] syzkaller0: entered allmulticast mode [ 870.705877][ T29] audit: type=1400 audit(1785710060.660:3147): avc: denied { write } for pid=17873 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 871.284851][T17895] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 871.500136][ T29] audit: type=1400 audit(1785710061.451:3148): avc: denied { write } for pid=17898 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 871.630439][T17904] netlink: 1363 bytes leftover after parsing attributes in process `syz.8.2970'. [ 871.676706][T17904] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2970'. [ 871.951369][ T5721] usb 9-1: new high-speed USB device number 56 using dummy_hcd [ 872.088651][ T29] audit: type=1400 audit(1785710062.041:3149): avc: denied { write } for pid=17908 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 872.131923][ T5721] usb 9-1: Using ep0 maxpacket: 8 [ 872.140378][ T5721] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 872.172102][ T5721] usb 9-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 872.181367][ T5721] usb 9-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 872.189473][ T5721] usb 9-1: Product: syz [ 872.194181][ T5721] usb 9-1: Manufacturer: syz [ 872.198800][ T5721] usb 9-1: SerialNumber: syz [ 872.283417][ T29] audit: type=1400 audit(1785710062.241:3150): avc: denied { write } for pid=17924 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 872.446776][T17904] netlink: 20 bytes leftover after parsing attributes in process `syz.8.2970'. [ 872.542770][ T5721] usb 9-1: palm_os_3_probe - error -71 getting connection information [ 872.562663][ T5721] visor 9-1:1.0: probe with driver visor failed with error -71 [ 872.577543][ T5721] usb 9-1: USB disconnect, device number 56 [ 873.564651][T17952] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 873.726422][T17958] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 873.749836][ T29] audit: type=1400 audit(1785710063.702:3151): avc: denied { write } for pid=17936 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 873.995196][ T29] audit: type=1400 audit(1785710063.952:3152): avc: denied { write } for pid=17962 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 876.763138][T17974] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2981'. [ 877.616894][ T9] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 877.617112][ T49] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 877.643520][ T49] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 877.652097][ T49] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 877.688146][ T86] usb 9-1: new high-speed USB device number 57 using dummy_hcd [ 877.861965][ T86] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 877.893473][ T86] usb 9-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.0a [ 877.922699][ T86] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 877.955015][ T86] usb 9-1: Product: syz [ 877.970331][ T86] usb 9-1: Manufacturer: syz [ 877.986136][ T86] usb 9-1: SerialNumber: syz [ 878.063295][ T86] gspca_main: xirlink-cit-2.14.0 probing 0545:8080 [ 878.150228][ T86] input: xirlink-cit as /devices/platform/dummy_hcd.8/usb9/9-1/input/input38 [ 878.494775][ T86] usb 9-1: USB disconnect, device number 57 [ 879.394454][ T49] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 879.435019][ T5598] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 879.447979][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 879.553305][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 879.699207][ T9] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 879.708305][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 879.884228][ T9] usb 4-1: config 0 descriptor?? [ 879.904433][T17981] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 880.082540][ T9] usb 4-1: can't set config #0, error -71 [ 880.117928][ T9] usb 4-1: USB disconnect, device number 23 [ 880.321554][T18007] SELinux: unknown common [ 880.326221][T18007] SELinux: invalid class [ 880.333957][T18007] SELinux: failed to load policy [ 880.390064][T18010] netlink: 'syz.3.2988': attribute type 4 has an invalid length. [ 880.448003][T18010] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2988'. [ 881.500828][T17991] Bluetooth: hci6: command 0x0406 tx timeout [ 881.680869][T17985] lo speed is unknown, defaulting to 1000 [ 881.817381][ T49] Bluetooth: hci2: command tx timeout [ 882.491927][T17985] bridge0: port 1(bridge_slave_0) entered blocking state [ 882.499652][T17985] bridge0: port 1(bridge_slave_0) entered disabled state [ 882.507391][T17985] bridge_slave_0: entered allmulticast mode [ 882.515659][T17985] bridge_slave_0: entered promiscuous mode [ 882.526236][T17985] bridge0: port 2(bridge_slave_1) entered blocking state [ 882.551595][T17985] bridge0: port 2(bridge_slave_1) entered disabled state [ 882.572434][T17985] bridge_slave_1: entered allmulticast mode [ 882.584491][T17985] bridge_slave_1: entered promiscuous mode [ 882.647614][T17985] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 882.666212][T17985] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 882.735442][T17985] team0: Port device team_slave_0 added [ 882.764199][T17985] team0: Port device team_slave_1 added [ 882.862515][T17985] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 882.876970][T17985] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 882.945590][T17985] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 882.968333][T17985] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 883.028423][T17985] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 883.095574][T17985] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 883.926542][ T49] Bluetooth: hci2: command tx timeout [ 884.167686][T18043] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2992'. [ 884.240996][T17985] hsr_slave_0: entered promiscuous mode [ 884.261879][T17985] hsr_slave_1: entered promiscuous mode [ 884.372689][T18048] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 884.394767][T18043] team0: Port device team_slave_0 removed [ 884.409228][T18048] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 884.603196][ T9] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 885.542441][ T29] audit: type=1400 audit(1785710075.506:3153): avc: denied { write } for pid=18055 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 885.691704][ T5806] usb 10-1: new high-speed USB device number 41 using dummy_hcd [ 885.720157][ T29] audit: type=1400 audit(1785710075.686:3154): avc: denied { write } for pid=18069 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 885.987716][ T49] Bluetooth: hci2: command tx timeout [ 886.534120][T18080] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2999'. [ 886.900607][T18080] syzkaller0: entered promiscuous mode [ 886.917009][T18080] syzkaller0: entered allmulticast mode [ 886.937745][ T9] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 886.956184][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.964873][ T9] usb 4-1: Product: syz [ 886.973955][ T9] usb 4-1: Manufacturer: syz [ 886.979157][ T9] usb 4-1: SerialNumber: syz [ 886.999282][ T9] usb 4-1: config 0 descriptor?? [ 887.174694][T17985] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 887.197077][T17985] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 887.217527][T17985] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 887.264595][T17985] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 887.317878][T17985] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 887.370727][T17985] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 887.403473][T17985] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 887.422644][T18086] netlink: 'syz.3.3000': attribute type 21 has an invalid length. [ 887.444732][T17985] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 887.448913][ T5806] usb 10-1: Using ep0 maxpacket: 32 [ 887.461248][T18086] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3000'. [ 887.514014][T18090] netlink: 'syz.3.3000': attribute type 21 has an invalid length. [ 887.543503][T18090] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3000'. [ 887.649661][ T29] audit: type=1400 audit(1785710077.616:3155): avc: denied { write } for pid=18071 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 887.835249][ T29] audit: type=1400 audit(1785710077.796:3156): avc: denied { write } for pid=18096 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 887.961479][ T9] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -71 [ 887.970757][ T9] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 887.970927][T18086] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3000'. [ 887.994941][ T9] usb 4-1: USB disconnect, device number 24 [ 888.010797][ T5806] usb 10-1: config 0 has an invalid interface number: 184 but max is 0 [ 888.025116][ T5806] usb 10-1: config 0 has no interface number 0 [ 888.036835][ T5806] usb 10-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 888.052315][T18090] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3000'. [ 888.061476][ T49] Bluetooth: hci2: command tx timeout [ 888.066745][ T5806] usb 10-1: config 0 interface 184 has no altsetting 0 [ 888.092855][ T5806] usb 10-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 888.121753][ T5806] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.144931][ T5806] usb 10-1: Product: syz [ 888.150362][ T5806] usb 10-1: Manufacturer: syz [ 888.156590][ T5806] usb 10-1: SerialNumber: syz [ 888.169160][ T5806] usb 10-1: config 0 descriptor?? [ 888.176029][T18062] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 888.242273][T17985] 8021q: adding VLAN 0 to HW filter on device bond0 [ 888.283797][T17985] 8021q: adding VLAN 0 to HW filter on device team0 [ 888.304538][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 888.311773][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 888.378917][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 888.386143][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 888.400389][ T5806] smsc75xx 10-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 888.442956][ T5806] smsc75xx 10-1:0.184: probe with driver smsc75xx failed with error -71 [ 888.479335][T17985] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 888.495053][ T5806] usb 10-1: USB disconnect, device number 41 [ 888.537052][T17985] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 888.834639][ T29] audit: type=1400 audit(1785710078.777:3157): avc: denied { write } for pid=18100 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 888.931434][T17991] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 888.949495][T17991] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 888.961459][T17991] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 888.970946][ T29] audit: type=1400 audit(1785710078.937:3158): avc: denied { write } for pid=18136 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 889.012649][T17991] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 889.022652][T17991] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 889.081013][T18142] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3005'. [ 890.868421][ T5784] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 891.026143][ T29] audit: type=1400 audit(1785710080.987:3159): avc: denied { write } for pid=18172 comm="syz.9.3010" name="nullb" dev="configfs" ino=2905 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 891.046740][T17985] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 891.098664][T17991] Bluetooth: hci5: command tx timeout [ 891.156807][ T5784] usb 4-1: not running at top speed; connect to a high speed hub [ 891.173581][ T29] audit: type=1400 audit(1785710081.137:3160): avc: denied { write } for pid=18172 comm="syz.9.3010" name="nullb" dev="configfs" ino=2905 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 891.215229][T18134] lo speed is unknown, defaulting to 1000 [ 891.225715][ T5784] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 891.260366][ T5784] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 891.304019][ T5784] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 891.335185][ T5784] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 891.559331][ T29] audit: type=1400 audit(1785710081.527:3161): avc: denied { write } for pid=18152 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 891.610195][ T5784] garmin_gps 4-1:1.0: Garmin GPS usb/tty converter detected [ 891.641874][ T5784] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 891.649063][ T5784] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 891.720130][ T29] audit: type=1400 audit(1785710081.677:3162): avc: denied { write } for pid=18191 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 891.860379][T18154] vlan2: entered promiscuous mode [ 891.865426][T18154] bridge0: entered promiscuous mode [ 891.997845][ T5784] usb 4-1: USB disconnect, device number 25 [ 892.005026][ T5784] garmin_gps 4-1:1.0: device disconnected [ 892.395206][ T29] audit: type=1400 audit(1785710082.357:3163): avc: denied { setopt } for pid=18214 comm="syz.9.3012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 892.419650][ T7578] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.464733][ T29] audit: type=1400 audit(1785710082.427:3164): avc: denied { write } for pid=18201 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 892.541506][T18220] FAULT_INJECTION: forcing a failure. [ 892.541506][T18220] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 892.572477][T18220] CPU: 1 UID: 0 PID: 18220 Comm: syz.9.3013 Tainted: G L syzkaller #0 PREEMPT(full) [ 892.572508][T18220] Tainted: [L]=SOFTLOCKUP [ 892.572515][T18220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 892.572525][T18220] Call Trace: [ 892.572543][T18220] [ 892.572551][T18220] dump_stack_lvl+0x100/0x190 [ 892.572581][T18220] should_fail_ex.cold+0x5/0xa [ 892.572605][T18220] _copy_to_user+0x32/0xd0 [ 892.572639][T18220] simple_read_from_buffer+0xcb/0x170 [ 892.572662][T18220] proc_fail_nth_read+0x1af/0x230 [ 892.572693][T18220] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 892.572724][T18220] ? rw_verify_area+0xce/0x6d0 [ 892.572750][T18220] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 892.572779][T18220] vfs_read+0x1e4/0xb40 [ 892.572810][T18220] ? __pfx_vfs_read+0x10/0x10 [ 892.572837][T18220] ? __fget_files+0x215/0x3d0 [ 892.572879][T18220] ? __fget_files+0x21f/0x3d0 [ 892.572905][T18220] ksys_read+0x12a/0x250 [ 892.572921][T18220] ? __pfx_ksys_read+0x10/0x10 [ 892.572943][T18220] do_syscall_64+0x115/0x870 [ 892.572963][T18220] ? clear_bhb_loop+0x70/0xc0 [ 892.572983][T18220] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.572999][T18220] RIP: 0033:0x7f0b7275e90e [ 892.573014][T18220] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 892.573030][T18220] RSP: 002b:00007f0b736b8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 892.573047][T18220] RAX: ffffffffffffffda RBX: 00007f0b736b96c0 RCX: 00007f0b7275e90e [ 892.573059][T18220] RDX: 000000000000000f RSI: 00007f0b736b90a0 RDI: 0000000000000003 [ 892.573070][T18220] RBP: 00007f0b736b9090 R08: 0000000000000000 R09: 0000000000000000 [ 892.573081][T18220] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 892.573092][T18220] R13: 00007f0b72a26038 R14: 00007f0b72a25fa0 R15: 00007ffe9fd8e6c8 [ 892.573117][T18220] [ 892.793761][ T29] audit: type=1400 audit(1785710082.547:3165): avc: denied { write } for pid=18221 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 892.934150][T18227] FAULT_INJECTION: forcing a failure. [ 892.934150][T18227] name failslab, interval 1, probability 0, space 0, times 0 [ 892.948219][T18227] CPU: 1 UID: 0 PID: 18227 Comm: syz.9.3015 Tainted: G L syzkaller #0 PREEMPT(full) [ 892.948250][T18227] Tainted: [L]=SOFTLOCKUP [ 892.948257][T18227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 892.948267][T18227] Call Trace: [ 892.948273][T18227] [ 892.948280][T18227] dump_stack_lvl+0x100/0x190 [ 892.948309][T18227] should_fail_ex.cold+0x5/0xa [ 892.948329][T18227] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 892.948357][T18227] should_failslab+0xc2/0x120 [ 892.948381][T18227] kmem_cache_alloc_noprof+0x91/0x6a0 [ 892.948402][T18227] ? skb_clone+0x190/0x400 [ 892.948429][T18227] skb_clone+0x190/0x400 [ 892.948451][T18227] netlink_deliver_tap+0xaed/0xcc0 [ 892.948480][T18227] netlink_unicast+0x6a5/0x850 [ 892.948501][T18227] ? __pfx_netlink_unicast+0x10/0x10 [ 892.948525][T18227] netlink_ack+0x655/0xb80 [ 892.948548][T18227] netlink_rcv_skb+0x333/0x420 [ 892.948567][T18227] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 892.948592][T18227] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 892.948626][T18227] ? netlink_deliver_tap+0x1ae/0xcc0 [ 892.948657][T18227] netlink_unicast+0x585/0x850 [ 892.948678][T18227] ? __pfx_netlink_unicast+0x10/0x10 [ 892.948702][T18227] netlink_sendmsg+0x8b0/0xda0 [ 892.948725][T18227] ? __pfx_netlink_sendmsg+0x10/0x10 [ 892.948758][T18227] ? selinux_socket_sendmsg+0x198/0x2f0 [ 892.948789][T18227] ____sys_sendmsg+0xa4d/0xbe0 [ 892.948815][T18227] ? __pfx_netlink_sendmsg+0x10/0x10 [ 892.948835][T18227] ? __pfx_____sys_sendmsg+0x10/0x10 [ 892.948872][T18227] ___sys_sendmsg+0x190/0x1e0 [ 892.948890][T18227] ? __pfx____sys_sendmsg+0x10/0x10 [ 892.948903][T18227] ? __lock_acquire+0x49f/0x1a40 [ 892.948926][T18227] ? get_pid_task+0x106/0x250 [ 892.948964][T18227] __sys_sendmsg+0x160/0x210 [ 892.948988][T18227] ? __pfx___sys_sendmsg+0x10/0x10 [ 892.949023][T18227] do_syscall_64+0x115/0x870 [ 892.949047][T18227] ? clear_bhb_loop+0x70/0xc0 [ 892.949069][T18227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.949087][T18227] RIP: 0033:0x7f0b7279e0d9 [ 892.949103][T18227] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 892.949126][T18227] RSP: 002b:00007f0b736b9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 892.949144][T18227] RAX: ffffffffffffffda RBX: 00007f0b72a25fa0 RCX: 00007f0b7279e0d9 [ 892.949162][T18227] RDX: 0000000000004044 RSI: 0000200000000300 RDI: 0000000000000003 [ 892.949173][T18227] RBP: 00007f0b736b9090 R08: 0000000000000000 R09: 0000000000000000 [ 892.949183][T18227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 892.949194][T18227] R13: 00007f0b72a26038 R14: 00007f0b72a25fa0 R15: 00007ffe9fd8e6c8 [ 892.949215][T18227] [ 892.987265][T17985] veth0_vlan: entered promiscuous mode [ 893.174649][T17991] Bluetooth: hci5: command tx timeout [ 893.305947][T17985] veth1_vlan: entered promiscuous mode [ 893.328478][T17985] veth0_macvtap: entered promiscuous mode [ 893.338023][T17985] veth1_macvtap: entered promiscuous mode [ 893.353822][T17985] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 893.434966][ T29] audit: type=1400 audit(1785710083.407:3166): avc: denied { write } for pid=18230 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 894.315989][ T7578] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 894.426097][T18134] bridge0: port 1(bridge_slave_0) entered blocking state [ 894.448864][T18134] bridge0: port 1(bridge_slave_0) entered disabled state [ 894.463470][ T29] audit: type=1400 audit(1785710084.417:3167): avc: denied { write } for pid=18250 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 894.492215][T18134] bridge_slave_0: entered allmulticast mode [ 894.515573][T18134] bridge_slave_0: entered promiscuous mode [ 894.541461][T18253] netlink: 199836 bytes leftover after parsing attributes in process `syz.8.3018'. [ 894.571718][T18134] bridge0: port 2(bridge_slave_1) entered blocking state [ 894.596268][T18134] bridge0: port 2(bridge_slave_1) entered disabled state [ 894.666570][T18134] bridge_slave_1: entered allmulticast mode [ 894.709455][T18134] bridge_slave_1: entered promiscuous mode [ 894.785366][T16991] usb 1-1: no suitable firmware found! [ 894.810390][T16991] usb 1-1: ath9k_htc: Failed to get firmware htc_9271.fw [ 894.847590][ T5713] usb 1-1: ath9k_htc: USB layer deinitialized [ 894.853119][T17985] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 894.994520][ T7578] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 895.144913][ T5721] usb 9-1: new full-speed USB device number 58 using dummy_hcd [ 895.209102][T18134] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 895.252380][T17570] lo speed is unknown, defaulting to 1000 [ 895.269381][T18134] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 895.319904][ T5721] usb 9-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 895.336144][T17991] Bluetooth: hci5: command tx timeout [ 895.351889][ T5721] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.395995][ T5721] usb 9-1: Product: syz [ 895.419714][ T5721] usb 9-1: Manufacturer: syz [ 895.444943][ T5721] usb 9-1: SerialNumber: syz [ 895.461582][ T5721] usb 9-1: config 0 descriptor?? [ 895.462338][ T29] audit: type=1400 audit(1785710085.427:3168): avc: denied { write } for pid=18254 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 895.525471][ T5721] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 895.599297][ T7578] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.229438][ T5721] gspca_stk1135: reg_w 0x2 err -110 [ 896.411280][ T5721] gspca_stk1135: serial bus timeout: status=0x00 [ 896.419908][ T5721] gspca_stk1135: Sensor write failed [ 896.425272][ T5721] gspca_stk1135: serial bus timeout: status=0x00 [ 896.431598][ T5721] gspca_stk1135: Sensor write failed [ 896.443069][ T5721] gspca_stk1135: serial bus timeout: status=0x00 [ 896.449467][ T5721] gspca_stk1135: Sensor read failed [ 896.460492][ T5721] gspca_stk1135: serial bus timeout: status=0x00 [ 896.468343][ T5721] gspca_stk1135: Sensor read failed [ 896.473620][ T5721] gspca_stk1135: Detected sensor type unknown (0x0) [ 896.494409][ T5721] gspca_stk1135: serial bus timeout: status=0x00 [ 896.500844][ T5721] gspca_stk1135: Sensor read failed [ 896.506258][ T5721] gspca_stk1135: serial bus timeout: status=0x00 [ 896.512657][ T5721] gspca_stk1135: Sensor read failed [ 896.517976][ T5721] gspca_stk1135: serial bus timeout: status=0x00 [ 896.524691][ T5721] gspca_stk1135: Sensor write failed [ 896.530186][ T5721] gspca_stk1135: serial bus timeout: status=0x00 [ 896.536593][ T5721] gspca_stk1135: Sensor write failed [ 896.542331][ T5721] stk1135 9-1:0.0: probe with driver stk1135 failed with error -110 [ 896.837826][T18134] team0: Port device team_slave_0 added [ 896.845834][T18134] team0: Port device team_slave_1 added [ 896.855192][T18275] FAULT_INJECTION: forcing a failure. [ 896.855192][T18275] name failslab, interval 1, probability 0, space 0, times 0 [ 896.870195][T18275] CPU: 1 UID: 0 PID: 18275 Comm: syz.3.3021 Tainted: G L syzkaller #0 PREEMPT(full) [ 896.870226][T18275] Tainted: [L]=SOFTLOCKUP [ 896.870234][T18275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 896.870244][T18275] Call Trace: [ 896.870253][T18275] [ 896.870261][T18275] dump_stack_lvl+0x100/0x190 [ 896.870289][T18275] should_fail_ex.cold+0x5/0xa [ 896.870312][T18275] should_failslab+0xc2/0x120 [ 896.870335][T18275] kmem_cache_alloc_noprof+0x91/0x6a0 [ 896.870355][T18275] ? perf_event_update_userpage+0x300/0x830 [ 896.870378][T18275] ? radix_tree_node_alloc.constprop.0+0x66/0x340 [ 896.870404][T18275] radix_tree_node_alloc.constprop.0+0x66/0x340 [ 896.870428][T18275] idr_get_free+0x52e/0xa00 [ 896.870458][T18275] idr_alloc_u32+0x1ac/0x320 [ 896.870483][T18275] ? __pfx_idr_alloc_u32+0x10/0x10 [ 896.870504][T18275] ? do_raw_spin_lock+0x128/0x260 [ 896.870538][T18275] l2tp_session_register+0x1cd/0xf90 [ 896.870561][T18275] ? __pfx_l2tp_session_register+0x10/0x10 [ 896.870584][T18275] ? lockdep_init_map_type+0x5c/0x250 [ 896.870606][T18275] ? lockdep_init_map_type+0x5c/0x250 [ 896.870632][T18275] pppol2tp_connect+0x15da/0x1c20 [ 896.870656][T18275] ? __pfx_pppol2tp_connect+0x10/0x10 [ 896.870675][T18275] ? __print_lock_name+0x61/0x80 [ 896.870694][T18275] ? __local_bh_enable_ip+0x9e/0x120 [ 896.870720][T18275] ? selinux_netlbl_socket_connect+0x30/0x40 [ 896.870748][T18275] ? selinux_socket_connect+0x6b/0x80 [ 896.870774][T18275] ? __pfx_pppol2tp_connect+0x10/0x10 [ 896.870793][T18275] __sys_connect_file+0x141/0x1a0 [ 896.870816][T18275] __sys_connect+0x141/0x170 [ 896.870835][T18275] ? __pfx___sys_connect+0x10/0x10 [ 896.870852][T18275] ? __fget_files+0x21f/0x3d0 [ 896.870879][T18275] ? __pfx_ksys_write+0x10/0x10 [ 896.870901][T18275] __x64_sys_connect+0x72/0xb0 [ 896.870919][T18275] ? lockdep_hardirqs_on+0x78/0x100 [ 896.870940][T18275] do_syscall_64+0x115/0x870 [ 896.870962][T18275] ? clear_bhb_loop+0x70/0xc0 [ 896.870983][T18275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.871000][T18275] RIP: 0033:0x7fc33af9e0d9 [ 896.871016][T18275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 896.871033][T18275] RSP: 002b:00007fc33be22028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 896.871050][T18275] RAX: ffffffffffffffda RBX: 00007fc33b225fa0 RCX: 00007fc33af9e0d9 [ 896.871061][T18275] RDX: 0000000000000026 RSI: 0000200000000000 RDI: 0000000000000009 [ 896.871071][T18275] RBP: 00007fc33be22090 R08: 0000000000000000 R09: 0000000000000000 [ 896.871082][T18275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 896.871092][T18275] R13: 00007fc33b226038 R14: 00007fc33b225fa0 R15: 00007ffe0098f8d8 [ 896.871115][T18275] [ 896.874309][ T7655] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 897.190586][T18278] binder: 18255:18278 ioctl c0306201 200000004a40 returned -14 [ 897.228656][T18134] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 897.237125][T18134] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 897.292293][T18134] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 897.329874][T18134] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 897.359005][T18134] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 897.414157][T17991] Bluetooth: hci5: command tx timeout [ 897.414184][T18134] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 897.677067][ T7655] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 897.687448][ T7655] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.556375][ T9] usb 9-1: USB disconnect, device number 58 [ 898.580049][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.701951][T18290] FAULT_INJECTION: forcing a failure. [ 898.701951][T18290] name failslab, interval 1, probability 0, space 0, times 0 [ 898.752507][T18290] CPU: 1 UID: 0 PID: 18290 Comm: syz.3.3023 Tainted: G L syzkaller #0 PREEMPT(full) [ 898.752536][T18290] Tainted: [L]=SOFTLOCKUP [ 898.752543][T18290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 898.752553][T18290] Call Trace: [ 898.752559][T18290] [ 898.752566][T18290] dump_stack_lvl+0x100/0x190 [ 898.752594][T18290] should_fail_ex.cold+0x5/0xa [ 898.752616][T18290] should_failslab+0xc2/0x120 [ 898.752642][T18290] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 898.752662][T18290] ? __alloc_skb+0x5b7/0x710 [ 898.752684][T18290] ? __alloc_skb+0x140/0x710 [ 898.752708][T18290] __alloc_skb+0x140/0x710 [ 898.752727][T18290] ? __alloc_skb+0x5b7/0x710 [ 898.752748][T18290] ? __pfx___alloc_skb+0x10/0x10 [ 898.752776][T18290] netlink_ack+0x117/0xb80 [ 898.752795][T18290] ? avc_has_perm_noaudit+0x145/0x3b0 [ 898.752838][T18290] netlink_rcv_skb+0x333/0x420 [ 898.752856][T18290] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 898.752881][T18290] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 898.752911][T18290] ? ns_capable+0xd2/0xf0 [ 898.752936][T18290] nfnetlink_rcv+0x1b3/0x440 [ 898.752959][T18290] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 898.752982][T18290] ? netlink_deliver_tap+0x1ae/0xcc0 [ 898.753015][T18290] netlink_unicast+0x585/0x850 [ 898.753037][T18290] ? __pfx_netlink_unicast+0x10/0x10 [ 898.753062][T18290] netlink_sendmsg+0x8b0/0xda0 [ 898.753084][T18290] ? __pfx_netlink_sendmsg+0x10/0x10 [ 898.753106][T18290] ? selinux_socket_sendmsg+0x198/0x2f0 [ 898.753136][T18290] ____sys_sendmsg+0xa4d/0xbe0 [ 898.753168][T18290] ? __pfx_netlink_sendmsg+0x10/0x10 [ 898.753188][T18290] ? __pfx_____sys_sendmsg+0x10/0x10 [ 898.753226][T18290] ___sys_sendmsg+0x190/0x1e0 [ 898.753245][T18290] ? __pfx____sys_sendmsg+0x10/0x10 [ 898.753261][T18290] ? __lock_acquire+0x49f/0x1a40 [ 898.753284][T18290] ? get_pid_task+0x106/0x250 [ 898.753326][T18290] __sys_sendmsg+0x160/0x210 [ 898.753349][T18290] ? __pfx___sys_sendmsg+0x10/0x10 [ 898.753384][T18290] do_syscall_64+0x115/0x870 [ 898.753407][T18290] ? clear_bhb_loop+0x70/0xc0 [ 898.753428][T18290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 898.753445][T18290] RIP: 0033:0x7fc33af9e0d9 [ 898.753461][T18290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 898.753476][T18290] RSP: 002b:00007fc33be22028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 898.753494][T18290] RAX: ffffffffffffffda RBX: 00007fc33b225fa0 RCX: 00007fc33af9e0d9 [ 898.753506][T18290] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 0000000000000004 [ 898.753516][T18290] RBP: 00007fc33be22090 R08: 0000000000000000 R09: 0000000000000000 [ 898.753526][T18290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 898.753536][T18290] R13: 00007fc33b226038 R14: 00007fc33b225fa0 R15: 00007ffe0098f8d8 [ 898.753561][T18290] [ 899.363020][T18311] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 899.368256][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 899.368270][ T29] audit: type=1400 audit(1785710089.298:3170): avc: denied { write } for pid=18279 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 899.384793][T18311] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 899.489418][T18134] hsr_slave_0: entered promiscuous mode [ 899.505175][T18134] hsr_slave_1: entered promiscuous mode [ 899.518612][T18134] debugfs: 'hsr0' already exists in 'hsr' [ 899.524368][T18134] Cannot create hsr debugfs directory [ 899.603888][ T29] audit: type=1400 audit(1785710089.558:3171): avc: denied { write } for pid=18315 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 900.182034][ T7649] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 900.289537][ T7649] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 900.763106][ T7659] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 900.771932][ T7659] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 900.826707][ T7578] bridge_slave_1: left allmulticast mode [ 901.111266][ T7578] bridge_slave_1: left promiscuous mode [ 901.454697][ T7578] bridge0: port 2(bridge_slave_1) entered disabled state [ 902.088119][ T7578] bridge_slave_0: left allmulticast mode [ 902.126489][ T29] audit: type=1400 audit(1785710092.098:3172): avc: denied { write } for pid=18324 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 902.132699][ T7578] bridge_slave_0: left promiscuous mode [ 902.270019][ T7578] bridge0: port 1(bridge_slave_0) entered disabled state [ 902.341504][ T29] audit: type=1400 audit(1785710092.308:3173): avc: denied { write } for pid=18348 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 903.979473][ T7578] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 904.003153][T18370] FAULT_INJECTION: forcing a failure. [ 904.003153][T18370] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 904.036552][ T7578] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 904.047185][T18370] CPU: 1 UID: 0 PID: 18370 Comm: syz.8.3035 Tainted: G L syzkaller #0 PREEMPT(full) [ 904.047220][T18370] Tainted: [L]=SOFTLOCKUP [ 904.047227][T18370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 904.047238][T18370] Call Trace: [ 904.047244][T18370] [ 904.047252][T18370] dump_stack_lvl+0x100/0x190 [ 904.047280][T18370] should_fail_ex.cold+0x5/0xa [ 904.047304][T18370] _copy_to_user+0x32/0xd0 [ 904.047330][T18370] simple_read_from_buffer+0xcb/0x170 [ 904.047351][T18370] proc_fail_nth_read+0x1af/0x230 [ 904.047380][T18370] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 904.047410][T18370] ? rw_verify_area+0xce/0x6d0 [ 904.047434][T18370] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 904.047462][T18370] vfs_read+0x1e4/0xb40 [ 904.047492][T18370] ? __pfx_vfs_read+0x10/0x10 [ 904.047518][T18370] ? __fget_files+0x215/0x3d0 [ 904.047542][T18370] ? __fget_files+0x21f/0x3d0 [ 904.047568][T18370] ksys_read+0x12a/0x250 [ 904.047584][T18370] ? __pfx_ksys_read+0x10/0x10 [ 904.047608][T18370] do_syscall_64+0x115/0x870 [ 904.047632][T18370] ? clear_bhb_loop+0x70/0xc0 [ 904.047653][T18370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.047671][T18370] RIP: 0033:0x7f370115e90e [ 904.047686][T18370] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 904.047702][T18370] RSP: 002b:00007f36ff3f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 904.047719][T18370] RAX: ffffffffffffffda RBX: 00007f36ff3f66c0 RCX: 00007f370115e90e [ 904.047731][T18370] RDX: 000000000000000f RSI: 00007f36ff3f60a0 RDI: 0000000000000004 [ 904.047741][T18370] RBP: 00007f36ff3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 904.047752][T18370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 904.047762][T18370] R13: 00007f3701426038 R14: 00007f3701425fa0 R15: 00007ffcfd096388 [ 904.047786][T18370] [ 904.261528][ T29] audit: type=1400 audit(1785710094.218:3174): avc: denied { write } for pid=18352 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 904.416480][ T29] audit: type=1400 audit(1785710094.388:3175): avc: denied { write } for pid=18375 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 904.499898][ T7578] bond0 (unregistering): Released all slaves [ 904.775038][T18380] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 905.004058][ T5807] usb 9-1: new high-speed USB device number 59 using dummy_hcd [ 905.473713][ T5807] usb 9-1: Using ep0 maxpacket: 8 [ 905.854863][ T5807] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 905.878482][ T5807] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.911812][ T5807] usb 9-1: Product: syz [ 905.928412][ T5807] usb 9-1: Manufacturer: syz [ 905.955636][ T5807] usb 9-1: SerialNumber: syz [ 906.012367][ T5807] usb 9-1: config 0 descriptor?? [ 906.515538][ T5807] dvb_usb_rtl28xxu 9-1:0.0: chip type detection failed -71 [ 906.853533][ T5807] dvb_usb_rtl28xxu 9-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 907.170300][ T5807] usb 9-1: USB disconnect, device number 59 [ 908.317307][ T29] audit: type=1400 audit(1785710098.268:3176): avc: denied { write } for pid=18381 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 908.583756][T18412] /dev/sg0: Can't lookup blockdev [ 909.105358][ T29] audit: type=1400 audit(1785710099.078:3177): avc: denied { write } for pid=18413 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 910.814560][ T29] audit: type=1400 audit(1785710100.749:3178): avc: denied { getopt } for pid=18443 comm="syz.9.3050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 910.838993][T18441] /dev/nullb0: Can't open blockdev [ 911.050783][ T7578] hsr_slave_0: left promiscuous mode [ 911.999673][ T7578] hsr_slave_1: left promiscuous mode [ 912.014457][ T7578] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 912.022028][ T29] audit: type=1400 audit(1785710101.979:3179): avc: denied { write } for pid=18422 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 912.062881][ T7578] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 912.272905][ T7578] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 912.295160][ T7578] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 912.601565][ T7578] veth1_macvtap: left promiscuous mode [ 912.608332][T18470] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3054'. [ 912.618326][ T29] audit: type=1400 audit(1785710102.579:3180): avc: denied { write } for pid=18463 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 912.650031][ T7578] veth0_macvtap: left promiscuous mode [ 912.655758][ T7578] veth1_vlan: left promiscuous mode [ 912.661106][ T7578] veth0_vlan: left promiscuous mode [ 913.077582][ T49] Bluetooth: hci0: Zero size dump init pkt [ 914.730423][ T7578] team0 (unregistering): Port device team_slave_1 removed [ 914.783832][ T7578] team0 (unregistering): Port device team_slave_0 removed [ 914.791814][ T29] audit: type=1400 audit(1785710104.759:3181): avc: denied { write } for pid=18486 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 915.022846][ T29] audit: type=1400 audit(1785710104.989:3182): avc: denied { write } for pid=18510 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 915.120837][T18496] tipc: Started in network mode [ 915.125925][T18496] tipc: Node identity 4, cluster identity 4711 [ 915.132105][T18496] tipc: Node number set to 4 [ 915.188221][T18477] syzkaller0: entered promiscuous mode [ 915.203394][T18477] syzkaller0: entered allmulticast mode [ 916.497431][T18520] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3063'. [ 918.232582][T18533] FAULT_INJECTION: forcing a failure. [ 918.232582][T18533] name failslab, interval 1, probability 0, space 0, times 0 [ 918.246644][T18533] CPU: 0 UID: 0 PID: 18533 Comm: syz.8.3066 Tainted: G L syzkaller #0 PREEMPT(full) [ 918.246675][T18533] Tainted: [L]=SOFTLOCKUP [ 918.246682][T18533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 918.246693][T18533] Call Trace: [ 918.246700][T18533] [ 918.246708][T18533] dump_stack_lvl+0x100/0x190 [ 918.246736][T18533] should_fail_ex.cold+0x5/0xa [ 918.246761][T18533] should_failslab+0xc2/0x120 [ 918.246787][T18533] __kmalloc_noprof+0xfc/0x820 [ 918.246811][T18533] ? sock_kmalloc+0x111/0x170 [ 918.246843][T18533] sock_kmalloc+0x111/0x170 [ 918.246871][T18533] af_alg_alloc_areq+0x9e/0x250 [ 918.246893][T18533] skcipher_recvmsg+0x75d/0xec0 [ 918.246925][T18533] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 918.246951][T18533] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 918.246975][T18533] sock_recvmsg+0x1d5/0x220 [ 918.247009][T18533] sock_read_iter+0x2b0/0x3a0 [ 918.247037][T18533] ? __pfx_sock_read_iter+0x10/0x10 [ 918.247071][T18533] ? __pfx___file_has_perm+0x10/0x10 [ 918.247100][T18533] do_iter_readv_writev+0x616/0x930 [ 918.247129][T18533] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 918.247154][T18533] ? selinux_file_permission+0x8f/0x6d0 [ 918.247184][T18533] ? bpf_lsm_file_permission+0x9/0x10 [ 918.247212][T18533] ? security_file_permission+0x76/0x210 [ 918.247242][T18533] ? rw_verify_area+0xce/0x6d0 [ 918.247270][T18533] vfs_readv+0x4d3/0x8d0 [ 918.247303][T18533] ? __pfx_vfs_readv+0x10/0x10 [ 918.247332][T18533] ? rcu_read_lock_any_held+0x6a/0xa0 [ 918.247366][T18533] ? __fget_files+0x21f/0x3d0 [ 918.247392][T18533] ? do_readv+0x28a/0x340 [ 918.247417][T18533] do_readv+0x28a/0x340 [ 918.247443][T18533] ? __pfx_do_readv+0x10/0x10 [ 918.247476][T18533] do_syscall_64+0x115/0x870 [ 918.247499][T18533] ? clear_bhb_loop+0x70/0xc0 [ 918.247522][T18533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 918.247540][T18533] RIP: 0033:0x7f370119e0d9 [ 918.247557][T18533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 918.247575][T18533] RSP: 002b:00007f36ff3d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 918.247593][T18533] RAX: ffffffffffffffda RBX: 00007f3701426090 RCX: 00007f370119e0d9 [ 918.247605][T18533] RDX: 0000000000000002 RSI: 0000200000000a40 RDI: 0000000000000006 [ 918.247616][T18533] RBP: 00007f36ff3d5090 R08: 0000000000000000 R09: 0000000000000000 [ 918.247627][T18533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 918.247638][T18533] R13: 00007f3701426128 R14: 00007f3701426090 R15: 00007ffcfd096388 [ 918.247664][T18533] [ 918.527604][T18534] IPVS: set_ctl: invalid protocol: 51 100.1.1.2:20002 [ 919.033589][T18134] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 919.046828][ T29] audit: type=1400 audit(1785710108.879:3183): avc: denied { append } for pid=18535 comm="syz.6.3067" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 919.162407][T18134] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 919.177152][T18134] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 919.209648][T18134] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 919.225649][T18134] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 919.267160][T18134] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 919.296204][T18134] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 919.601533][ T29] audit: type=1400 audit(1785710109.569:3184): avc: denied { write } for pid=18525 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 920.132269][T18134] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 920.258194][T18556] FAULT_INJECTION: forcing a failure. [ 920.258194][T18556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 920.297073][ T29] audit: type=1400 audit(1785710110.259:3185): avc: denied { map } for pid=18553 comm="syz.6.3069" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 920.342155][T18556] CPU: 1 UID: 0 PID: 18556 Comm: syz.9.3070 Tainted: G L syzkaller #0 PREEMPT(full) [ 920.342186][T18556] Tainted: [L]=SOFTLOCKUP [ 920.342193][T18556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 920.342203][T18556] Call Trace: [ 920.342208][T18556] [ 920.342216][T18556] dump_stack_lvl+0x100/0x190 [ 920.342243][T18556] should_fail_ex.cold+0x5/0xa [ 920.342266][T18556] _copy_from_user+0x2e/0xd0 [ 920.342291][T18556] kstrtouint_from_user+0xd6/0x1d0 [ 920.342309][T18556] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 920.342327][T18556] ? __lock_acquire+0x49f/0x1a40 [ 920.342358][T18556] proc_fail_nth_write+0x83/0x220 [ 920.342376][T18556] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 920.342400][T18556] vfs_write+0x2aa/0x1050 [ 920.342417][T18556] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 920.342436][T18556] ? __pfx_vfs_write+0x10/0x10 [ 920.342452][T18556] ? __fget_files+0x215/0x3d0 [ 920.342475][T18556] ? __fget_files+0x21f/0x3d0 [ 920.342499][T18556] ksys_write+0x12a/0x250 [ 920.342514][T18556] ? __pfx_ksys_write+0x10/0x10 [ 920.342538][T18556] do_syscall_64+0x115/0x870 [ 920.342560][T18556] ? clear_bhb_loop+0x70/0xc0 [ 920.342581][T18556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 920.342599][T18556] RIP: 0033:0x7f0b7275e90e [ 920.342614][T18556] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 920.342629][T18556] RSP: 002b:00007f0b73697fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 920.342647][T18556] RAX: ffffffffffffffda RBX: 00007f0b736986c0 RCX: 00007f0b7275e90e [ 920.342658][T18556] RDX: 0000000000000001 RSI: 00007f0b736980a0 RDI: 0000000000000003 [ 920.342668][T18556] RBP: 00007f0b73698090 R08: 0000000000000000 R09: 0000000000000000 [ 920.342679][T18556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 920.342690][T18556] R13: 00007f0b72a26128 R14: 00007f0b72a26090 R15: 00007ffe9fd8e6c8 [ 920.342712][T18556] [ 920.561156][ T29] audit: type=1400 audit(1785710110.259:3186): avc: denied { execute } for pid=18553 comm="syz.6.3069" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 920.637446][T18567] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 920.663931][ T29] audit: type=1400 audit(1785710110.529:3187): avc: denied { write } for pid=18558 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 920.764629][ T5257] 8021q: adding VLAN 0 to HW filter on device eth9 [ 920.880079][T18134] 8021q: adding VLAN 0 to HW filter on device bond0 [ 920.943787][T18572] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 920.945481][T18134] 8021q: adding VLAN 0 to HW filter on device team0 [ 920.953955][T18572] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 920.994009][ T7657] bridge0: port 1(bridge_slave_0) entered blocking state [ 921.001133][ T7657] bridge0: port 1(bridge_slave_0) entered forwarding state [ 921.076639][ T7578] bridge0: port 2(bridge_slave_1) entered blocking state [ 921.083884][ T7578] bridge0: port 2(bridge_slave_1) entered forwarding state [ 921.171534][T18578] bridge3: entered promiscuous mode [ 921.187986][T18578] bridge3: entered allmulticast mode [ 921.585146][ T29] audit: type=1400 audit(1785710111.529:3188): avc: denied { write } for pid=18575 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 921.822871][ T29] audit: type=1400 audit(1785710111.739:3189): avc: denied { write } for pid=18600 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 923.787557][T18612] lo speed is unknown, defaulting to 1000 [ 924.103401][ T5257] 8021q: adding VLAN 0 to HW filter on device eth10 [ 924.134354][T18609] orangefs_mount: mount request failed with -4 [ 925.667236][T18134] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 925.889934][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 926.992947][T17594] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 927.119436][ T29] audit: type=1400 audit(1785710117.089:3190): avc: denied { write } for pid=18629 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 927.366836][T17594] usb 4-1: device descriptor read/64, error -71 [ 927.765903][T17594] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 927.923680][T17594] usb 4-1: device descriptor read/64, error -71 [ 929.281872][T17594] usb usb4-port1: attempt power cycle [ 929.862966][ T29] audit: type=1400 audit(1785710119.669:3191): avc: denied { write } for pid=18668 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 930.082965][T17594] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 930.503820][T17594] usb 4-1: device not accepting address 28, error -71 [ 930.521235][T18134] veth0_vlan: entered promiscuous mode [ 930.726044][T18674] bridge6: entered promiscuous mode [ 930.737837][T18674] bridge6: entered allmulticast mode [ 930.802369][T18134] veth1_vlan: entered promiscuous mode [ 930.880389][ T5257] 8021q: adding VLAN 0 to HW filter on device eth11 [ 931.029633][T17570] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 931.083222][T18134] veth0_macvtap: entered promiscuous mode [ 931.093524][T18134] veth1_macvtap: entered promiscuous mode [ 931.108795][T18134] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 931.122502][T18134] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 931.300163][T17570] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 931.309322][T17570] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 931.327203][T17570] usb 7-1: Product: syz [ 931.342392][T17570] usb 7-1: Manufacturer: syz [ 931.361629][T17570] usb 7-1: SerialNumber: syz [ 931.421244][T17570] usb 7-1: config 0 descriptor?? [ 931.500330][ T7655] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.524512][ T7655] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.650950][T17570] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 931.745827][ T7653] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.852950][ T7653] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 932.798093][ T7657] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 932.809313][ T7657] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 932.928043][T17570] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 933.020363][ T29] audit: type=1400 audit(1785710122.989:3192): avc: denied { write } for pid=18680 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 933.113962][ T7647] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 933.131468][ T7647] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 933.242006][ T29] audit: type=1400 audit(1785710123.209:3193): avc: denied { write } for pid=18701 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 933.377484][ T5257] 8021q: adding VLAN 0 to HW filter on device eth12 [ 934.615850][T17603] usb 7-1: USB disconnect, device number 5 [ 936.608676][ T29] audit: type=1400 audit(1785710126.579:3194): avc: denied { write } for pid=18707 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 936.756478][T18739] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 937.311008][ T29] audit: type=1400 audit(1785710127.279:3195): avc: denied { write } for pid=18751 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 937.848289][T18765] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 937.890542][T18762] overlayfs: failed lookup in lower (newroot/3, name='file0', err=-40): overlapping layers [ 937.935219][T18762] overlayfs: failed lookup in lower (newroot/3, name='file0', err=-40): overlapping layers [ 938.146060][ T29] audit: type=1400 audit(1785710128.119:3196): avc: denied { write } for pid=18754 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 938.217927][T18778] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3105'. [ 938.351839][ T29] audit: type=1400 audit(1785710128.319:3197): avc: denied { write } for pid=18779 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 938.387673][T18762] overlayfs: failed lookup in lower (newroot/3, name='file0', err=-40): overlapping layers [ 938.952275][ T5611] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 939.206102][ T29] audit: type=1400 audit(1785710129.179:3198): avc: denied { write } for pid=18783 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 939.234978][ T5611] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 939.341644][ T29] audit: type=1400 audit(1785710129.309:3199): avc: denied { write } for pid=18802 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 940.142017][ T5611] usb 6-1: New USB device found, idVendor=0b48, idProduct=1006, bcdDevice= 1.00 [ 940.151090][ T5611] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.159084][ T5611] usb 6-1: Product: syz [ 940.163260][ T5611] usb 6-1: Manufacturer: syz [ 940.167852][ T5611] usb 6-1: SerialNumber: syz [ 940.428252][T18820] bridge2: entered promiscuous mode [ 940.448309][T18820] bridge2: entered allmulticast mode [ 940.469729][ T5611] dvbdev: DVB: registering new adapter (DEC3000-s) [ 940.520854][ T5611] usb 6-1: DVB: registering adapter 1 frontend 0 (TechnoTrend/Hauppauge DEC3000-s Frontend)... [ 940.547075][ T29] audit: type=1400 audit(1785710130.509:3200): avc: denied { write } for pid=18807 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 940.756766][ T29] audit: type=1400 audit(1785710130.729:3201): avc: denied { write } for pid=18827 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 940.940259][ T5611] ttusb_dec_send_command: command bulk message failed: error -71 [ 940.990191][ T5611] usb 6-1: USB disconnect, device number 31 [ 944.095576][T18853] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 944.147808][ T29] audit: type=1400 audit(1785710134.119:3202): avc: denied { write } for pid=18830 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 944.193510][T18853] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 944.409017][ T29] audit: type=1400 audit(1785710134.369:3203): avc: denied { write } for pid=18859 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 946.886395][ T29] audit: type=1400 audit(1785710136.849:3204): avc: denied { write } for pid=18862 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 946.929525][T18887] bridge1: entered promiscuous mode [ 946.969012][T18887] bridge1: entered allmulticast mode [ 947.162611][T17570] usb 9-1: new high-speed USB device number 60 using dummy_hcd [ 947.532602][T17570] usb 9-1: Using ep0 maxpacket: 8 [ 948.154887][T17570] usb 9-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 948.200833][T17570] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.239699][T17570] usb 9-1: Product: syz [ 948.256155][T17570] usb 9-1: Manufacturer: syz [ 948.284819][T17570] usb 9-1: SerialNumber: syz [ 948.299083][T18906] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=18906 comm=syz.3.3125 [ 948.325223][T17570] usb 9-1: config 0 descriptor?? [ 948.364806][T17570] gspca_main: se401-2.14.0 probing 047d:5003 [ 948.389784][ T29] audit: type=1400 audit(1785710138.339:3205): avc: denied { write } for pid=18902 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 948.609247][T17991] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 948.634470][T17991] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 948.645562][T17991] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 948.661675][T17991] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 948.680614][T17991] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 949.005946][T17570] gspca_se401: ExtraFeatures: 255 [ 949.022645][T17570] gspca_se401: Frame size: 0x0 1/16th janggu [ 949.348081][T17570] gspca_se401: Frame size: 0x0 1/16th janggu [ 949.356265][T17570] gspca_se401: Frame size: 0x0 1/16th janggu [ 949.379115][T17570] input: se401 as /devices/platform/dummy_hcd.8/usb9/9-1/input/input39 [ 949.457609][T17570] usb 9-1: USB disconnect, device number 60 [ 950.852686][T17991] Bluetooth: hci4: command tx timeout [ 951.148560][ T29] audit: type=1400 audit(1785710141.109:3206): avc: denied { write } for pid=18916 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 951.342709][T17603] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 952.463004][ T29] audit: type=1400 audit(1785710142.429:3207): avc: denied { write } for pid=18955 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 952.739563][T17603] usb 4-1: Using ep0 maxpacket: 8 [ 952.932559][T17991] Bluetooth: hci4: command tx timeout [ 953.424054][T17603] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 953.433273][T17603] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 953.442030][T17603] usb 4-1: Product: syz [ 953.454830][T17603] usb 4-1: Manufacturer: syz [ 953.468368][T17603] usb 4-1: SerialNumber: syz [ 953.503810][T17603] usb 4-1: config 0 descriptor?? [ 953.515451][T17603] gspca_main: se401-2.14.0 probing 047d:5003 [ 953.536976][T18966] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 953.752111][ T7657] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 953.863572][T18972] 9p: Bad value for 'wfdno' [ 954.089471][T17603] gspca_se401: ExtraFeatures: 255 [ 954.758491][T17603] gspca_se401: Frame size: 0x0 1/16th janggu [ 954.835330][T17603] gspca_se401: Frame size: 0x0 1/16th janggu [ 954.869201][T17603] gspca_se401: Frame size: 0x0 1/16th janggu [ 954.891002][T18910] lo speed is unknown, defaulting to 1000 [ 954.939043][T17603] input: se401 as /devices/platform/dummy_hcd.3/usb4/4-1/input/input40 [ 955.012675][T17991] Bluetooth: hci4: command tx timeout [ 955.027814][T18992] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 955.078359][T17603] usb 4-1: USB disconnect, device number 30 [ 955.126652][ T7657] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 955.141615][ T5784] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 955.159354][T18992] CPU: 1 UID: 0 PID: 18992 Comm: syz.8.3140 Tainted: G L syzkaller #0 PREEMPT(full) [ 955.159387][T18992] Tainted: [L]=SOFTLOCKUP [ 955.159395][T18992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 955.159406][T18992] Call Trace: [ 955.159412][T18992] [ 955.159420][T18992] dump_stack_lvl+0x100/0x190 [ 955.159449][T18992] sysfs_warn_dup.cold+0x1c/0x28 [ 955.159479][T18992] sysfs_create_dir_ns+0x24b/0x2b0 [ 955.159501][T18992] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 955.159519][T18992] ? find_held_lock+0x2b/0x80 [ 955.159538][T18992] ? kobject_add_internal+0x25f/0x930 [ 955.159556][T18992] ? kobject_add_internal+0x25f/0x930 [ 955.159577][T18992] ? class_dir_child_ns_type+0xd/0x60 [ 955.159608][T18992] kobject_add_internal+0x2c8/0x930 [ 955.159632][T18992] kobject_add+0x16a/0x1e0 [ 955.159651][T18992] ? __pfx_kobject_add+0x10/0x10 [ 955.159671][T18992] ? get_device_parent+0x1b3/0x4c0 [ 955.159694][T18992] ? kobject_put+0xb9/0x640 [ 955.159727][T18992] device_add+0x294/0x1970 [ 955.159762][T18992] ? lockdep_init_map_type+0x5c/0x250 [ 955.159786][T18992] ? __pfx_device_add+0x10/0x10 [ 955.159811][T18992] ? lockdep_init_map_type+0x5c/0x250 [ 955.159835][T18992] ? __init_waitqueue_head+0xca/0x150 [ 955.159868][T18992] tty_register_device_attr+0x388/0x7f0 [ 955.159891][T18992] ? lockdep_init_map_type+0x5c/0x250 [ 955.159914][T18992] ? __pfx_tty_register_device_attr+0x10/0x10 [ 955.159943][T18992] ? tty_port_init+0x156/0x1c0 [ 955.159970][T18992] gsm_activate_mux+0x155/0x2a0 [ 955.159995][T18992] gsmld_ioctl+0xbbc/0x15c0 [ 955.160027][T18992] ? __pfx_gsmld_ioctl+0x10/0x10 [ 955.160058][T18992] ? __ldsem_down_read_nested+0xf3/0x890 [ 955.160089][T18992] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 955.160121][T18992] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 955.160145][T18992] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 955.160166][T18992] ? __pfx_gsmld_ioctl+0x10/0x10 [ 955.160190][T18992] tty_ioctl+0x11b4/0x1640 [ 955.160213][T18992] ? __pfx_tty_ioctl+0x10/0x10 [ 955.160236][T18992] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 955.160272][T18992] ? __fget_files+0x215/0x3d0 [ 955.160290][T18992] ? hook_file_ioctl_common+0x140/0x440 [ 955.160319][T18992] ? selinux_file_ioctl+0x13b/0x290 [ 955.160345][T18992] ? selinux_file_ioctl+0xb6/0x290 [ 955.160373][T18992] ? __pfx_tty_ioctl+0x10/0x10 [ 955.160395][T18992] __x64_sys_ioctl+0x18e/0x210 [ 955.160421][T18992] do_syscall_64+0x115/0x870 [ 955.160446][T18992] ? clear_bhb_loop+0x70/0xc0 [ 955.160468][T18992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 955.160485][T18992] RIP: 0033:0x7f370119e0d9 [ 955.160501][T18992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 955.160517][T18992] RSP: 002b:00007f36ff3d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 955.160535][T18992] RAX: ffffffffffffffda RBX: 00007f3701426090 RCX: 00007f370119e0d9 [ 955.160545][T18992] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000003 [ 955.160556][T18992] RBP: 00007f3701235024 R08: 0000000000000000 R09: 0000000000000000 [ 955.160565][T18992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 955.160573][T18992] R13: 00007f3701426128 R14: 00007f3701426090 R15: 00007ffcfd096388 [ 955.160594][T18992] [ 955.160630][T18992] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 955.307137][ T5784] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 955.544353][ T29] audit: type=1400 audit(1785710145.439:3208): avc: denied { write } for pid=18969 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 955.890829][ T5784] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 955.899633][ T5784] usb 6-1: Product: syz [ 955.954517][ T5784] usb 6-1: Manufacturer: syz [ 955.981236][ T5784] usb 6-1: SerialNumber: syz [ 956.042506][ T29] audit: type=1400 audit(1785710145.989:3209): avc: denied { write } for pid=19000 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 956.227979][T18992] bridge0: port 1(bridge_slave_0) entered disabled state [ 956.439530][ T7657] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.755357][T19017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 956.837663][T19017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 957.116606][T17991] Bluetooth: hci4: command tx timeout [ 957.203816][ T7657] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.949717][ T5784] rtl8150 6-1:1.0: couldn't reset the device [ 957.960085][ T5784] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 957.966154][ T29] audit: type=1400 audit(1785710147.909:3210): avc: denied { write } for pid=19005 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 958.353577][ T5784] usb 6-1: USB disconnect, device number 32 [ 958.373127][ T29] audit: type=1400 audit(1785710148.329:3211): avc: denied { write } for pid=19032 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 958.774782][T17570] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 958.925512][T18910] bridge0: port 1(bridge_slave_0) entered blocking state [ 958.944912][T17570] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 958.956852][T18910] bridge0: port 1(bridge_slave_0) entered disabled state [ 958.972820][T18910] bridge_slave_0: entered allmulticast mode [ 958.974514][ T9] usb 9-1: new high-speed USB device number 61 using dummy_hcd [ 958.982309][T17570] usb 4-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 959.017747][T18910] bridge_slave_0: entered promiscuous mode [ 959.882318][T17570] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 960.424577][T17570] usb 4-1: Product: syz [ 960.440148][T17570] usb 4-1: Manufacturer: syz [ 960.478349][T17570] usb 4-1: SerialNumber: syz [ 960.570979][T18910] bridge0: port 2(bridge_slave_1) entered blocking state [ 960.611322][T18910] bridge0: port 2(bridge_slave_1) entered disabled state [ 960.642942][T18910] bridge_slave_1: entered allmulticast mode [ 960.666039][T18910] bridge_slave_1: entered promiscuous mode [ 960.992759][T17603] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 961.277830][ T9] usb 9-1: unable to get BOS descriptor or descriptor too short [ 961.291228][ T9] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 155, changing to 7 [ 961.313059][ T9] usb 9-1: New USB device found, idVendor=2b73, idProduct=0034, bcdDevice= 0.40 [ 961.328822][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 961.348145][T18910] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 961.358322][ T9] usb 9-1: Product: syz [ 961.362496][ T9] usb 9-1: Manufacturer: syz [ 961.367077][ T9] usb 9-1: SerialNumber: syz [ 961.390284][T18910] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 961.454234][ T29] audit: type=1400 audit(1785710151.419:3212): avc: denied { write } for pid=19049 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 961.511770][T17570] usb 4-1: usb_control_msg returned -71 [ 961.517625][T17603] usb 6-1: Using ep0 maxpacket: 8 [ 961.542169][T17570] usbtmc 4-1:1.0: can't read capabilities [ 961.549553][ T29] audit: type=1400 audit(1785710151.499:3213): avc: denied { write } for pid=19066 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 961.574001][ T9] usb 9-1: BAAD HEADPHONE p_chmask mismatch [ 961.578714][T17603] usb 6-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 961.595274][T17570] usb 4-1: USB disconnect, device number 31 [ 961.609943][T17603] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 961.642022][T17603] usb 6-1: Product: syz [ 961.669082][T17603] usb 6-1: Manufacturer: syz [ 961.685549][T17603] usb 6-1: SerialNumber: syz [ 961.723395][T17603] usb 6-1: config 0 descriptor?? [ 961.747861][T17603] gspca_main: se401-2.14.0 probing 047d:5003 [ 961.839817][ T9] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 961.841276][T19069] overlayfs: missing 'lowerdir' [ 961.936663][ T9] usb 9-1: USB disconnect, device number 61 [ 962.091288][T19012] udevd[19012]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 962.161716][T17603] gspca_se401: ExtraFeatures: 255 [ 962.177211][T17603] gspca_se401: Frame size: 0x0 1/16th janggu [ 962.202676][T17603] gspca_se401: Frame size: 0x0 1/16th janggu [ 962.228262][T17603] gspca_se401: Frame size: 0x0 1/16th janggu [ 962.377355][T17603] input: se401 as /devices/platform/dummy_hcd.5/usb6/6-1/input/input41 [ 962.449670][T17603] usb 6-1: USB disconnect, device number 33 [ 962.762666][T19087] x_tables: unsorted underflow at hook 2 [ 962.832542][ T29] audit: type=1400 audit(1785710152.789:3214): avc: denied { write } for pid=19073 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 962.919984][T19093] xt_l2tp: v2 sid > 0xffff: 117440512 [ 962.961454][T19095] netlink: 'syz.8.3152': attribute type 10 has an invalid length. [ 962.991083][ T29] audit: type=1400 audit(1785710152.939:3215): avc: denied { write } for pid=19094 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 964.454781][ T7657] bridge_slave_1: left allmulticast mode [ 964.493179][ T7657] bridge_slave_1: left promiscuous mode [ 964.509170][ T7657] bridge0: port 2(bridge_slave_1) entered disabled state [ 964.580916][ T7657] bridge_slave_0: left allmulticast mode [ 964.607797][ T7657] bridge_slave_0: left promiscuous mode [ 964.622319][ T7657] bridge0: port 1(bridge_slave_0) entered disabled state [ 964.641496][T19110] CIFS: Attempting to mount //127.0.0.1/share [ 964.645707][ T29] audit: type=1800 audit(1785710154.599:3216): pid=19108 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.3154" name="ipv4_port" dev="configfs" ino=65502 res=0 errno=0 [ 964.651721][T19110] CIFS: VFS: Error connecting to socket. Aborting operation. [ 964.682728][T19110] CIFS: VFS: cifs_mount failed w/return code = -111 [ 964.811423][ T7657] dvmrp8: left allmulticast mode [ 964.869261][T19113] syz.3.3154 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=1000 [ 964.882383][T19113] CPU: 0 UID: 0 PID: 19113 Comm: syz.3.3154 Tainted: G L syzkaller #0 PREEMPT(full) [ 964.882412][T19113] Tainted: [L]=SOFTLOCKUP [ 964.882418][T19113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 964.882429][T19113] Call Trace: [ 964.882436][T19113] [ 964.882444][T19113] dump_stack_lvl+0x100/0x190 [ 964.882476][T19113] dump_header+0xfb/0x606 [ 964.882499][T19113] oom_kill_process.cold+0xd/0x330 [ 964.882523][T19113] out_of_memory+0x340/0x14f0 [ 964.882558][T19113] ? __pfx_out_of_memory+0x10/0x10 [ 964.882595][T19113] mem_cgroup_out_of_memory+0xc6/0x130 [ 964.882618][T19113] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 964.882638][T19113] ? find_held_lock+0x2b/0x80 [ 964.882662][T19113] ? do_raw_spin_unlock+0x145/0x1e0 [ 964.882690][T19113] ? _raw_spin_unlock+0x28/0x50 [ 964.882715][T19113] try_charge_memcg+0x6e5/0xdf0 [ 964.882748][T19113] ? __pfx_try_charge_memcg+0x10/0x10 [ 964.882776][T19113] ? find_held_lock+0x2b/0x80 [ 964.882794][T19113] ? rcu_read_unlock+0x17/0x60 [ 964.882822][T19113] ? rcu_read_unlock+0x17/0x60 [ 964.882853][T19113] obj_cgroup_charge_pages+0x22/0x1d0 [ 964.882879][T19113] __memcg_kmem_charge_page+0x1c1/0x4d0 [ 964.882907][T19113] __alloc_frozen_pages_noprof+0x365/0x2dc0 [ 964.882931][T19113] ? vma_wants_writenotify+0xdc/0x2e0 [ 964.882951][T19113] ? __pfx_vma_wants_writenotify+0x10/0x10 [ 964.882971][T19113] ? __pfx_uprobe_mmap+0x10/0x10 [ 964.883002][T19113] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 964.883025][T19113] ? __mmap_region+0xc73/0x2db0 [ 964.883054][T19113] ? __pfx___mmap_region+0x10/0x10 [ 964.883077][T19113] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 964.883101][T19113] ? mas_next_node+0x29c/0x1020 [ 964.883127][T19113] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 964.883150][T19113] ? policy_nodemask+0xed/0x4f0 [ 964.883178][T19113] alloc_pages_mpol+0x1fb/0x540 [ 964.883207][T19113] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 964.883233][T19113] ? __thp_vma_allowable_orders+0x1d9/0xf00 [ 964.883270][T19113] alloc_pages_noprof+0x1a/0x160 [ 964.883301][T19113] pte_alloc_one+0x1c/0x3d0 [ 964.883323][T19113] do_fault+0x86c/0x1750 [ 964.883355][T19113] __handle_mm_fault+0x187d/0x2a00 [ 964.883379][T19113] ? mt_find+0x45e/0x8e0 [ 964.883408][T19113] ? __pfx___handle_mm_fault+0x10/0x10 [ 964.883426][T19113] ? __pfx_mt_find+0x10/0x10 [ 964.883475][T19113] handle_mm_fault+0x37b/0xa30 [ 964.883501][T19113] __get_user_pages+0x1178/0x32a0 [ 964.883539][T19113] ? __pfx___get_user_pages+0x10/0x10 [ 964.883572][T19113] populate_vma_page_range+0x267/0x3f0 [ 964.883598][T19113] ? __pfx_populate_vma_page_range+0x10/0x10 [ 964.883621][T19113] ? __pfx_find_vma_intersection+0x10/0x10 [ 964.883643][T19113] ? do_mmap+0x93f/0x12f0 [ 964.883667][T19113] __mm_populate+0x107/0x3a0 [ 964.883691][T19113] ? __pfx___mm_populate+0x10/0x10 [ 964.883721][T19113] ? up_write+0x2e5/0x5c0 [ 964.883751][T19113] vm_mmap_pgoff+0x37f/0x470 [ 964.883780][T19113] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 964.883811][T19113] ? __pfx_do_futex+0x10/0x10 [ 964.883850][T19113] ksys_mmap_pgoff+0xe4/0x610 [ 964.883877][T19113] ? __x64_sys_futex+0x358/0x4d0 [ 964.883906][T19113] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 964.883932][T19113] ? xfd_validate_state+0x129/0x190 [ 964.883967][T19113] __x64_sys_mmap+0x125/0x190 [ 964.884000][T19113] do_syscall_64+0x115/0x870 [ 964.884024][T19113] ? clear_bhb_loop+0x70/0xc0 [ 964.884062][T19113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 964.884084][T19113] RIP: 0033:0x7fc33af9e0d9 [ 964.884103][T19113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 964.884124][T19113] RSP: 002b:00007fc33be01028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 964.884144][T19113] RAX: ffffffffffffffda RBX: 00007fc33b226090 RCX: 00007fc33af9e0d9 [ 964.884159][T19113] RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000200000000000 [ 964.884172][T19113] RBP: 00007fc33b035024 R08: ffffffffffffffff R09: 000000006a855000 [ 964.884185][T19113] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 964.884198][T19113] R13: 00007fc33b226128 R14: 00007fc33b226090 R15: 00007ffe0098f8d8 [ 964.884226][T19113] [ 964.888079][T19113] memory: usage 8kB, limit 8kB, failcnt 21 [ 965.052931][ T29] audit: type=1400 audit(1785710154.859:3217): avc: denied { write } for pid=19102 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 965.052983][ T29] audit: type=1400 audit(1785710154.919:3218): avc: denied { write } for pid=19120 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 965.454471][T19113] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 965.469262][T19113] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 965.478611][T19113] Memory cgroup stats for /syz3/test: [ 965.478866][T19113] cache 0 [ 965.505416][T19113] rss 0 [ 965.513863][T19113] rss_huge 0 [ 965.532946][T19113] shmem 0 [ 965.542033][T19113] mapped_file 0 [ 965.672241][T19113] dirty 0 [ 965.676438][T19113] writeback 0 [ 965.680118][T19113] workingset_refault_anon 0 [ 965.685709][T19113] workingset_refault_file 0 [ 965.703571][T19113] swap 0 [ 965.713151][T19113] swapcached 0 [ 965.718392][T19113] pgpgin 0 [ 965.723331][T19113] pgpgout 0 [ 965.729146][T19113] pgfault 0 [ 965.733184][T19113] pgmajfault 0 [ 965.736619][T19113] inactive_anon 0 [ 965.742773][T19113] active_anon 0 [ 965.746238][T19113] inactive_file 0 [ 965.749856][T19113] active_file 0 [ 965.754364][T19113] unevictable 0 [ 965.757817][T19113] hierarchical_memory_limit 8192 [ 965.762724][T19113] hierarchical_memsw_limit 9223372036854771712 [ 965.768859][T19113] total_cache 0 [ 965.772314][T19113] total_rss 0 [ 965.775669][T19113] total_rss_huge 0 [ 965.779432][T19113] total_shmem 0 [ 965.784479][T19113] total_mapped_file 0 [ 965.788494][T19113] total_dirty 0 [ 965.792371][T19113] total_writeback 0 [ 965.796162][T19113] total_workingset_refault_anon 0 [ 965.801173][T19113] total_workingset_refault_file 0 [ 965.806193][T19113] total_swap 0 [ 965.809555][T19113] total_swapcached 0 [ 965.813523][T19113] total_pgpgin 0 [ 965.817095][T19113] total_pgpgout 0 [ 965.820821][T19113] total_pgfault 0 [ 965.824462][T19113] total_pgmajfault 0 [ 965.828357][T19113] total_inactive_anon 0 [ 965.866175][T19113] total_active_anon 0 [ 965.882196][ T7657] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 965.899064][ T7657] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 965.918321][ T7657] bond0 (unregistering): Released all slaves [ 965.926498][T19113] total_inactive_file 0 [ 965.937261][ T7657] bond1 (unregistering): Released all slaves [ 965.952934][ T7657] bond2 (unregistering): Released all slaves [ 965.980885][T19095] bridge0: port 3(team0) entered disabled state [ 965.988114][T19095] bridge0: port 2(bridge_slave_1) entered disabled state [ 966.066955][T19095] bridge0: left promiscuous mode [ 966.098850][T19095] bridge0: left allmulticast mode [ 966.143325][T19113] total_active_file 0 [ 966.143558][T19095] bridge0: port 3(team0) entered blocking state [ 966.153743][T19095] bridge0: port 3(team0) entered forwarding state [ 966.160439][T19095] bridge0: port 2(bridge_slave_1) entered blocking state [ 966.167560][T19095] bridge0: port 2(bridge_slave_1) entered forwarding state [ 966.228497][T19095] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 966.230097][T19113] total_unevictable 0 [ 966.321639][T18910] team0: Port device team_slave_0 added [ 966.367515][T19113] anon_cost 0 [ 966.400335][T19113] file_cost 0 [ 966.420130][T19113] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.3154,pid=19107,uid=0 [ 966.479289][T18910] team0: Port device team_slave_1 added [ 966.557551][T19113] Memory cgroup out of memory: Killed process 19107 (syz.3.3154) total-vm:104432kB, anon-rss:3388kB, file-rss:23048kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 966.596264][T19132] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 966.622056][T19132] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 966.973000][T17570] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 967.008430][T18910] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 967.040160][T18910] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 967.115740][T19144] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 967.128638][T18910] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 967.132784][T19144] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 967.162582][T17570] usb 7-1: Using ep0 maxpacket: 16 [ 967.191418][T18910] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 967.211803][T17570] usb 7-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 967.230838][T17570] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.260919][T18910] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 967.648283][T18910] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 968.316620][T17570] usb 7-1: Product: syz [ 968.320890][T17570] usb 7-1: Manufacturer: syz [ 968.326541][T17570] usb 7-1: SerialNumber: syz [ 968.363723][T17570] r8152-cfgselector 7-1: Unknown version 0x0000 [ 968.370142][T17570] r8152-cfgselector 7-1: config 0 descriptor?? [ 968.423144][ T29] audit: type=1400 audit(1785710158.389:3219): avc: denied { write } for pid=19134 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 968.598510][T18910] hsr_slave_0: entered promiscuous mode [ 968.605120][T18910] hsr_slave_1: entered promiscuous mode [ 968.611379][T18910] debugfs: 'hsr0' already exists in 'hsr' [ 968.617118][T18910] Cannot create hsr debugfs directory [ 968.631725][ T29] audit: type=1400 audit(1785710158.589:3220): avc: denied { write } for pid=19155 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 968.876303][ T7657] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 968.883809][ T7657] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 968.891805][ T7657] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 968.899365][ T7657] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 969.086455][ T7657] virt_wifi0: left promiscuous mode [ 969.098475][ T7657] veth1_macvtap: left promiscuous mode [ 969.109109][ T7657] veth0_macvtap: left promiscuous mode [ 969.121050][ T7657] veth1_vlan: left promiscuous mode [ 969.154623][ T7657] veth0_vlan: left promiscuous mode [ 969.727482][T17570] r8152-cfgselector 7-1: Unknown version 0x0000 [ 969.746302][T17570] r8152-cfgselector 7-1: No union descriptors [ 969.765655][T17570] r8152-cfgselector 7-1: USB disconnect, device number 6 [ 969.855805][T19167] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3166'. [ 970.275920][T19178] CUSE: info not properly terminated [ 970.370330][T19173] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 970.622620][T17570] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 970.833551][T17570] usb 7-1: Using ep0 maxpacket: 8 [ 970.897767][T17570] usb 7-1: too many configurations: 54, using maximum allowed: 8 [ 971.024614][T17570] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 971.055725][T17570] usb 7-1: can't read configurations, error -61 [ 971.088537][ T7657] team0 (unregistering): Port device team_slave_1 removed [ 971.202800][T17570] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 971.224512][ T5257] 8021q: adding VLAN 0 to HW filter on device eth13 [ 971.305804][T19167] team0 (unregistering): Port device team_slave_0 removed [ 971.320030][T19193] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 971.332293][T19193] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 971.349941][T19167] team0 (unregistering): Port device team_slave_1 removed [ 971.363319][T17570] usb 7-1: Using ep0 maxpacket: 8 [ 971.371871][T17570] usb 7-1: too many configurations: 54, using maximum allowed: 8 [ 971.392150][T17570] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 971.410023][T17570] usb 7-1: can't read configurations, error -61 [ 971.425329][T17570] usb usb7-port1: attempt power cycle [ 971.772593][T17570] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 971.813310][T17570] usb 7-1: Using ep0 maxpacket: 8 [ 971.825409][T17570] usb 7-1: too many configurations: 54, using maximum allowed: 8 [ 971.874249][T17570] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 971.889390][T17570] usb 7-1: can't read configurations, error -61 [ 971.998301][T19201] FAULT_INJECTION: forcing a failure. [ 971.998301][T19201] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 972.011405][T19201] CPU: 0 UID: 0 PID: 19201 Comm: syz.5.3171 Tainted: G L syzkaller #0 PREEMPT(full) [ 972.011434][T19201] Tainted: [L]=SOFTLOCKUP [ 972.011441][T19201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 972.011452][T19201] Call Trace: [ 972.011461][T19201] [ 972.011469][T19201] dump_stack_lvl+0x100/0x190 [ 972.011497][T19201] should_fail_ex.cold+0x5/0xa [ 972.011521][T19201] _copy_from_user+0x2e/0xd0 [ 972.011547][T19201] memdup_user+0x6b/0xe0 [ 972.011569][T19201] strndup_user+0x78/0xe0 [ 972.011591][T19201] __x64_sys_mount+0x17f/0x310 [ 972.011616][T19201] ? __pfx___x64_sys_mount+0x10/0x10 [ 972.011660][T19201] do_syscall_64+0x115/0x870 [ 972.011684][T19201] ? clear_bhb_loop+0x70/0xc0 [ 972.011706][T19201] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 972.011724][T19201] RIP: 0033:0x7f4129d9e0d9 [ 972.011740][T19201] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 972.011757][T19201] RSP: 002b:00007f412ac93028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 972.011776][T19201] RAX: ffffffffffffffda RBX: 00007f412a026180 RCX: 00007f4129d9e0d9 [ 972.011788][T19201] RDX: 0000200000000180 RSI: 0000200000000140 RDI: 00002000000000c0 [ 972.011800][T19201] RBP: 00007f412ac93090 R08: 0000000000000000 R09: 0000000000000000 [ 972.011811][T19201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 972.011822][T19201] R13: 00007f412a026218 R14: 00007f412a026180 R15: 00007ffc03b591e8 [ 972.011846][T19201] [ 972.349499][T17570] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 972.397402][T17570] usb 7-1: Using ep0 maxpacket: 8 [ 972.403267][T17570] usb 7-1: too many configurations: 54, using maximum allowed: 8 [ 972.415698][T17570] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 972.423619][T17570] usb 7-1: can't read configurations, error -61 [ 972.430337][T17570] usb usb7-port1: unable to enumerate USB device [ 972.482645][ T5784] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 972.516580][ T7657] IPVS: stop unused estimator thread 0... [ 972.715307][ T5784] usb 4-1: Using ep0 maxpacket: 32 [ 972.843510][ T29] audit: type=1400 audit(1785710162.799:3221): avc: denied { connect } for pid=19200 comm="syz.3.3172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 972.994731][T17570] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 973.179941][T17570] usb 6-1: Using ep0 maxpacket: 32 [ 973.195611][T17570] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 973.213268][T17570] usb 6-1: config 0 has no interface number 0 [ 973.222245][T17570] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 973.266872][T17570] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 973.283006][ T5784] usb 4-1: unable to get BOS descriptor or descriptor too short [ 973.289743][T17570] usb 6-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 973.323417][T17570] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 973.353998][T17570] usb 6-1: config 0 descriptor?? [ 973.367825][ T29] audit: type=1400 audit(1785710163.329:3222): avc: denied { write } for pid=19216 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 973.478757][T19231] netlink: 20 bytes leftover after parsing attributes in process `syz.8.3176'. [ 973.527033][T19231] bridge0: port 3(team0) entered disabled state [ 973.535347][T19231] bridge0: port 3(team0) entered disabled state [ 973.535493][ T29] audit: type=1400 audit(1785710163.499:3223): avc: denied { write } for pid=19230 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 973.582190][T19231] team_slave_0: left promiscuous mode [ 973.614788][ T5784] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 973.622410][ T5784] usb 4-1: can't read configurations, error -71 [ 973.633302][T19231] team_slave_0: left allmulticast mode [ 973.665115][T19236] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3177'. [ 973.692862][T19231] team0 (unregistering): Port device team_slave_0 removed [ 973.702861][T19231] team_slave_1: left promiscuous mode [ 973.708429][T19231] team_slave_1: left allmulticast mode [ 973.737071][T19231] team0 (unregistering): Port device team_slave_1 removed [ 975.468742][T17570] input: HID 28bd:0094 Pen as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.1/0003:28BD:0094.0014/input/input42 [ 975.534090][T19241] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 975.547576][T19240] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 975.560162][T19248] CIFS: Attempting to mount //127.0.0.1/share [ 975.666374][T17570] uclogic 0003:28BD:0094.0014: input,hidraw0: USB HID v0.00 Device [HID 28bd:0094] on usb-dummy_hcd.5-1/input1 [ 975.725659][T19252] CIFS: VFS: \\127.0.0.1 SMB response too short (0 bytes) [ 975.897094][T19236] team0 (unregistering): Port device team_slave_0 removed [ 976.081048][T19236] team0 (unregistering): Port device team_slave_1 removed [ 976.312855][T19246] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 976.313511][T19248] CIFS: VFS: \\127.0.0.1 failed to create a new SMB session with Unknown: -11 [ 976.378099][T19246] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 976.387393][T19248] CIFS: VFS: cifs_mount failed w/return code = -11 [ 976.661245][T18910] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 976.932426][ T29] audit: type=1400 audit(1785710166.889:3224): avc: denied { write } for pid=19245 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 977.050507][T16991] usb 6-1: USB disconnect, device number 34 [ 977.228929][T18910] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 977.500732][T18910] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 977.657445][T18910] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 977.716770][T18910] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 977.800485][T18910] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 977.850071][T18910] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 977.903464][ T29] audit: type=1400 audit(1785710167.869:3225): avc: denied { write } for pid=19280 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 977.941090][T18910] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 979.363478][T18910] 8021q: adding VLAN 0 to HW filter on device bond0 [ 980.613295][T18910] 8021q: adding VLAN 0 to HW filter on device team0 [ 980.631981][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 980.639170][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 980.729254][ T7655] bridge0: port 2(bridge_slave_1) entered blocking state [ 980.736467][ T7655] bridge0: port 2(bridge_slave_1) entered forwarding state [ 980.939869][T19322] jffs2: notice: (19322) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 2 of xref (0 dead, 0 orphan) found. [ 981.273363][T17570] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 981.388300][ T29] audit: type=1400 audit(1785710171.349:3226): avc: denied { write } for pid=19308 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 981.442569][T17570] usb 6-1: Using ep0 maxpacket: 32 [ 981.595795][T17570] usb 6-1: unable to get BOS descriptor or descriptor too short [ 982.321239][T17570] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 982.369858][T17570] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 982.415507][T17570] usb 6-1: config 14 has no interface number 0 [ 982.446909][T17570] usb 6-1: config 14 has no interface number 1 [ 982.608185][T17570] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 982.976075][T17570] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 982.976109][T17570] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 982.976135][T17570] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 982.976162][T17570] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 982.976185][T17570] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 982.976208][T17570] usb 6-1: config 14 interface 57 has no altsetting 0 [ 982.976225][T17570] usb 6-1: config 14 interface 228 has no altsetting 0 [ 982.980618][T17570] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 982.980647][T17570] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.980667][T17570] usb 6-1: Product: syz [ 982.980682][T17570] usb 6-1: Manufacturer: syz [ 982.980697][T17570] usb 6-1: SerialNumber: syz [ 983.032251][ T29] audit: type=1400 audit(1785710172.979:3227): avc: denied { write } for pid=19347 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 983.439762][T17570] legousbtower 6-1:14.57: interrupt endpoints not found [ 983.553924][T19362] netlink: 'syz.8.3191': attribute type 1 has an invalid length. [ 983.739689][T19371] netlink: 28 bytes leftover after parsing attributes in process `syz.8.3191'. [ 983.808224][T19373] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3192'. [ 983.839464][T17570] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 985.619447][T17570] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 985.646522][T18910] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 986.071339][ T5784] usb 6-1: USB disconnect, device number 35 [ 986.100772][T19405] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3195'. [ 986.121334][ T5784] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 986.130756][ T29] audit: type=1400 audit(1785710176.089:3228): avc: denied { write } for pid=19364 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 986.938820][T19410] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 986.940972][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 987.026622][T19405] team0 (unregistering): Port device team_slave_0 removed [ 988.222012][T19405] team0 (unregistering): Port device team_slave_1 removed [ 988.526770][ T29] audit: type=1400 audit(1785710178.489:3229): avc: denied { write } for pid=19419 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 989.430315][T18910] veth0_vlan: entered promiscuous mode [ 989.458722][T18910] veth1_vlan: entered promiscuous mode [ 989.536075][T19438] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 989.564398][T18910] veth0_macvtap: entered promiscuous mode [ 989.586530][T19438] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 989.608272][T18910] veth1_macvtap: entered promiscuous mode [ 989.660426][ T29] audit: type=1400 audit(1785710179.619:3230): avc: denied { write } for pid=19429 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 989.685635][T18910] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 989.721718][T18910] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 989.841255][ T683] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 989.872647][ T65] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 989.920903][ T65] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 989.957111][ T29] audit: type=1400 audit(1785710179.909:3231): avc: denied { write } for pid=19449 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 990.032531][T18340] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 990.239668][ T65] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 990.291383][ T65] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 990.324021][ T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 990.331871][ T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 990.466655][ T6559] usb 4-1: new full-speed USB device number 34 using dummy_hcd [ 990.678571][ T6559] usb 4-1: not running at top speed; connect to a high speed hub [ 990.731359][ T6559] usb 4-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 990.762030][ T6559] usb 4-1: New USB device found, idVendor=04b4, idProduct=1002, bcdDevice=60.1b [ 990.890314][T17991] Bluetooth: hci0: Zero size dump init pkt [ 991.327783][ T29] audit: type=1400 audit(1785710181.289:3232): avc: denied { write } for pid=19458 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 991.387690][T19474] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3124'. [ 991.572151][ T6559] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 991.584426][ T6559] usb 4-1: Product: syz [ 991.588615][ T6559] usb 4-1: Manufacturer: syz [ 991.593218][ T6559] usb 4-1: SerialNumber: syz [ 991.691061][T19480] bridge2: entered promiscuous mode [ 991.696321][T19480] bridge2: entered allmulticast mode [ 991.701963][ T29] audit: type=1400 audit(1785710181.649:3233): avc: denied { write } for pid=19481 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 991.888474][T19487] vlan2: entered promiscuous mode [ 991.894309][T19487] macvlan0: entered promiscuous mode [ 991.960451][ T29] audit: type=1400 audit(1785710181.919:3234): avc: denied { write } for pid=19485 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 992.014217][ T29] audit: type=1400 audit(1785710181.979:3235): avc: denied { write } for pid=19498 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 992.288163][ T29] audit: type=1400 audit(1785710182.249:3236): avc: denied { write } for pid=19503 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 992.344418][ T6559] usb 4-1: USB disconnect, device number 34 [ 992.421171][ T29] audit: type=1400 audit(1785710182.379:3237): avc: denied { write } for pid=19518 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 992.902642][T19523] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3210'. [ 993.312918][T19451] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 993.845071][T19451] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 993.858603][T19451] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 993.884245][T19451] usb 6-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 993.907353][T19451] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 993.919102][T19539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 994.114074][T17603] usb 9-1: new high-speed USB device number 62 using dummy_hcd [ 994.125999][T19539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 994.302723][T17603] usb 9-1: Using ep0 maxpacket: 16 [ 994.368101][T17603] usb 9-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 994.444478][T17603] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 994.520076][T17603] usb 9-1: Product: syz [ 994.562157][T17603] usb 9-1: Manufacturer: syz [ 994.617695][T17603] usb 9-1: SerialNumber: syz [ 994.677697][ T29] audit: type=1400 audit(1785710184.639:3238): avc: denied { write } for pid=19526 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 994.710055][T17603] usb 9-1: config 0 descriptor?? [ 994.810250][T17603] ftdi_sio 9-1:0.0: FTDI USB Serial Device converter detected [ 994.862179][T17603] usb 9-1: Detected FT-X [ 995.008890][T19451] cxacru 6-1:1.0: invalid response length to cm 0x90: 0 [ 995.023251][T19451] cxacru 6-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 995.026990][T17603] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 995.031218][T19451] cxacru 6-1:1.0: probe with driver cxacru failed with error -22 [ 995.173368][T16653] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 995.197510][T17603] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 995.409640][T17603] ftdi_sio 9-1:0.0: GPIO initialisation failed: -71 [ 995.419749][ T29] audit: type=1400 audit(1785710185.349:3239): avc: denied { write } for pid=19557 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 995.464055][T17603] usb 9-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 995.599418][T17603] usb 9-1: USB disconnect, device number 62 [ 995.774420][T16653] usb 4-1: Using ep0 maxpacket: 8 [ 996.082317][T17603] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 996.093233][T17603] ftdi_sio 9-1:0.0: device disconnected [ 996.423530][T16653] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 996.433441][T16653] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 996.452676][T16653] usb 4-1: Product: syz [ 996.466831][T16653] usb 4-1: Manufacturer: syz [ 996.709846][T16653] usb 4-1: SerialNumber: syz [ 997.233198][T16653] usb 4-1: config 0 descriptor?? [ 997.292101][T16653] usb 4-1: can't set config #0, error -71 [ 997.324772][T16653] usb 4-1: USB disconnect, device number 35 [ 997.488368][T19584] usb usb8: usbfs: process 19584 (syz.6.3221) did not claim interface 0 before use [ 998.522814][T19451] usb 6-1: USB disconnect, device number 36 [ 998.555089][T19589] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 998.611413][T19593] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1000.247212][ T29] audit: type=1400 audit(1785710189.909:3240): avc: denied { write } for pid=19566 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1002.886268][ T29] audit: type=1400 audit(1785710192.849:3241): avc: denied { write } for pid=19606 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1002.962825][T16991] IPVS: starting estimator thread 0... [ 1003.059288][T19613] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3227'. [ 1003.082585][T19611] IPVS: using max 42 ests per chain, 100800 per kthread [ 1003.176565][T19616] FAULT_INJECTION: forcing a failure. [ 1003.176565][T19616] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1003.242545][T19616] CPU: 1 UID: 0 PID: 19616 Comm: syz.3.3231 Tainted: G L syzkaller #0 PREEMPT(full) [ 1003.242574][T19616] Tainted: [L]=SOFTLOCKUP [ 1003.242581][T19616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1003.242590][T19616] Call Trace: [ 1003.242597][T19616] [ 1003.242604][T19616] dump_stack_lvl+0x100/0x190 [ 1003.242631][T19616] should_fail_ex.cold+0x5/0xa [ 1003.242653][T19616] _copy_to_user+0x32/0xd0 [ 1003.242677][T19616] simple_read_from_buffer+0xcb/0x170 [ 1003.242698][T19616] proc_fail_nth_read+0x1af/0x230 [ 1003.242725][T19616] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1003.242753][T19616] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1003.242778][T19616] vfs_read+0x1e4/0xb40 [ 1003.242805][T19616] ? __pfx_vfs_read+0x10/0x10 [ 1003.242829][T19616] ? __fget_files+0x215/0x3d0 [ 1003.242853][T19616] ? __fget_files+0x21f/0x3d0 [ 1003.242877][T19616] ksys_read+0x12a/0x250 [ 1003.242893][T19616] ? __pfx_ksys_read+0x10/0x10 [ 1003.242916][T19616] do_syscall_64+0x115/0x870 [ 1003.242939][T19616] ? clear_bhb_loop+0x70/0xc0 [ 1003.242962][T19616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1003.242979][T19616] RIP: 0033:0x7fc33af5e90e [ 1003.242994][T19616] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1003.243010][T19616] RSP: 002b:00007fc33be21fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1003.243028][T19616] RAX: ffffffffffffffda RBX: 00007fc33be226c0 RCX: 00007fc33af5e90e [ 1003.243040][T19616] RDX: 000000000000000f RSI: 00007fc33be220a0 RDI: 0000000000000005 [ 1003.243050][T19616] RBP: 00007fc33be22090 R08: 0000000000000000 R09: 0000000000000000 [ 1003.243061][T19616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1003.243071][T19616] R13: 00007fc33b226038 R14: 00007fc33b225fa0 R15: 00007ffe0098f8d8 [ 1003.243096][T19616] [ 1003.842149][T19637] xt_hashlimit: size too large, truncated to 1048576 [ 1004.738436][ T49] Bluetooth: hci2: command 0x0406 tx timeout [ 1004.933906][T19642] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3235'. [ 1006.372867][ T29] audit: type=1400 audit(1785710196.239:3242): avc: denied { write } for pid=19615 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1007.728122][ T29] audit: type=1400 audit(1785710197.659:3243): avc: denied { write } for pid=19670 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1007.762497][T19665] bridge3: entered promiscuous mode [ 1007.767857][T19665] bridge3: entered allmulticast mode [ 1008.279537][T19674] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3240'. [ 1008.323455][ T29] audit: type=1800 audit(1785710198.279:3244): pid=19658 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.3236" name="file1" dev="tmpfs" ino=569 res=0 errno=0 [ 1008.488776][T19684] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3242'. [ 1008.563925][T19684] team0 (unregistering): Port device team_slave_0 removed [ 1008.673209][T19684] team0 (unregistering): Port device team_slave_1 removed [ 1009.810800][T19688] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 1010.243700][T19707] FAULT_INJECTION: forcing a failure. [ 1010.243700][T19707] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1010.279984][T19707] CPU: 0 UID: 0 PID: 19707 Comm: syz.3.3244 Tainted: G L syzkaller #0 PREEMPT(full) [ 1010.280015][T19707] Tainted: [L]=SOFTLOCKUP [ 1010.280021][T19707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1010.280031][T19707] Call Trace: [ 1010.280037][T19707] [ 1010.280043][T19707] dump_stack_lvl+0x100/0x190 [ 1010.280071][T19707] should_fail_ex.cold+0x5/0xa [ 1010.280094][T19707] _copy_to_user+0x32/0xd0 [ 1010.280121][T19707] simple_read_from_buffer+0xcb/0x170 [ 1010.280142][T19707] proc_fail_nth_read+0x1af/0x230 [ 1010.280172][T19707] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1010.280200][T19707] ? rw_verify_area+0xce/0x6d0 [ 1010.280230][T19707] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1010.280256][T19707] vfs_read+0x1e4/0xb40 [ 1010.280286][T19707] ? __pfx_vfs_read+0x10/0x10 [ 1010.280312][T19707] ? __fget_files+0x215/0x3d0 [ 1010.280336][T19707] ? __fget_files+0x21f/0x3d0 [ 1010.280361][T19707] ksys_read+0x12a/0x250 [ 1010.280377][T19707] ? __pfx_ksys_read+0x10/0x10 [ 1010.280400][T19707] do_syscall_64+0x115/0x870 [ 1010.280424][T19707] ? clear_bhb_loop+0x70/0xc0 [ 1010.280446][T19707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1010.280464][T19707] RIP: 0033:0x7fc33af5e90e [ 1010.280478][T19707] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1010.280495][T19707] RSP: 002b:00007fc33be21fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1010.280513][T19707] RAX: ffffffffffffffda RBX: 00007fc33be226c0 RCX: 00007fc33af5e90e [ 1010.280524][T19707] RDX: 000000000000000f RSI: 00007fc33be220a0 RDI: 0000000000000004 [ 1010.280534][T19707] RBP: 00007fc33be22090 R08: 0000000000000000 R09: 0000000000000000 [ 1010.280545][T19707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1010.280555][T19707] R13: 00007fc33b226038 R14: 00007fc33b225fa0 R15: 00007ffe0098f8d8 [ 1010.280580][T19707] [ 1010.727294][ T29] audit: type=1400 audit(1785710200.689:3245): avc: denied { write } for pid=19677 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1012.093737][ T29] audit: type=1400 audit(1785710201.969:3246): avc: denied { write } for pid=19728 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1012.599291][T19737] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3252'. [ 1013.508664][ T5257] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1014.625966][T17991] Bluetooth: hci5: command 0x0406 tx timeout [ 1015.750781][T19763] xt_hashlimit: size too large, truncated to 1048576 [ 1016.569403][T19773] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 1019.256826][T19819] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 1019.371732][ T29] audit: type=1400 audit(1785710209.329:3247): avc: denied { write } for pid=19780 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1019.762122][ T29] audit: type=1400 audit(1785710209.719:3248): avc: denied { write } for pid=19834 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1020.149565][ T29] audit: type=1400 audit(1785710210.109:3249): avc: denied { append } for pid=19840 comm="syz.8.3272" name="event3" dev="devtmpfs" ino=923 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1020.261150][T19846] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1020.323403][T19848] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1020.410236][T19853] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3275'. [ 1020.810030][T19866] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3277'. [ 1020.835455][T19866] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3277'. [ 1020.926536][ T29] audit: type=1400 audit(1785710210.889:3250): avc: denied { write } for pid=19847 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1021.179055][ T29] audit: type=1400 audit(1785710211.139:3251): avc: denied { write } for pid=19872 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1022.475280][T19883] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1022.485787][T19883] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1022.589402][ T5257] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1022.722228][T19879] CIFS: Attempting to mount //127.0.0.1/share [ 1022.731011][T19879] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1022.738478][T19879] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1024.068498][T19902] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3286'. [ 1024.905426][ T29] audit: type=1400 audit(1785710214.859:3252): avc: denied { write } for pid=19885 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1025.009558][T19930] syz.6.3290 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 1025.207557][ T29] audit: type=1400 audit(1785710215.169:3253): avc: denied { write } for pid=19931 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1025.406919][ T5257] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1131.532388][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1131.539354][ C1] rcu: 0-...!: (1 GPs behind) idle=4484/0/0x1 softirq=111006/111007 fqs=0 [ 1131.549243][ C1] rcu: (detected by 1, t=10505 jiffies, g=112129, q=431 ncpus=2) [ 1131.557057][ C1] Sending NMI from CPU 1 to CPUs 0: [ 1131.557085][ C0] NMI backtrace for cpu 0 [ 1131.557100][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1131.557120][ C0] Tainted: [L]=SOFTLOCKUP [ 1131.557125][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1131.557133][ C0] RIP: 0010:rcu_is_watching+0x80/0xc0 [ 1131.557160][ C0] Code: 89 da 48 c1 ea 03 0f b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 24 8b 03 c1 e8 02 83 e0 01 65 ff 0d 80 d9 74 12 <74> 07 5b 5d c3 cc cc cc cc e8 02 86 87 ff 5b 5d e9 9b 8d cf 09 48 [ 1131.557173][ C0] RSP: 0018:ffffc90000007d38 EFLAGS: 00000086 [ 1131.557186][ C0] RAX: 0000000000000001 RBX: ffff8880b8433c68 RCX: 0000000000000002 [ 1131.557196][ C0] RDX: 0000000000000000 RSI: ffffffff8c400300 RDI: ffffffff8e470920 [ 1131.557205][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: fffff52000000fa4 [ 1131.557214][ C0] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000001 [ 1131.557223][ C0] R13: dffffc0000000000 R14: ffff88802a7d3300 R15: 1ffff92000000fb8 [ 1131.557233][ C0] FS: 0000000000000000(0000) GS:ffff888123dec000(0000) knlGS:0000000000000000 [ 1131.557248][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1131.557258][ C0] CR2: 0000200000000100 CR3: 000000004f86b000 CR4: 00000000003526f0 [ 1131.557267][ C0] Call Trace: [ 1131.557273][ C0] [ 1131.557280][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 1131.557305][ C0] lock_release+0x24d/0x310 [ 1131.557324][ C0] _raw_spin_unlock_irqrestore+0x1a/0x80 [ 1131.557342][ C0] debug_object_deactivate+0x2e4/0x3b0 [ 1131.557360][ C0] ? __pfx_debug_object_deactivate+0x10/0x10 [ 1131.557379][ C0] ? timerqueue_linked_add+0x260/0x430 [ 1131.557395][ C0] __hrtimer_run_queues+0x2e9/0x9c0 [ 1131.557420][ C0] hrtimer_interrupt+0x3e5/0x940 [ 1131.557438][ C0] __sysvec_apic_timer_interrupt+0x109/0x470 [ 1131.557461][ C0] sysvec_apic_timer_interrupt+0x9e/0xc0 [ 1131.557479][ C0] [ 1131.557484][ C0] [ 1131.557489][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1131.557505][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1131.557522][ C0] Code: 65 8c 02 e9 83 4b 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 df 10 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 1131.557535][ C0] RSP: 0018:ffffffff8e807e10 EFLAGS: 00000246 [ 1131.557545][ C0] RAX: 0000000003b1cbe1 RBX: ffffffff8e891480 RCX: ffffffff8bbac335 [ 1131.557555][ C0] RDX: 0000000000000000 RSI: ffffffff8e1a8e56 RDI: ffffffff8c400380 [ 1131.557565][ C0] RBP: fffffbfff1d12290 R08: 0000000000000001 R09: ffffed101708678d [ 1131.557574][ C0] R10: ffff8880b8433c6b R11: 0000000000000000 R12: 0000000000000000 [ 1131.557583][ C0] R13: 0000000000000000 R14: 1ffffffff1d00fc6 R15: dffffc0000000000 [ 1131.557595][ C0] ? ct_kernel_exit+0x125/0x180 [ 1131.557614][ C0] default_idle+0x9/0x10 [ 1131.557632][ C0] default_idle_call+0x6c/0xb0 [ 1131.557650][ C0] do_idle+0x3a7/0x5b0 [ 1131.557669][ C0] ? __pfx_do_idle+0x10/0x10 [ 1131.557687][ C0] ? finish_task_switch.isra.0+0x14c/0x10c0 [ 1131.557710][ C0] cpu_startup_entry+0x4f/0x60 [ 1131.557729][ C0] rest_init+0x251/0x260 [ 1131.557749][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 1131.557764][ C0] start_kernel+0x48e/0x490 [ 1131.557784][ C0] x86_64_start_reservations+0x24/0x30 [ 1131.557805][ C0] x86_64_start_kernel+0x12b/0x130 [ 1131.557826][ C0] common_startup_64+0x13e/0x158 [ 1131.557845][ C0] [ 1131.558079][ C1] rcu: rcu_preempt kthread starved for 10505 jiffies! g112129 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 1131.906650][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1131.916607][ C1] rcu: RCU grace-period kthread stack dump: [ 1131.922477][ C1] task:rcu_preempt state:R running task stack:27432 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1131.935958][ C1] Call Trace: [ 1131.939236][ C1] [ 1131.942164][ C1] __schedule+0x125c/0x6730 [ 1131.946682][ C1] ? __pfx___schedule+0x10/0x10 [ 1131.951525][ C1] ? find_held_lock+0x2b/0x80 [ 1131.956548][ C1] ? schedule+0x225/0x2c0 [ 1131.960877][ C1] schedule+0xdd/0x2c0 [ 1131.965030][ C1] schedule_timeout+0x127/0x280 [ 1131.969875][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 1131.975248][ C1] ? __pfx_process_timeout+0x10/0x10 [ 1131.980529][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1131.986415][ C1] ? prepare_to_swait_event+0xdf/0x4a0 [ 1131.991873][ C1] rcu_gp_fqs_loop+0x1a9/0x900 [ 1131.996638][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1132.001921][ C1] ? __pfx_rcu_gp_init+0x10/0x10 [ 1132.006861][ C1] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 1132.012058][ C1] rcu_gp_kthread+0x179/0x230 [ 1132.016734][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1132.022010][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1132.027810][ C1] ? __kthread_parkme+0x18c/0x230 [ 1132.032843][ C1] ? kthread+0x13a/0x450 [ 1132.037073][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1132.042263][ C1] kthread+0x370/0x450 [ 1132.046323][ C1] ? __pfx_kthread+0x10/0x10 [ 1132.050991][ C1] ret_from_fork+0x72b/0xd50 [ 1132.055595][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1132.060717][ C1] ? __switch_to+0x800/0x10f0 [ 1132.065384][ C1] ? __pfx_kthread+0x10/0x10 [ 1132.069966][ C1] ret_from_fork_asm+0x1a/0x30 [ 1132.074764][ C1] [ 1132.077782][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 1132.084094][ C1] CPU: 1 UID: 0 PID: 19953 Comm: syz.3.3293 Tainted: G L syzkaller #0 PREEMPT(full) [ 1132.095020][ C1] Tainted: [L]=SOFTLOCKUP [ 1132.099328][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1132.109381][ C1] RIP: 0010:smp_call_function_many_cond+0x58e/0x1870 [ 1132.116056][ C1] Code: b8 00 00 00 00 00 fc ff df 48 8b 54 24 08 49 89 d5 49 89 d4 49 c1 ed 03 41 83 e4 07 49 01 c5 41 83 c4 03 e8 b4 9b 0c 00 f3 90 <41> 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 a8 10 00 00 8b 45 08 31 [ 1132.135653][ C1] RSP: 0018:ffffc900055cfb20 EFLAGS: 00000246 [ 1132.141722][ C1] RAX: 0000000000080000 RBX: 0000000000000000 RCX: ffffc90025315000 [ 1132.149702][ C1] RDX: 0000000000080000 RSI: ffffffff81fdc92c RDI: ffff88801eb52540 [ 1132.157663][ C1] RBP: ffff8880b8443680 R08: 0000000000000005 R09: 0000000000000000 [ 1132.165626][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003 [ 1132.173583][ C1] R13: ffffed10170886d1 R14: 0000000000000001 R15: ffff8880b853c880 [ 1132.181550][ C1] FS: 00007fc33be016c0(0000) GS:ffff888123eec000(0000) knlGS:0000000000000000 [ 1132.190472][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1132.197043][ C1] CR2: 00007fc33be00ff8 CR3: 00000000372d6000 CR4: 00000000003526f0 [ 1132.205093][ C1] Call Trace: [ 1132.208362][ C1] [ 1132.211285][ C1] ? __pfx_retrigger_next_event+0x10/0x10 [ 1132.217004][ C1] ? clock_was_set+0x1c3/0x850 [ 1132.221759][ C1] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 1132.228086][ C1] ? mark_held_locks+0x40/0x70 [ 1132.232849][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1132.238655][ C1] clock_was_set+0x61c/0x850 [ 1132.243241][ C1] ? __pfx_clock_was_set+0x10/0x10 [ 1132.248347][ C1] ? rcu_is_watching+0x12/0xc0 [ 1132.253107][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1132.258906][ C1] do_settimeofday64+0x330/0x4d0 [ 1132.263842][ C1] ? __pfx_do_settimeofday64+0x10/0x10 [ 1132.269295][ C1] ? security_capable+0x80/0x260 [ 1132.274226][ C1] ? rdma_join_multicast+0x9a2/0x1c00 [ 1132.279589][ C1] ? capable+0xd3/0xf0 [ 1132.283660][ C1] do_sys_settimeofday64+0x1dc/0x260 [ 1132.288940][ C1] __x64_sys_clock_settime+0x1c1/0x2a0 [ 1132.294388][ C1] ? __pfx___x64_sys_clock_settime+0x10/0x10 [ 1132.300367][ C1] do_syscall_64+0x115/0x870 [ 1132.304957][ C1] ? clear_bhb_loop+0x70/0xc0 [ 1132.309625][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1132.315506][ C1] RIP: 0033:0x7fc33af9e0d9 [ 1132.319912][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1132.339507][ C1] RSP: 002b:00007fc33be01028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e3 [ 1132.347911][ C1] RAX: ffffffffffffffda RBX: 00007fc33b226090 RCX: 00007fc33af9e0d9 [ 1132.355869][ C1] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000000 [ 1132.363826][ C1] RBP: 00007fc33b035024 R08: 0000000000000000 R09: 0000000000000000 [ 1132.371793][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1132.379749][ C1] R13: 00007fc33b226128 R14: 00007fc33b226090 R15: 00007ffe0098f8d8 [ 1132.387719][ C1]