last executing test programs:

8m50.421794794s ago: executing program 32 (id=89):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
ioctl$VHOST_VDPA_SET_GROUP_ASID(0xffffffffffffffff, 0x4008af7c, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000340)={0x2c, 0x0, 0x0, &(0x7f0000000400)={0x0, 0xf, 0x26, {0x5, 0xf, 0x26, 0x4, [@generic={0x3}, @wireless={0xb, 0x10, 0x1, 0x0, 0x0, 0x5d, 0x0, 0x1}, @generic={0x3, 0x10, 0xb}, @ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0x0, 0x0, 0x0, [0x30]}]}}, 0x0, 0x0}, 0x0)
syz_usb_control_io(r2, &(0x7f0000000340)={0x2c, &(0x7f00000001c0)=ANY=[@ANYBLOB="201006000000065f01"], 0x0, 0x0, 0x0, 0x0}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000010400c600"/20, @ANYRES32=r3, @ANYBLOB="46060900000000001c00128009000100626f6e64000000000c0002800800040088"], 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20008040)
r5 = socket$nl_route(0x10, 0x3, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x69)
ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000500)={{0x1, 0x1, 0x18, <r7=>r1, {0xb0}}, './file0\x00'})
preadv(r7, &(0x7f0000000a00)=[{&(0x7f0000000540)=""/183, 0xb7}, {&(0x7f0000000600)=""/218, 0xda}, {&(0x7f0000000700)=""/49, 0x31}, {&(0x7f0000000740)=""/125, 0x7d}, {&(0x7f00000007c0)=""/73, 0x49}, {&(0x7f0000000840)=""/131, 0x83}, {&(0x7f0000000900)=""/193, 0xc1}], 0x7, 0x7, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e000100697036677265746170000000180002801400", @ANYRES32=r6], 0x54}}, 0x0)
syz_genetlink_get_family_id$nl80211(0x0, r1)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000001c0)={'wlan1\x00'})

7m43.033883938s ago: executing program 33 (id=204):
syz_open_dev$sndpcmp(&(0x7f0000000180), 0x7d, 0x2300)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000020c0)={r0, 0x0, 0xb, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000bde5a44070275290f515010203010902120001000000000904"], 0x0)
syz_usb_control_io$sierra_net(r1, 0x0, 0x0)
syz_usb_control_io$uac2(r1, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000700)={0x0, 0x31}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$lan78xx(r1, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000022c0))
writev(0xffffffffffffffff, &(0x7f00000027c0)=[{&(0x7f00000001c0)}], 0x1)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x8, &(0x7f0000002340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_query, @generic={0x5, 0x9, 0x9, 0x7, 0x7}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="180000000300000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000010}, 0x8041)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2, 0x3}}, 0x2e)
getsockopt(r6, 0x111, 0x5, 0x0, &(0x7f00000001c0))
sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000002280)={&(0x7f0000002080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002140)={0xc4, 0x3ed, 0x400, 0x70bd2d, 0x25dfdbff, "865dae9f9ef0fa3d8b52e9aabfb192ccd09d743e8f88be593b6dc0fc62df1fcb53f0e0bc41ba8682e950ce01a0e5cb587c37e933d1e9ecae79524f53c78d08a454094a7694f96f267ab9d348025eaf01065dc6a75003785af241edb4e2760f5733d95055b3e3744a54f6a998a37a6868d788c4097ad4d2893287b7bcb537d1d6aa748b06a7c1f0ecef199cc73bf376dad9ca0386d6c183f4abfd869ee68d64da862f53d1bf673db635d967eb077acb4f9da1f85d", [""]}, 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000041)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r7 = syz_open_procfs(0x0, &(0x7f0000002040)='net/snmp6\x00')
read$FUSE(r7, &(0x7f0000000000)={0x2020}, 0xfffffc7a)
sendto$x25(r7, 0x0, 0x0, 0x2000c080, 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x2, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff00000000000000000004851000000600000018000000", @ANYRES32, @ANYBLOB="000000000000000066080000feffffff1800000000000000000000000000000195000000000000001801000020207825000000000b2020207b1af8ff00000000bfa100000000000007010000f8fbffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x3, &(0x7f0000000340)=""/222, 0x0, 0xc}, 0x94)

7m42.903064186s ago: executing program 34 (id=217):
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@random="67f8b54229e0", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, @loopback, @private=0xa810102}, "00186371ae9b1c03"}}}}}, 0x0)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48)
openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080), 0xf75e376bc33dbed3, 0x0)
r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000080))
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

7m42.828202124s ago: executing program 35 (id=218):
socket$nl_netfilter(0x10, 0x3, 0xc)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, 0x0, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000000))
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8004, 0x1000003, 0x2, 0x9db, 0xfffffe0000000001, 0xfa11, 0x2}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r2 = syz_open_dev$sg(0x0, 0x0, 0x802)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0xffffffffffffffff)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f00000001c0)={0x1, 0x0, [{0x400000b5}]})
ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f00000000c0))
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
syz_usb_connect(0x0, 0x24, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4)
r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0)
read$msr(r6, &(0x7f0000019680)=""/102392, 0xfffffe7b)
r7 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_linger(r7, 0x1, 0x50, &(0x7f0000000100)={0x0, 0x57}, 0x8)
bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000800000000100"/28], 0x50)
openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x800, 0x0)
r8 = syz_open_procfs(0xffffffffffffffff, 0x0)
read$FUSE(r8, &(0x7f0000004100)={0x2020}, 0x2020)
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

7m42.757636378s ago: executing program 36 (id=219):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'dummy0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00000018000506000000000000000023000000fe00000100000000050001000400000008000400", @ANYRES32=r2], 0x2c}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)=@dellink={0x20, 0x11, 0x5, 0x0, 0x0, {0x0, 0x0, 0x600, r2}}, 0x20}}, 0x0)

7m42.639572872s ago: executing program 37 (id=215):
socket$nl_route(0x10, 0x3, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x40402)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/address_bits', 0x800, 0x4)
read$char_usb(r1, &(0x7f0000000040)=""/236, 0xec)
pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x300000000000000, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0)

2m35.469806584s ago: executing program 9 (id=1217):
openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={<r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'wlan0\x00', <r2=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x5c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x42, 0x2021}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x24, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x3}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_DATA={0x10, 0x5, 0x0, 0x1, [{0xa, 0x4, @local}]}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x5c}, 0xfe, 0x0, 0x0, 0x4000010}, 0x8000002)

2m34.275616675s ago: executing program 9 (id=1221):
r0 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$cec(0x0, 0x0, 0x40000)
ioctl$CEC_S_MODE(r3, 0x40046109, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0)
socket$inet6(0xa, 0x1, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000070605000000000000000000010000020500010007000000946b9ad98d8b4f628bf8092767404bf02c67cba3992349df2a61a9c4b94426b6a81b5bfc11a573747f9da9d0d7bd95e847b88b4389a8a81c19"], 0x1c}, 0x1, 0x0, 0x3000000, 0x20004080}, 0x48810)
recvmsg(r6, 0x0, 0x20)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@can_newroute={0x2c, 0x18, 0x1, 0x70bd2c, 0x25dfdbfd, {0x1d, 0x1, 0x2}, [@CGW_MOD_SET={0x15, 0x4, {{{0x0, 0x0, 0x1}, 0x4, 0x0, 0x0, 0x0, "3f0d8de98686b453"}, 0x8b7e0472ff469332}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8800}, 0x80)

2m33.285560048s ago: executing program 9 (id=1226):
syz_open_dev$video4linux(&(0x7f0000000100), 0x5, 0x8000)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'})
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wlan0\x00'})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$NL80211_CMD_NEW_MPATH(r1, &(0x7f0000000900)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x50, r2, 0x400, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x17}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x40040c0}, 0x8000)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r4, 0x80044dfd, &(0x7f00000000c0))
r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0)
ioctl$PTP_SYS_OFFSET_EXTENDED(r5, 0xc4c03d09, &(0x7f0000000340)={0x2})
r6 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2)
ftruncate(r6, 0x80079a3)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
getpid()

2m31.71493186s ago: executing program 9 (id=1228):
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
getsockopt(r0, 0x29, 0x4e, 0x0, 0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x8)
io_getevents(0x0, 0x80, 0x5, &(0x7f0000000000)=[{}, {}, {}, {}, {}], &(0x7f00000000c0)={0x77359400})

2m29.765956347s ago: executing program 9 (id=1234):
r0 = socket$l2tp6(0xa, 0x2, 0x73)
bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x7, @empty, 0xe229, 0x1}, 0x20)
bind$l2tp6(r0, &(0x7f0000000040)={0xa, 0x7, 0x0, @dev={0xfe, 0x80, '\x00', 0x20}, 0x8, 0x400000}, 0x20)
open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x6, 0x0, 0x10, 0x7fff7ff9}, {0x9, 0x4, 0xa, 0x2}]})
gettid()
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xffffffffffffffff)
fcntl$setsig(r1, 0xa, 0x12)
ppoll(&(0x7f0000000100)=[{r2, 0x8440}], 0x1, 0x0, &(0x7f00000001c0)={[0x8001a0ffffffff]}, 0x8)
dup2(r1, r2)
mkdir(&(0x7f0000000540)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./trace\x00', &(0x7f0000000600)='tracefs\x00', 0x0, 0x0)
syz_usb_connect$midi(0x0, 0x39, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x582, 0x14, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x27, 0x1, 0x1, 0x3, 0x60, 0x5, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x30, 0x28, [@midi_in_jack={0x6, 0x24, 0x2, 0x0, 0x5, 0x3}], [{{0x9, 0x5, 0x9, 0x2, 0x10, 0x80, 0xd1, 0x7, {0x6, 0x25, 0x1, 0x2, "6d11"}}}]}}}}}]}}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0})
r3 = openat(0xffffff9c, &(0x7f0000000640)='./trace/events/mac80211/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000680)='1', 0x1)
setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000003d40), 0x4)
setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10)
r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r5 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10)
setsockopt$inet_mreq(r4, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8)
syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @broadcast, @val={@void, {0x8100, 0x0, 0x0, 0x3}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x38, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0x7ff, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @local}, "695a31130fbfeaee"}}}}}, 0x0)
setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000200)={@remote, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0x800b2, 0xfffffff7, 0x4, 0x40000006}, 0x3c)
r6 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00')
pread64(r6, &(0x7f0000000100)=""/253, 0xfd, 0x1)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e00)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4, 0x21}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x48}}, 0x8000000)

2m27.072137973s ago: executing program 7 (id=1242):
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x7, 0x7ae}}, './file0\x00'})
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e20, 0x0, @empty, 0xffffff3f}}, 0x0, 0x0, 0x24, 0x0, "4a17c54c3bf9e77d92012046e952cc6357fa8f920e0b5c888cf2f6d84abbd12a651f39a0750d6e87a85d791e6f24744a41df49b710ec4be69e195464ddaa380683cf7ae48db7faf868d26696a689e59d"}, 0xd8) (async)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e20, 0x0, @empty, 0xffffff3f}}, 0x0, 0x0, 0x24, 0x0, "4a17c54c3bf9e77d92012046e952cc6357fa8f920e0b5c888cf2f6d84abbd12a651f39a0750d6e87a85d791e6f24744a41df49b710ec4be69e195464ddaa380683cf7ae48db7faf868d26696a689e59d"}, 0xd8)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x2, 0x5, 0xf1, 0x9, 0xb, 0x0, 0x70bd2c, 0x25dfdbfe, [@sadb_lifetime={0x4, 0x3, 0xeaf, 0x3ff, 0x5, 0x1ff}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e24, @private=0xa010102}}]}, 0x58}}, 0x51)
sendto$inet(r0, &(0x7f0000000240)="cc7de134e73d4032fc243e54c795968c968157a202892b67ba3d06566bf8c811e3ddecf8f7622dafbe18a4e1ccd14d996131a9957cfff19d76be0e8c150e85591c09aeeb9b90fbc82247e75a535b9984b4eb4190396dabc843bf6a115f3b6482605a1c7510d1d16f45069c3d89f49f945e3e1fd436199f49c1f8939143d0f4cf7f786694c42288ba513870631164ff32d7a76285147cfd1c9f8d4bfae92d4e46fee18e5162b21c", 0xa7, 0x4008801, &(0x7f0000000300)={0x2, 0x4e22, @private=0xa010101}, 0x10)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x893a1b0fa0b39de5}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x6}}, [@NFT_MSG_NEWSET={0x100, 0x9, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x38}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x14}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x2}, @NFTA_SET_DESC={0xb0, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xa4, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x200}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x40}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x4}, {0x54, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}]}]}, @NFTA_SET_DESC_SIZE={0x8}]}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x128}, 0x1, 0x0, 0x0, 0x4}, 0x4010) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x893a1b0fa0b39de5}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x6}}, [@NFT_MSG_NEWSET={0x100, 0x9, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x38}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x14}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x2}, @NFTA_SET_DESC={0xb0, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xa4, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x200}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x40}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x4}, {0x54, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}]}]}, @NFTA_SET_DESC_SIZE={0x8}]}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x128}, 0x1, 0x0, 0x0, 0x4}, 0x4010)
preadv(r0, &(0x7f0000001900)=[{&(0x7f0000000540)=""/201, 0xc9}, {&(0x7f0000000640)=""/34, 0x22}, {&(0x7f0000000680)=""/197, 0xc5}, {&(0x7f0000000780)=""/185, 0xb9}, {&(0x7f0000000840)=""/177, 0xb1}, {&(0x7f0000000900)=""/4096, 0x1000}], 0x6, 0x8, 0x5)
r2 = syz_clone(0x50000800, &(0x7f0000001980)="1561c27e5a67277aac507000870c56f4ef6387be9892fa91ae58f7400af72f2ce2b2c1460c9afac6115d2909d063e9ab081026034a505166a4060bd27a15e313461ba2cd155fe38730a44f3c22306626ad9b8413b7286a49b7921dc20b3be4ecc35218388f0067066901161a2f8c21deab7b1a6c77e931ef66e7386d8dc94dfd268925b34e3bd82b823aa1580bc63ef922a832b5e08c576b2d44a7c871d010df984f0382fc0baf6d3df6e01e4dd7e977959f472bd938959505f71c325bb3c7953141e71fb456e7ae5507d9eec03f0b9befe68340fd3585eb44d6a4110e0dbf802669f2a397976dadb417021efc8e1089", 0xf0, &(0x7f0000001a80), &(0x7f0000001ac0), &(0x7f0000001b00)="db1e4d7fbb60f4b88c8659c0d38818834ffa4ec8922320b328e6f8e683e17206bfbc97e17c0e5f16c14056111f322feae7e6b4e78b530c224c21da3a5268a8c8899d9280be10d0a8e879fef357fe56c523a45579d7723c500392")
prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x1, &(0x7f0000001b80))
r3 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x74, 0xc, 0x40010, r0, 0x20000000)
r4 = mmap$IORING_OFF_PBUF_RING(0x0, 0xc, 0x8, 0x110, r0, 0x872719e2)
syz_ublk_add_dev(r0, 0x0, 0x0, 0x0, &(0x7f0000001c00)={0x2e, 0x0, 0x0, <r5=>r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xa9e5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001bc0)=@new_dev={0x3, 0x72d, 0x0, 0x0, 0x1000, 0xffffffff, r2, 0x0, 0x4}}}, &(0x7f0000001c80))
io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) (async)
r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
syz_ublk_add_dev(r0, r3, r4, 0x0, &(0x7f0000001d00)={0x2e, 0x4, 0x0, r5, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, r6, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001cc0)=@any_dev={0x3, 0x50b, 0x0, 0x0, 0x1000, 0x40, r2, 0x0, 0x80}}}, &(0x7f0000001d80))
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001dc0)={{0x1, 0x3, 0x0, 0x1, 0x100}})
ioctl$BLKCRYPTOPREPAREKEY(r0, 0xc040128b, &(0x7f0000001e80)={&(0x7f0000001e00)="d0513c23af7f45d634e900d632583a47a4dc2ca41b0f74b771731b8349b407a4", 0x20, &(0x7f0000001e40)=""/14, 0xe})
ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000001ec0)) (async)
ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000001ec0))
openat$cuse(0xffffffffffffff9c, &(0x7f0000001f00), 0x2, 0x0) (async)
r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001f00), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000001f40)={0x2020, 0x0, <r8=>0x0}, 0x2020)
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000003f80)={0x0, 0xdd, {r2}, {<r9=>0xffffffffffffffff}, 0x7, 0x39af28b9})
getresgid(&(0x7f0000003fc0), &(0x7f0000004000), &(0x7f0000004040)) (async)
getresgid(&(0x7f0000003fc0)=<r10=>0x0, &(0x7f0000004000), &(0x7f0000004040))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000004080)={0x0, <r11=>0x0}, &(0x7f00000040c0)=0xc)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000004100)={{{@in, @in6=@empty}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f0000004200)=0xe8) (async)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000004100)={{{@in, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r12=>0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f0000004200)=0xe8)
r13 = getegid()
write$FUSE_DIRENTPLUS(r7, &(0x7f0000004240)={0x1f0, 0x0, r8, [{{0x6, 0x2, 0x5, 0xffffffff, 0x1ff, 0x3, {0x3, 0x6, 0x1, 0x83, 0x6, 0x7, 0x8000, 0x3, 0x1, 0xa000, 0x2, r9, r10, 0x0, 0x80000001}}, {0x4, 0x4, 0x5, 0x1, 'syz0\x00'}}, {{0x6, 0x2, 0xa, 0x7, 0x9, 0x2, {0x3, 0x0, 0x9, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8000, 0x1, 0xb51, 0xdd3, 0x1000, 0x3924, r11, 0xee01, 0xffffffff, 0x9}}, {0x3, 0x5, 0x2, 0x57, '\xea!'}}, {{0x2, 0x2, 0x8, 0x0, 0x1, 0xffff, {0x1, 0x5, 0x7fffffffffffffff, 0x19e000000000, 0x9, 0x101, 0x5, 0x5, 0x6, 0x6000, 0x400, r12, r13, 0x9, 0x4}}, {0x3, 0x8, 0x5, 0x1, 'syz0\x00'}}]}, 0x1f0) (async)
write$FUSE_DIRENTPLUS(r7, &(0x7f0000004240)={0x1f0, 0x0, r8, [{{0x6, 0x2, 0x5, 0xffffffff, 0x1ff, 0x3, {0x3, 0x6, 0x1, 0x83, 0x6, 0x7, 0x8000, 0x3, 0x1, 0xa000, 0x2, r9, r10, 0x0, 0x80000001}}, {0x4, 0x4, 0x5, 0x1, 'syz0\x00'}}, {{0x6, 0x2, 0xa, 0x7, 0x9, 0x2, {0x3, 0x0, 0x9, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8000, 0x1, 0xb51, 0xdd3, 0x1000, 0x3924, r11, 0xee01, 0xffffffff, 0x9}}, {0x3, 0x5, 0x2, 0x57, '\xea!'}}, {{0x2, 0x2, 0x8, 0x0, 0x1, 0xffff, {0x1, 0x5, 0x7fffffffffffffff, 0x19e000000000, 0x9, 0x101, 0x5, 0x5, 0x6, 0x6000, 0x400, r12, r13, 0x9, 0x4}}, {0x3, 0x8, 0x5, 0x1, 'syz0\x00'}}]}, 0x1f0)
syz_emit_vhci(&(0x7f0000004440)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x61}, "c6c2cf42219a8668ddd7fd1785a77da762d3fbd62a6bae8393c38fba624d53012ecf13f79fed67670678480f062b1ceafff07beb8b66a5c4f0ae91343a4f529fa3caac57b96cb429fad4930a75ead4d7a82793209348df3b45366e280fda44a0f2"}, 0x65)
r14 = signalfd4(r7, &(0x7f00000044c0), 0x8, 0x800)
r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004540), r0)
sendmsg$NL80211_CMD_START_AP(r14, &(0x7f00000047c0)={&(0x7f0000004500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000004780)={&(0x7f0000004580)={0x1f0, r15, 0x1, 0x70bd27, 0x7, {{}, {@void, @val={0xc, 0x99, {0x1, 0x6a}}}}, [@beacon=[@NL80211_ATTR_FTM_RESPONDER={0x16c, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0x27, 0x3, "718bf52c504f1d83be23cd13df936b9ce67be5a7cd7876fe89406a518836508be9b642"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xc6, 0x3, "ea15060fca348d9844c3d2427217fcf7abad45b19982da3f3c8f87c4bd03e15adf4df1aa2bec9914519ba080a47b83b829f832408e8fc17aa5a2255d5304c9bd44a132e0319e89dd75f6beb4236786239b913487089c57e5e85d8c24a54d4a5a7266bbac881c549c19a5f15364374c424f4a7c5e1349d6d56171667b47f51d296a49ddacbe613a9c9b3c371604e62b7e345f70274c65dadf358c2734056fd756c493c9084df0afae91bf4a863dd1a0d272b3d62d0082a18f753a5569c54fc2c615c0"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x60, 0x3, "410a911c7002812e7164bc6af44939b830ed8f9f0185543ff90a8d3cf0eb4b7a134e3819482e4ce8a293e5322a09496db340533472d9a5608bffca307d7a01c5bf51e591a5930747a768ecfb57eff9474a2438e8c650bdfb9c674247"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xf, 0x3, "b0a6c7b6097227c30168de"}]}, @NL80211_ATTR_IE_ASSOC_RESP={0xd, 0x80, [@sec_chan_ofs={0x3e, 0x1, 0x1}, @ext_channel_switch={0x3c, 0x4, {0x1, 0xc, 0x5, 0x8}}]}, @NL80211_ATTR_BEACON_TAIL={0x3d, 0xf, [@ext_channel_switch={0x3c, 0x4, {0x1, 0xea, 0xb0, 0x5}}, @challenge={0x10, 0x1, 0x57}, @mesh_chsw={0x76, 0x6, {0x6, 0x8c, 0x2, 0xfffc}}, @link_id={0x65, 0x12, {@random="eab52109997a", @device_b, @broadcast}}, @link_id={0x65, 0x12, {@random="42f771fa8fbc", @device_b, @device_b}}]}], @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x5}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x4c1a}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x85}, 0x10) (async)
sendmsg$NL80211_CMD_START_AP(r14, &(0x7f00000047c0)={&(0x7f0000004500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000004780)={&(0x7f0000004580)={0x1f0, r15, 0x1, 0x70bd27, 0x7, {{}, {@void, @val={0xc, 0x99, {0x1, 0x6a}}}}, [@beacon=[@NL80211_ATTR_FTM_RESPONDER={0x16c, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0x27, 0x3, "718bf52c504f1d83be23cd13df936b9ce67be5a7cd7876fe89406a518836508be9b642"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xc6, 0x3, "ea15060fca348d9844c3d2427217fcf7abad45b19982da3f3c8f87c4bd03e15adf4df1aa2bec9914519ba080a47b83b829f832408e8fc17aa5a2255d5304c9bd44a132e0319e89dd75f6beb4236786239b913487089c57e5e85d8c24a54d4a5a7266bbac881c549c19a5f15364374c424f4a7c5e1349d6d56171667b47f51d296a49ddacbe613a9c9b3c371604e62b7e345f70274c65dadf358c2734056fd756c493c9084df0afae91bf4a863dd1a0d272b3d62d0082a18f753a5569c54fc2c615c0"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x60, 0x3, "410a911c7002812e7164bc6af44939b830ed8f9f0185543ff90a8d3cf0eb4b7a134e3819482e4ce8a293e5322a09496db340533472d9a5608bffca307d7a01c5bf51e591a5930747a768ecfb57eff9474a2438e8c650bdfb9c674247"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xf, 0x3, "b0a6c7b6097227c30168de"}]}, @NL80211_ATTR_IE_ASSOC_RESP={0xd, 0x80, [@sec_chan_ofs={0x3e, 0x1, 0x1}, @ext_channel_switch={0x3c, 0x4, {0x1, 0xc, 0x5, 0x8}}]}, @NL80211_ATTR_BEACON_TAIL={0x3d, 0xf, [@ext_channel_switch={0x3c, 0x4, {0x1, 0xea, 0xb0, 0x5}}, @challenge={0x10, 0x1, 0x57}, @mesh_chsw={0x76, 0x6, {0x6, 0x8c, 0x2, 0xfffc}}, @link_id={0x65, 0x12, {@random="eab52109997a", @device_b, @broadcast}}, @link_id={0x65, 0x12, {@random="42f771fa8fbc", @device_b, @device_b}}]}], @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x5}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x4c1a}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x85}, 0x10)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000004800)=0x1) (async)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000004800)=0x1)

2m26.799774218s ago: executing program 38 (id=1242):
ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x7, 0x7ae}}, './file0\x00'})
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e20, 0x0, @empty, 0xffffff3f}}, 0x0, 0x0, 0x24, 0x0, "4a17c54c3bf9e77d92012046e952cc6357fa8f920e0b5c888cf2f6d84abbd12a651f39a0750d6e87a85d791e6f24744a41df49b710ec4be69e195464ddaa380683cf7ae48db7faf868d26696a689e59d"}, 0xd8) (async)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e20, 0x0, @empty, 0xffffff3f}}, 0x0, 0x0, 0x24, 0x0, "4a17c54c3bf9e77d92012046e952cc6357fa8f920e0b5c888cf2f6d84abbd12a651f39a0750d6e87a85d791e6f24744a41df49b710ec4be69e195464ddaa380683cf7ae48db7faf868d26696a689e59d"}, 0xd8)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x2, 0x5, 0xf1, 0x9, 0xb, 0x0, 0x70bd2c, 0x25dfdbfe, [@sadb_lifetime={0x4, 0x3, 0xeaf, 0x3ff, 0x5, 0x1ff}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e24, @private=0xa010102}}]}, 0x58}}, 0x51)
sendto$inet(r0, &(0x7f0000000240)="cc7de134e73d4032fc243e54c795968c968157a202892b67ba3d06566bf8c811e3ddecf8f7622dafbe18a4e1ccd14d996131a9957cfff19d76be0e8c150e85591c09aeeb9b90fbc82247e75a535b9984b4eb4190396dabc843bf6a115f3b6482605a1c7510d1d16f45069c3d89f49f945e3e1fd436199f49c1f8939143d0f4cf7f786694c42288ba513870631164ff32d7a76285147cfd1c9f8d4bfae92d4e46fee18e5162b21c", 0xa7, 0x4008801, &(0x7f0000000300)={0x2, 0x4e22, @private=0xa010101}, 0x10)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x893a1b0fa0b39de5}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x6}}, [@NFT_MSG_NEWSET={0x100, 0x9, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x38}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x14}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x2}, @NFTA_SET_DESC={0xb0, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xa4, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x200}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x40}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x4}, {0x54, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}]}]}, @NFTA_SET_DESC_SIZE={0x8}]}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x128}, 0x1, 0x0, 0x0, 0x4}, 0x4010) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x893a1b0fa0b39de5}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x6}}, [@NFT_MSG_NEWSET={0x100, 0x9, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x38}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x14}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x2}, @NFTA_SET_DESC={0xb0, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xa4, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x200}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x40}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x4}, {0x54, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}]}]}, @NFTA_SET_DESC_SIZE={0x8}]}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x128}, 0x1, 0x0, 0x0, 0x4}, 0x4010)
preadv(r0, &(0x7f0000001900)=[{&(0x7f0000000540)=""/201, 0xc9}, {&(0x7f0000000640)=""/34, 0x22}, {&(0x7f0000000680)=""/197, 0xc5}, {&(0x7f0000000780)=""/185, 0xb9}, {&(0x7f0000000840)=""/177, 0xb1}, {&(0x7f0000000900)=""/4096, 0x1000}], 0x6, 0x8, 0x5)
r2 = syz_clone(0x50000800, &(0x7f0000001980)="1561c27e5a67277aac507000870c56f4ef6387be9892fa91ae58f7400af72f2ce2b2c1460c9afac6115d2909d063e9ab081026034a505166a4060bd27a15e313461ba2cd155fe38730a44f3c22306626ad9b8413b7286a49b7921dc20b3be4ecc35218388f0067066901161a2f8c21deab7b1a6c77e931ef66e7386d8dc94dfd268925b34e3bd82b823aa1580bc63ef922a832b5e08c576b2d44a7c871d010df984f0382fc0baf6d3df6e01e4dd7e977959f472bd938959505f71c325bb3c7953141e71fb456e7ae5507d9eec03f0b9befe68340fd3585eb44d6a4110e0dbf802669f2a397976dadb417021efc8e1089", 0xf0, &(0x7f0000001a80), &(0x7f0000001ac0), &(0x7f0000001b00)="db1e4d7fbb60f4b88c8659c0d38818834ffa4ec8922320b328e6f8e683e17206bfbc97e17c0e5f16c14056111f322feae7e6b4e78b530c224c21da3a5268a8c8899d9280be10d0a8e879fef357fe56c523a45579d7723c500392")
prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x1, &(0x7f0000001b80))
r3 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x74, 0xc, 0x40010, r0, 0x20000000)
r4 = mmap$IORING_OFF_PBUF_RING(0x0, 0xc, 0x8, 0x110, r0, 0x872719e2)
syz_ublk_add_dev(r0, 0x0, 0x0, 0x0, &(0x7f0000001c00)={0x2e, 0x0, 0x0, <r5=>r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xa9e5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001bc0)=@new_dev={0x3, 0x72d, 0x0, 0x0, 0x1000, 0xffffffff, r2, 0x0, 0x4}}}, &(0x7f0000001c80))
io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) (async)
r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
syz_ublk_add_dev(r0, r3, r4, 0x0, &(0x7f0000001d00)={0x2e, 0x4, 0x0, r5, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, r6, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001cc0)=@any_dev={0x3, 0x50b, 0x0, 0x0, 0x1000, 0x40, r2, 0x0, 0x80}}}, &(0x7f0000001d80))
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001dc0)={{0x1, 0x3, 0x0, 0x1, 0x100}})
ioctl$BLKCRYPTOPREPAREKEY(r0, 0xc040128b, &(0x7f0000001e80)={&(0x7f0000001e00)="d0513c23af7f45d634e900d632583a47a4dc2ca41b0f74b771731b8349b407a4", 0x20, &(0x7f0000001e40)=""/14, 0xe})
ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000001ec0)) (async)
ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000001ec0))
openat$cuse(0xffffffffffffff9c, &(0x7f0000001f00), 0x2, 0x0) (async)
r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001f00), 0x2, 0x0)
read$FUSE(r0, &(0x7f0000001f40)={0x2020, 0x0, <r8=>0x0}, 0x2020)
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000003f80)={0x0, 0xdd, {r2}, {<r9=>0xffffffffffffffff}, 0x7, 0x39af28b9})
getresgid(&(0x7f0000003fc0), &(0x7f0000004000), &(0x7f0000004040)) (async)
getresgid(&(0x7f0000003fc0)=<r10=>0x0, &(0x7f0000004000), &(0x7f0000004040))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000004080)={0x0, <r11=>0x0}, &(0x7f00000040c0)=0xc)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000004100)={{{@in, @in6=@empty}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f0000004200)=0xe8) (async)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000004100)={{{@in, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r12=>0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f0000004200)=0xe8)
r13 = getegid()
write$FUSE_DIRENTPLUS(r7, &(0x7f0000004240)={0x1f0, 0x0, r8, [{{0x6, 0x2, 0x5, 0xffffffff, 0x1ff, 0x3, {0x3, 0x6, 0x1, 0x83, 0x6, 0x7, 0x8000, 0x3, 0x1, 0xa000, 0x2, r9, r10, 0x0, 0x80000001}}, {0x4, 0x4, 0x5, 0x1, 'syz0\x00'}}, {{0x6, 0x2, 0xa, 0x7, 0x9, 0x2, {0x3, 0x0, 0x9, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8000, 0x1, 0xb51, 0xdd3, 0x1000, 0x3924, r11, 0xee01, 0xffffffff, 0x9}}, {0x3, 0x5, 0x2, 0x57, '\xea!'}}, {{0x2, 0x2, 0x8, 0x0, 0x1, 0xffff, {0x1, 0x5, 0x7fffffffffffffff, 0x19e000000000, 0x9, 0x101, 0x5, 0x5, 0x6, 0x6000, 0x400, r12, r13, 0x9, 0x4}}, {0x3, 0x8, 0x5, 0x1, 'syz0\x00'}}]}, 0x1f0) (async)
write$FUSE_DIRENTPLUS(r7, &(0x7f0000004240)={0x1f0, 0x0, r8, [{{0x6, 0x2, 0x5, 0xffffffff, 0x1ff, 0x3, {0x3, 0x6, 0x1, 0x83, 0x6, 0x7, 0x8000, 0x3, 0x1, 0xa000, 0x2, r9, r10, 0x0, 0x80000001}}, {0x4, 0x4, 0x5, 0x1, 'syz0\x00'}}, {{0x6, 0x2, 0xa, 0x7, 0x9, 0x2, {0x3, 0x0, 0x9, 0x7fffffffffffffff, 0xffffffffffffffff, 0x8000, 0x1, 0xb51, 0xdd3, 0x1000, 0x3924, r11, 0xee01, 0xffffffff, 0x9}}, {0x3, 0x5, 0x2, 0x57, '\xea!'}}, {{0x2, 0x2, 0x8, 0x0, 0x1, 0xffff, {0x1, 0x5, 0x7fffffffffffffff, 0x19e000000000, 0x9, 0x101, 0x5, 0x5, 0x6, 0x6000, 0x400, r12, r13, 0x9, 0x4}}, {0x3, 0x8, 0x5, 0x1, 'syz0\x00'}}]}, 0x1f0)
syz_emit_vhci(&(0x7f0000004440)=@HCI_SCODATA_PKT={0x3, {0xc8, 0x61}, "c6c2cf42219a8668ddd7fd1785a77da762d3fbd62a6bae8393c38fba624d53012ecf13f79fed67670678480f062b1ceafff07beb8b66a5c4f0ae91343a4f529fa3caac57b96cb429fad4930a75ead4d7a82793209348df3b45366e280fda44a0f2"}, 0x65)
r14 = signalfd4(r7, &(0x7f00000044c0), 0x8, 0x800)
r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004540), r0)
sendmsg$NL80211_CMD_START_AP(r14, &(0x7f00000047c0)={&(0x7f0000004500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000004780)={&(0x7f0000004580)={0x1f0, r15, 0x1, 0x70bd27, 0x7, {{}, {@void, @val={0xc, 0x99, {0x1, 0x6a}}}}, [@beacon=[@NL80211_ATTR_FTM_RESPONDER={0x16c, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0x27, 0x3, "718bf52c504f1d83be23cd13df936b9ce67be5a7cd7876fe89406a518836508be9b642"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xc6, 0x3, "ea15060fca348d9844c3d2427217fcf7abad45b19982da3f3c8f87c4bd03e15adf4df1aa2bec9914519ba080a47b83b829f832408e8fc17aa5a2255d5304c9bd44a132e0319e89dd75f6beb4236786239b913487089c57e5e85d8c24a54d4a5a7266bbac881c549c19a5f15364374c424f4a7c5e1349d6d56171667b47f51d296a49ddacbe613a9c9b3c371604e62b7e345f70274c65dadf358c2734056fd756c493c9084df0afae91bf4a863dd1a0d272b3d62d0082a18f753a5569c54fc2c615c0"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x60, 0x3, "410a911c7002812e7164bc6af44939b830ed8f9f0185543ff90a8d3cf0eb4b7a134e3819482e4ce8a293e5322a09496db340533472d9a5608bffca307d7a01c5bf51e591a5930747a768ecfb57eff9474a2438e8c650bdfb9c674247"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xf, 0x3, "b0a6c7b6097227c30168de"}]}, @NL80211_ATTR_IE_ASSOC_RESP={0xd, 0x80, [@sec_chan_ofs={0x3e, 0x1, 0x1}, @ext_channel_switch={0x3c, 0x4, {0x1, 0xc, 0x5, 0x8}}]}, @NL80211_ATTR_BEACON_TAIL={0x3d, 0xf, [@ext_channel_switch={0x3c, 0x4, {0x1, 0xea, 0xb0, 0x5}}, @challenge={0x10, 0x1, 0x57}, @mesh_chsw={0x76, 0x6, {0x6, 0x8c, 0x2, 0xfffc}}, @link_id={0x65, 0x12, {@random="eab52109997a", @device_b, @broadcast}}, @link_id={0x65, 0x12, {@random="42f771fa8fbc", @device_b, @device_b}}]}], @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x5}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x4c1a}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x85}, 0x10) (async)
sendmsg$NL80211_CMD_START_AP(r14, &(0x7f00000047c0)={&(0x7f0000004500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000004780)={&(0x7f0000004580)={0x1f0, r15, 0x1, 0x70bd27, 0x7, {{}, {@void, @val={0xc, 0x99, {0x1, 0x6a}}}}, [@beacon=[@NL80211_ATTR_FTM_RESPONDER={0x16c, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0x27, 0x3, "718bf52c504f1d83be23cd13df936b9ce67be5a7cd7876fe89406a518836508be9b642"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xc6, 0x3, "ea15060fca348d9844c3d2427217fcf7abad45b19982da3f3c8f87c4bd03e15adf4df1aa2bec9914519ba080a47b83b829f832408e8fc17aa5a2255d5304c9bd44a132e0319e89dd75f6beb4236786239b913487089c57e5e85d8c24a54d4a5a7266bbac881c549c19a5f15364374c424f4a7c5e1349d6d56171667b47f51d296a49ddacbe613a9c9b3c371604e62b7e345f70274c65dadf358c2734056fd756c493c9084df0afae91bf4a863dd1a0d272b3d62d0082a18f753a5569c54fc2c615c0"}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x60, 0x3, "410a911c7002812e7164bc6af44939b830ed8f9f0185543ff90a8d3cf0eb4b7a134e3819482e4ce8a293e5322a09496db340533472d9a5608bffca307d7a01c5bf51e591a5930747a768ecfb57eff9474a2438e8c650bdfb9c674247"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0xf, 0x3, "b0a6c7b6097227c30168de"}]}, @NL80211_ATTR_IE_ASSOC_RESP={0xd, 0x80, [@sec_chan_ofs={0x3e, 0x1, 0x1}, @ext_channel_switch={0x3c, 0x4, {0x1, 0xc, 0x5, 0x8}}]}, @NL80211_ATTR_BEACON_TAIL={0x3d, 0xf, [@ext_channel_switch={0x3c, 0x4, {0x1, 0xea, 0xb0, 0x5}}, @challenge={0x10, 0x1, 0x57}, @mesh_chsw={0x76, 0x6, {0x6, 0x8c, 0x2, 0xfffc}}, @link_id={0x65, 0x12, {@random="eab52109997a", @device_b, @broadcast}}, @link_id={0x65, 0x12, {@random="42f771fa8fbc", @device_b, @device_b}}]}], @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x5}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x4c1a}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x85}, 0x10)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000004800)=0x1) (async)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000004800)=0x1)

2m26.643724222s ago: executing program 9 (id=1245):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./rec\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/nfsv4recoverydir\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='./rec\x00', 0x6)
r1 = socket$inet_tcp(0x2, 0x1, 0x6)
mmap$usbfs(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xa, 0x90030, r0, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/versions\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, <r4=>0x0}, 0x2020)
write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50)
syz_fuse_handle_req(r3, &(0x7f0000004200)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x0, {0x0, 0x3022d6e144aa3cee}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x28a43, 0x0)
write(r2, &(0x7f0000000100)='-2 -3 +4\n\x00', 0x9)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r5, &(0x7f0000000300)='5\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r6, &(0x7f0000000100)='1\n\x00', 0x2)

2m21.365205609s ago: executing program 8 (id=1256):
syz_emit_ethernet(0xa6, &(0x7f0000000000)={@link_local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "010120", 0x70, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x60, 0x7000000, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96489269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000000000400260004000000"}]}}}}}}, 0x0)

2m21.310756137s ago: executing program 8 (id=1257):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00@\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fcdbdf250000000008000100", @ANYRES32=0x0, @ANYBLOB="0800020001f9"], 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4004010)

2m21.176356644s ago: executing program 8 (id=1258):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000001c0)=ANY=[@ANYRESDEC=0x0], 0x114}], 0x1, 0x0, 0x0, 0x4}, 0x0)
r1 = socket(0xa, 0x5, 0x1d9)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000003c0)=[@in6={0xa, 0x4e22, 0x791599b7, @dev={0xfe, 0x80, '\x00', 0x15}, 0x7117}], 0x1c)
pipe2$watch_queue(&(0x7f0000000080)={<r2=>0xffffffffffffffff}, 0x80)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80200, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000340)={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x306, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}}, 0x8, {0x2, 0x4e22, @multicast2}, 'pimreg1\x00'})
r5 = eventfd(0x8c66)
ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000240)={0x27800000000, 0x0, 0x0, r5})
close_range(r2, 0xffffffffffffffff, 0x0)
setsockopt$PNPIPE_INITSTATE(r1, 0x113, 0x4, &(0x7f0000000100)=0x1, 0x4)
listen(r1, 0x100)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000000)={0x0, &(0x7f0000000100)})
pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCBRADDBR(r6, 0x89a0, &(0x7f0000000100)='dvmrp0\x00')
r7 = dup(r1)
sendmsg$inet_sctp(r7, &(0x7f00000000c0)={&(0x7f00000002c0)=@in6={0xa, 0x4e23, 0xd1, @empty, 0x43f}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000300)="d9", 0x1}], 0x1, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x18, 0x4040854}, 0x8050)
setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r7, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x4e22, @empty}], 0x10)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000002100010000000000fcdbdf2502000000000000000000000006001d"], 0x2c}}, 0x0)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'bond0\x00', 0x2000})

2m20.817279476s ago: executing program 8 (id=1259):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000009c0), 0xffffffffffffffff)
openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7)
r4 = socket(0x2b, 0x1, 0x1)
getsockname$packet(r4, 0x0, &(0x7f0000000080))
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000240)={@empty, @private, <r5=>0x0}, &(0x7f0000000280)=0xc)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'netdevsim0\x00', <r6=>0x0})
sendmsg$nl_route(r4, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@ipv6_getnexthop={0x38, 0x6a, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@NHA_OIF={0x8, 0x5, r5}, @NHA_OIF={0x8, 0x5, r6}, @NHA_ID={0x8}, @NHA_MASTER={0x8, 0xa, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004800}, 0x4040)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r8, 0x0, 0x0, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r1, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r2, 0x1, 0x70bd2d, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x4}, {0x6, 0x16, 0xb}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x80}, {0x8, 0xb, 0x6}}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x13000000}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x205, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x0)

2m19.881459627s ago: executing program 8 (id=1261):
prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000200)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000800000/0x800000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000d19000/0x3000)=nil, &(0x7f0000935000/0xf000)=nil, &(0x7f0000df1000/0x4000)=nil, &(0x7f0000f2a000/0x1000)=nil, &(0x7f00008cd000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0}, 0x68)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000340)={0x0, 'macsec0\x00'})
io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xcf67, 0x1f480, 0x0, 0x399})
r2 = socket$inet(0x2, 0x3, 0x2)
r3 = syz_open_dev$sg(&(0x7f0000000300), 0x2, 0x4040)
ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380)
setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000140)={0x6, {{0x2, 0x0, @multicast1}}}, 0x88)
r4 = socket$kcm(0x29, 0x2, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811)
mount(&(0x7f0000000180)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='mqueue\x00', 0x200000, &(0x7f0000000280)='\x00')
ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f0000000200)={r4})

2m19.575623661s ago: executing program 8 (id=1264):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048e8)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, &(0x7f0000000c40)={0x1c, &(0x7f0000000240)={0x20, 0xd, 0x1, "02"}, 0x0, 0x0})
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}}, 0x4000080)
r3 = getpid()
prlimit64(r3, 0xe, &(0x7f0000000040)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
poll(0x0, 0x0, 0x4)
read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8)
timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4}, &(0x7f0000044000))
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0)
quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)

2m11.45694694s ago: executing program 39 (id=1245):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./rec\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/nfsv4recoverydir\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='./rec\x00', 0x6)
r1 = socket$inet_tcp(0x2, 0x1, 0x6)
mmap$usbfs(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xa, 0x90030, r0, 0x0)
bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10)
listen(r1, 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/versions\x00', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, <r4=>0x0}, 0x2020)
write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50)
syz_fuse_handle_req(r3, &(0x7f0000004200)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x0, {0x0, 0x3022d6e144aa3cee}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x28a43, 0x0)
write(r2, &(0x7f0000000100)='-2 -3 +4\n\x00', 0x9)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/portlist\x00', 0x1, 0x0)
write(r5, &(0x7f0000000300)='5\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x1, 0x0)
write(r6, &(0x7f0000000100)='1\n\x00', 0x2)

2m4.07385419s ago: executing program 40 (id=1264):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048e8)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, &(0x7f0000000c40)={0x1c, &(0x7f0000000240)={0x20, 0xd, 0x1, "02"}, 0x0, 0x0})
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}}, 0x4000080)
r3 = getpid()
prlimit64(r3, 0xe, &(0x7f0000000040)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
poll(0x0, 0x0, 0x4)
read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8)
timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4}, &(0x7f0000044000))
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0)
quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)

1m49.396599421s ago: executing program 0 (id=1333):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000300)=@abs={0x1, 0x0, 0x4e20}, 0x73)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r2 = syz_clone(0x180, &(0x7f0000000280)="d06fd3e6dd7972a1ef36c8c7751a8993b8a3511fd0dfc7eedb87dba6764364cecd1bc1e8564274f2cf9496de0119d22068ce263d691160a753eb6ce6f434680e6752432fcef210124209e8379d25e8d03763821f4264fadada8b9ffd3890a6bbb4166c929361f2daac5ca9bf0a71e3be2f19cc995b91e132172e2115977776", 0x7f, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)="d5c059c03e49a3c756da0fc09deffc25bc5049e52a813c24f37c50b7a5cb427e36d9112c4af77706775d882e5b8de893d9430cb3b9285c481c9da4bc2ce76f7e30535ec92c32e63735dc1f132cd6960268")
sched_setattr(r2, &(0x7f0000000000)={0x38, 0x0, 0x10000018, 0x8000, 0x2, 0x8, 0x400000000000010, 0x80, 0xfa0e, 0x127c33e1}, 0x0)
mount(0x0, 0x0, 0x0, 0x44021, 0x0)
madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x80000000e)
syz_emit_ethernet(0x7e, &(0x7f00000006c0)=ANY=[@ANYBLOB="01ffffffffff86dd6000ff8000481100fe8000000000000000000000000000bbff02000000000000000000000000000100004e2286cf255fcf4260bfb2ebb0080048907804000000000000007d91b3ccaf4c63521df8f969a9a3ef8377d86e2c440f000000000000001c32d5f00ce4a5807ebb53fbfc8fbe4761a7cfe44dcf957dbdc9460000000000007713720bf527e5307f113f69c9b76041272029d8f23d990abb28ffbae8dd465b70875014668fb860b53c1d15e34ffcf9075d219e2678af46dcdce0faab29"], 0x0)
set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
io_uring_register$IORING_REGISTER_FILES_UPDATE2(0xffffffffffffffff, 0x2, &(0x7f0000002d40)={0x0, 0x0, 0x0, 0x0}, 0x20)
r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0x75, 0x3501)
ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000240)=@urb_type_control={0x2, {}, 0x0, 0x41, &(0x7f00000004c0)={0x80, 0x14, 0x14, 0x3}, 0xfffffffffffffefe, 0x800000, 0x4, 0x0, 0x0, 0x0, 0x0})
io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000000040)={0x5, 0xffffffffffffffff, 0x3e, {0xe5, 0x3}, 0x2}, 0x1)
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x40000, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60)
ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r7, 0x4068aea3, 0x0)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0xfffffffffffffeaf, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[], 0xac}, 0x1, 0x0, 0x0, 0x1404c0c1}, 0x20044040)
connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r8 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r8, 0x400448c8, &(0x7f0000000600)={r4, r4, 0x6, 0x0, 0x0, 0x62, 0xfe, 0x10cf, 0x5, 0x5, 0x2, 0x2, 'syz1\x00'})
shutdown(r4, 0x1)
mlock(&(0x7f00008ae000/0x1000)=nil, 0x1000)

1m46.60931027s ago: executing program 0 (id=1341):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7fc}], 0x2c)
sendto$inet6(r1, &(0x7f0000000040)="e4", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
readv(r1, &(0x7f0000000d00)=[{&(0x7f0000000780)=""/155, 0x9b}, {0x0}], 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000012c0)='./file0\x00', 0x81)
rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='./file0/file0\x00')
setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4)
sched_setscheduler(0x0, 0x2, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7f, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40)
getpid()
setns(0xffffffffffffffff, 0x24020000)
mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xb, 0x0, 0x100000}, 0x20)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280))
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x5fae, 0x4)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000080)
syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x5885, 0x4000, 0x0, 0x1d}, &(0x7f0000000340), &(0x7f0000000600), &(0x7f0000001700))
io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f0000000040)={0x0, 0x0, 0xf}, 0x1)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x48850, 0x1}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x24040051}, 0x4000000)
shutdown(r0, 0x0)

1m45.449360604s ago: executing program 0 (id=1343):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r4}, 0x0, &(0x7f0000000640)=r3}, 0x20)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r4}, &(0x7f0000000240), &(0x7f0000000280)='%pS    \x00'}, 0x20)
r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='sysfs\x00', 0x1214040, 0x0)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000640)='./file0\x00')
syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0)
r6 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2)
ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0205648, 0x0)
close(0xffffffffffffffff)
r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x115)
getdents64(r7, &(0x7f0000000f80)=""/4096, 0x1000)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@loopback, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in6=@loopback}, 0x0, @in=@local}}, &(0x7f0000000540)=0xe8)
quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000202, r8, &(0x7f00000006c0)='./file0\x00')
ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60)
setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f00000002c0)=0x40b, 0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, '\x00', 0x34}, 0xd}, 0x1c)

1m42.690052657s ago: executing program 0 (id=1349):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00', <r2=>0x0})
connect$can_bcm(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r2}, 0x10)
mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0)
socket$kcm(0x29, 0x0, 0x0)
rmdir(0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
unshare(0x60000600)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x800, @loopback}, 0x10)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0)
write(r4, &(0x7f0000000540)="6f6f6d5f73638f33952a8fbf3318c5f56f6df3ae4bec1d6e0cc9e7961db414a8914f6df033df38d627d906f474a6aed40310ef326e2d98a5d1ba7ac41ffd68ab3ad8dd0c808f64e3f4bc5b", 0x4b)
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000ff00"/16, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000f700"], 0x48}, 0x1, 0x0, 0x0, 0x24000041}, 0x8000)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2800000043000701fefffffffcdbdf255dd3106ef4027c00000c004580080009000000000000004d60e3430bff0022cee34b56a96406a7381fbc32ce9cf1382d09f722490b3eb2498945567ff811c33a4510e3afeeefa38a519cfeb49b65971d01a7e015f4a4b32b9efe1f0777a54bfdde7808c07e4e5060e75b62819d1aa9665cc2d3c74eb2acc901ba7e860aeb8c15a0b915c34cdafaf7c190e143052f25d06f8f273bf9f3e79ec9b53a0f601f25a4bfcfe5421a51ef7576da9fd626a9baad69868d0f9a61d32a695e11780eea642bafca109861bb79d5c4b49664a1fd6bc19525042aca423147a8957f56f95c6bfabed3be2fc7f5c8d97712af7540d0eea88d9516ce1de58a40b52876db37b268a5986750e5b09132842842fea47fde5b2eacf7a329c655e0cb5122fbb5459b7122d50a416b86f7063a69379f3c731b44d4046013db2ff92e3b3b031a6342d7f5f9", @ANYRES32=r1, @ANYBLOB="0800018004001c80"], 0x28}}, 0x2004c000)
mlockall(0x2)
socket$inet_tcp(0x2, 0x1, 0x0)
r5 = syz_usb_connect(0x0, 0x48, &(0x7f0000000a40)=ANY=[@ANYBLOB="1201000022546940fa0ae803d0990102030109023600010000000009047500038cbb2a0009050a00100001000009058803"], 0x0)
syz_usb_control_io(r5, 0x0, &(0x7f0000002740)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="40098e00000006"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r6 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newtaction={0x64, 0x30, 0x1, 0x2, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x80, 0x0, 0x3}, 0x5}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0)
shmat(r6, &(0x7f0000ffc000/0x3000)=nil, 0x4000)
shmctl$IPC_RMID(r6, 0x0)
remap_file_pages(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0)
syz_usb_control_io$uac3(r5, 0x0, &(0x7f0000000480)={0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="00030300000015"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r8 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0)
ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000140)=0xa)

1m41.570085108s ago: executing program 5 (id=1351):
openat$iommufd(0xffffffffffffff9c, &(0x7f00000015c0), 0x20200, 0x0)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
syz_open_dev$video(0x0, 0x8, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRESOCT=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x4000001)
sendmsg$NLBL_UNLABEL_C_STATICADD(r2, 0x0, 0x0)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
syz_open_dev$MSR(0x0, 0x2, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x4)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x70bd25, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x80, 0x3c, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x802000000000000, 0x9}, {}, 0x5}}, 0xb8}}, 0x0)
sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x47, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r0, 0x3b87, &(0x7f0000001600)={0x18, 0x0, 0x0, 0x0, 0x0, 0xd})

1m40.623657749s ago: executing program 5 (id=1352):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="540000000206010200000000000000000500000005000100060000000d000300686173683a6e6574000000000900020073797a31000000000c00078008000640000000400500050002000000050004"], 0x54}}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=@base={0x2, 0x4, 0x4, 0x1, 0x1014}, 0x50)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[], 0x50)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000500000095"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000001c0)={r2, 0xffffffffffffffff, 0x60000000}, 0xc)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c)
syz_emit_ethernet(0x3a, &(0x7f0000000480)={@local, @random="24bd0a4e6969", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x20, 0x2c, 0x64, 0x0, 0x7, 0x6, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x2, 0x0, 0xe7, {[@sack={0x5, 0x2}]}}}}}}}, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_LIST(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810)
recvmsg(r5, 0x0, 0x40000020)

1m39.542169155s ago: executing program 0 (id=1355):
prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000200)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000800000/0x800000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000d19000/0x3000)=nil, &(0x7f0000935000/0xf000)=nil, &(0x7f0000df1000/0x4000)=nil, &(0x7f0000f2a000/0x1000)=nil, &(0x7f00008cd000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0}, 0x68)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, 0x0)
io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xcf67, 0x1f480, 0x0, 0x399})
r2 = socket$inet(0x2, 0x3, 0x2)
r3 = syz_open_dev$sg(&(0x7f0000000300), 0x2, 0x4040)
ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380)
setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000140)={0x6, {{0x2, 0x0, @multicast1}}}, 0x88)
r4 = socket$kcm(0x29, 0x2, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811)
mount(&(0x7f0000000180)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='mqueue\x00', 0x200000, &(0x7f0000000280)='\x00')
ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f0000000200)={r4})

1m36.052968405s ago: executing program 5 (id=1362):
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002580)=@delchain={0x24, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0x8, 0x1}, {0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x2404c080}, 0x200000c0)
r0 = syz_io_uring_setup(0xf03, &(0x7f00000001c0)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f00000000c0)=<r2=>0x0, 0x0)
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x4b564d03, 0x0, 0x81}]})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
socket$inet6_tcp(0xa, 0x1, 0x0)
r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r8 = getpid()
sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r9=>0xffffffffffffffff, <r10=>0xffffffffffffffff})
connect$unix(r9, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r11 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa200000000000007020000d5ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0)
syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00')
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c00)=@bpf_tracing={0x1a, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@call]}, &(0x7f0000000a00)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x1c, r11, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x13b02, r11, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94)
ioctl$KDSKBSENT(r6, 0x4b49, &(0x7f0000000000)={0x14, "4b06fd1eef8b955837299a48a79b795dd15444c5ccdc7761fd4aede1db230ec517c4c01644f76a7faf2886091e9d7758a2d6cb3176a8cc20a153fe65b79299601a043843a980a8c2a60f34f3a8cc392080287dde476396707809000bcc9df3a809a331362584230997eee408696f05506bd39497c774c7025f494eccc71d5ca5ead2a3401aecc011b5688bbf3ce3d299f9da1960f6e0b21f2e451b2934aa20037634dab209b8fd429cc546b279029da2e9a246f9a142fbc4d640532e256c9866c704ca8f46b39f21a417dc857f68f331533cf93489297a6ef038e7569580771c4463b572cbd6511dfca0cc0fa8624f278cc8be4eac6720b64173dd9741492a56b08b3eabe3dd82d7135f35a869359f0f19c1a284d9fc807898cbee0b1a3901c3823e7c5f31fd5781d7828ae6b0d83693e505afabafa4bbdf982af38f1c55bead75a1e0bb55f0ada3b4aad0aebb0d79ee34e59810126eb806781c1370fb095cb66d9210b608182078b8ab7edd1568c9b2005749d676977b62b8b657fb8161fdede1bea44de79c4c8b9d329200abbab48698b94db5b14d831c2ceb36138242c3ad1f170d2cede27557dedd0faa60453ebd93cd32f2d1e7add2b69c14eefa84e91f0c83b414334e61cf2af20812a737eb83c8c5630dd16bbce66af74debf70df14fdeb1cc1491d335017271f5d310191a97859f00"})
ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]})
syz_io_uring_submit(r1, r2, 0x0, &(0x7f0000000140)=@IORING_OP_MSG_RING={0x28, 0x4, 0x0, r0, 0x0, 0x0, 0x8, 0x1, 0x1, {0x0, 0x0, 0xffffffffffffffff, 0xffffffff}})
socket$alg(0x26, 0x5, 0x0)
r12 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00'})

1m35.087529048s ago: executing program 5 (id=1363):
unshare(0x6a040000)
r0 = socket$netlink(0x10, 0x3, 0xc) (async)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000880)=""/112, 0x70}], 0x1, 0x0, 0x0)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async)
r2 = socket$inet(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x290, 0x0, 0xb, 0xd0e0011, 0x120, 0xc6, 0x1f8, 0x1d8, 0x190, 0x1f8, 0x1d8, 0x3, 0x0, {[{{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'nr0\x00', '\x00', {}, {}, 0x1}, 0x0, 0xd8, 0x120, 0x7000000, {}, [@common=@icmp={{0x28}, {0xd, "0010"}}, @common=@unspec=@connlimit={{0x40}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x33f}}}, {{@ip={@remote, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'virt_wifi0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x9, 0x0, 0x0, 0x20000, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)

1m33.841265691s ago: executing program 0 (id=1364):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048e8)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, &(0x7f0000000c40)={0x1c, &(0x7f0000000240)={0x20, 0xd, 0x1, "02"}, 0x0, 0x0})
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}}, 0x4000080)
r4 = getpid()
prlimit64(r4, 0xe, &(0x7f0000000040)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
poll(0x0, 0x0, 0x4)
read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8)
timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4}, &(0x7f0000044000))
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0)
quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)

1m32.739012438s ago: executing program 5 (id=1371):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000004c0)={{r0, <r1=>0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000480)='%pI4   \x00'}, 0x20)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r2=>r1, {0x13f}}, '.\x00'})
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
bind$802154_dgram(r3, &(0x7f0000000400)={0x24, @none={0x0, 0x2}}, 0x14)
accept4$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10, 0x0)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000000000000000000020004008500000097000000b7080000000000007b8af8ff000000ffb7080000ffffffff7b8af0ff00000000bfa100004000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x4}, 0x94)
syz_emit_ethernet(0x5e, &(0x7f0000000400)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x4c, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xe, 0x1, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "263292fb99d5157ac6a6ec526f6518c7"}, @md5sig={0x13, 0x12, "a7e8ec95aa6295ea40a52b32e98fdeef"}]}}}}}}}, 0x0)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d491009b3426c8928f3d97cb", 0x10)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
connect$inet6(r5, &(0x7f0000000080)={0xa, 0x3, 0x0, @empty, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000003c0), 0x3)
getsockopt$bt_hci(r5, 0x11a, 0x1, 0x0, 0x0)
r6 = accept4(r4, 0x0, 0x0, 0x0)
sendmsg$IPVS_CMD_SET_SERVICE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x83}, 0x8010)
read$alg(r6, &(0x7f0000000000)=""/35, 0x23)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r7=>0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r7, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

1m31.747059736s ago: executing program 5 (id=1372):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048e8)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}}, 0x4000080)
r4 = getpid()
prlimit64(r4, 0xe, &(0x7f0000000040)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
poll(0x0, 0x0, 0x4)
read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8)
timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4}, &(0x7f0000044000))
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0)
quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)

1m18.754931123s ago: executing program 41 (id=1364):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048e8)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, &(0x7f0000000c40)={0x1c, &(0x7f0000000240)={0x20, 0xd, 0x1, "02"}, 0x0, 0x0})
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}}, 0x4000080)
r4 = getpid()
prlimit64(r4, 0xe, &(0x7f0000000040)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
poll(0x0, 0x0, 0x4)
read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8)
timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4}, &(0x7f0000044000))
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0)
quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)

1m15.964801931s ago: executing program 42 (id=1372):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048e8)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}}, 0x4000080)
r4 = getpid()
prlimit64(r4, 0xe, &(0x7f0000000040)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
poll(0x0, 0x0, 0x4)
read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8)
timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4}, &(0x7f0000044000))
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0)
quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)

49.91210917s ago: executing program 3 (id=1476):
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0)
r0 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
writev(r0, &(0x7f0000003940)=[{&(0x7f00000001c0)="cb6f", 0x2}, {&(0x7f0000001400)="8b", 0x1}], 0x2)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NFC_CMD_GET_TARGET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0)
syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r1)
r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000d00), r1)
ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, 0x0)
sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000001140)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000fedbdf250700000008000300", @ANYRES32, @ANYBLOB="08000300", @ANYRES32, @ANYBLOB="0c0017000203aaaaaaaaaaaa0800010003"], 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x400c044)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bridge0/bridge/multicast_snooping\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='1', 0x1)

49.389160949s ago: executing program 3 (id=1478):
r0 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x2100)
ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2})
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000300)={&(0x7f00000001c0)=[<r1=>0x0], 0x1})
ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000280)={&(0x7f0000000240)=[r1], 0x1, 0x80000})
r2 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
r3 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r3, 0x83, 0x12, &(0x7f0000000000)=@conn_svc_rsp={0x0, 0x0, 0xa, "41ce8e50", {0x3, 0x0, 0x0, 0x1, 0x0, 0x7, 0x13}})
r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, r2)
keyctl$KEYCTL_MOVE(0x1e, r2, 0xfffffffffffffffe, r4, 0x0)

47.445670882s ago: executing program 3 (id=1480):
prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000200)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000800000/0x800000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000d19000/0x3000)=nil, &(0x7f0000935000/0xf000)=nil, &(0x7f0000df1000/0x4000)=nil, &(0x7f0000f2a000/0x1000)=nil, &(0x7f00008cd000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0}, 0x68)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000340)={0x0, 'macsec0\x00'})
io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xcf67, 0x1f480, 0x0, 0x399})
r2 = socket$inet(0x2, 0x3, 0x2)
r3 = syz_open_dev$sg(0x0, 0x2, 0x4040)
ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380)
setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000140)={0x6, {{0x2, 0x0, @multicast1}}}, 0x88)
r4 = socket$kcm(0x29, 0x2, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811)
mount(&(0x7f0000000180)=@filename='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='mqueue\x00', 0x200000, &(0x7f0000000280)='\x00')
ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f0000000200)={r4})

47.149993576s ago: executing program 3 (id=1483):
memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2<Y\xa1\xdeP\b\xf1kM\x02\x00\x00\x03\x00eA\xb5#>\xa0D-N\xf9\xba!L]h;F[\xe2\x1c<L\xaa\x87A\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xad\t\x15\xdb|\x87\xf1\xc4\xb8\xb2\x9a\xd2A\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x88&}\xd1\x00\x00\x00\xe6\xaf\t\x9f\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\xe9\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc\xc6\x7f\x93eE1xp\xa3\xdc\xd7K9J<\xeb\xd2!\xf4\x19\xbd#\xb8\x83\x858\n\xdc\x12Z\x1a\x12\xfa\xcc\x04\r\xf3\xf4;\v\x15b^\xea\xa2\x04 \xe8\x99\xb3\x97\x9e\r\xb0\x05\xbb(f\xd0\x85\xc5\x15\xae#\x12Q\xacF\xfb\xc8\xbd\xcc#\v\x00\x00\x00\x00\x00\x00\x8f\x9b\x00\x03\xc8}\x11\xbc\x01\x8fi\xf5\x7f\xaf\x11\xfb\x16\x95\xdfc\xc9\x8a/&\x81w\x06]ao\\\x88\xf7\xce\xbd\xb0\xa6J~\x8d\xf1\xe9\x1c\xcfo\xb3\xdc\x04Y\x8e\r\xf5\xa0\xeft\x06G0\xe3D\xd6\xa3L\xedN\x0e\xdc@7\xd8^\xae\xea\x92\xbe\x9c\xf9~c\xc1|\xca\x8d\x93R\xe5\xceU\xa5\x0f\xbf\xd8l\x96`\x05\x00e\x8aR{\x17Y\x15m>\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3)
socket$inet_mptcp(0x2, 0x1, 0x106)
accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x32, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x802, 0x0)
write$binfmt_misc(r0, &(0x7f00000003c0)="e7998f", 0x3)

46.374811595s ago: executing program 3 (id=1484):
syz_open_dev$video4linux(&(0x7f0000000100), 0x5, 0x8000)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r2, 0x1, 0x70bd25, 0x0, {{0x2}, {@val={0x8, 0x3, r1}, @void}}, [@chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x97b}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wlan0\x00'})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000900)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x50, r4, 0x400, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x17}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x40040c0}, 0x8000)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8)
r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r6, 0x80044dfd, &(0x7f00000000c0))
r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0)
ioctl$PTP_SYS_OFFSET_EXTENDED(r7, 0xc4c03d09, &(0x7f0000000340)={0x2})
r8 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2)
ftruncate(r8, 0x80079a3)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
getpid()

45.318367545s ago: executing program 3 (id=1488):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048e8)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, &(0x7f0000000c40)={0x1c, &(0x7f0000000240)={0x20, 0xd, 0x1, "02"}, 0x0, 0x0})
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}}, 0x4000080)
r4 = getpid()
prlimit64(r4, 0xe, &(0x7f0000000040)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
poll(0x0, 0x0, 0x4)
read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8)
timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4}, &(0x7f0000044000))
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0)
quotactl$Q_SYNC(0xffffffff8000011f, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)

29.736423617s ago: executing program 43 (id=1488):
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x42001, 0x0)
close(r0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048e8)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, &(0x7f0000000c40)={0x1c, &(0x7f0000000240)={0x20, 0xd, 0x1, "02"}, 0x0, 0x0})
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x78bd25, 0x25dfdbfd, {0xf}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x3}]}, 0x1c}}, 0x4000080)
r4 = getpid()
prlimit64(r4, 0xe, &(0x7f0000000040)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
poll(0x0, 0x0, 0x4)
read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000)
rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8)
timer_create(0x3, &(0x7f000049efa0)={0x0, 0x14, 0x4}, &(0x7f0000044000))
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x77359400}, {0x0, 0xe4c}}, 0x0)
quotactl$Q_SYNC(0xffffffff8000011f, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
socket$nl_route(0x10, 0x3, 0x0)
socket$unix(0x1, 0x1, 0x0)

16.997036309s ago: executing program 6 (id=1562):
r0 = socket$l2tp6(0xa, 0x2, 0x73)
bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x7, @empty, 0xe229, 0x1}, 0x20)
bind$l2tp6(r0, &(0x7f0000000040)={0xa, 0x7, 0x0, @dev={0xfe, 0x80, '\x00', 0x20}, 0x8, 0x400000}, 0x20)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x6, 0x0, 0x10, 0x7fff7ff9}, {0x9, 0x4, 0xa, 0x2}]})
gettid()
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xffffffffffffffff)
fcntl$setsig(r1, 0xa, 0x12)
ppoll(&(0x7f0000000100)=[{r2, 0x8440}], 0x1, 0x0, &(0x7f00000001c0)={[0x8001a0ffffffff]}, 0x8)
dup2(r1, r2)
r3 = socket$igmp(0x2, 0x3, 0x2)
mkdir(&(0x7f0000000540)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./trace\x00', &(0x7f0000000600)='tracefs\x00', 0x0, 0x0)
syz_usb_connect$midi(0x0, 0x39, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x582, 0x14, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x27, 0x1, 0x1, 0x3, 0x60, 0x5, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x30, 0x28, [@midi_in_jack={0x6, 0x24, 0x2, 0x0, 0x5, 0x3}], [{{0x9, 0x5, 0x9, 0x2, 0x10, 0x80, 0xd1, 0x7, {0x6, 0x25, 0x1, 0x2, "6d11"}}}]}}}}}]}}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0})
r4 = openat(0xffffff9c, &(0x7f0000000640)='./trace/events/mac80211/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='1', 0x1)
setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4)
setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r6 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10)
setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8)
syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @broadcast, @val={@void, {0x8100, 0x0, 0x0, 0x3}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x38, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0x7ff, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @local}, "695a31130fbfeaee"}}}}}, 0x0)
setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@remote, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0x800b2, 0xfffffff7, 0x4, 0x40000006}, 0x3c)
r7 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00')
pread64(r7, &(0x7f0000000100)=""/253, 0xfd, 0x1)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e00)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4, 0x21}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x48}}, 0x8000000)

13.893487762s ago: executing program 6 (id=1573):
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$can_bcm(0x1d, 0x2, 0x2)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, 0x0)
connect$can_bcm(r1, &(0x7f00000000c0), 0x10)
mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0)
socket$kcm(0x29, 0x0, 0x0)
rmdir(0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
unshare(0x60000600)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000080)={0x2, 0x800, @loopback}, 0x10)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)="6f6f6d5f73638f33952a8fbf3318c5f56f6df3ae4bec1d6e0cc9e7961db414a8914f6df033df38d627d906f474a6aed40310ef326e2d98a5d1ba7ac41ffd68ab3ad8dd0c808f64e3f4bc5b", 0x4b)
sendmsg$can_bcm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000ff00"/16, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000f700"], 0x48}, 0x1, 0x0, 0x0, 0x24000041}, 0x8000)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2800000043000701fefffffffcdbdf255dd3106ef4027c00000c004580080009000000000000004d60e3430bff0022cee34b56a96406a7381fbc32ce9cf1382d09f722490b3eb2498945567ff811c33a4510e3afeeefa38a519cfeb49b65971d01a7e015f4a4b32b9efe1f0777a54bfdde7808c07e4e5060e75b62819d1aa9665cc2d3c74eb2acc901ba7e860aeb8c15a0b915c34cdafaf7c190e143052f25d06f8f273bf9f3e79ec9b53a0f601f25a4bfcfe5421a51ef7576da9fd626a9baad69868d0f9a61d32a695e11780eea642bafca109861bb79d5c4b49664a1fd6bc19525042aca423147a8957f56f95c6bfabed3be2fc7f5c8d97712af7540d0eea88d9516ce1de58a40b52876db37b268a5986750e5b09132842842fea47fde5b2eacf7a329c655e0cb5122fbb5459b7122d50a416b86f7063a69379f3c731b44d4046013db2ff92e3b3b031a6342d7f5f9", @ANYRES32=r0, @ANYBLOB="0800018004001c80"], 0x28}}, 0x2004c000)
mlockall(0x2)
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = syz_usb_connect(0x0, 0x48, &(0x7f0000000a40)=ANY=[@ANYBLOB="1201000022546940fa0ae803d0990102030109023600010000000009047500038cbb2a0009050a00100001000009058803"], 0x0)
syz_usb_control_io(r4, 0x0, &(0x7f0000002740)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="40098e00000006"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r5 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newtaction={0x64, 0x30, 0x1, 0x2, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x80, 0x0, 0x3}, 0x5}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0)
shmat(r5, &(0x7f0000ffc000/0x3000)=nil, 0x4000)
shmctl$IPC_RMID(r5, 0x0)
remap_file_pages(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0)
syz_usb_control_io$uac3(r4, 0x0, &(0x7f0000000480)={0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="00030300000015"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r7 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0)
ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000140)=0xa)

11.921185782s ago: executing program 7 (id=1526):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000004c0)={{r0, <r1=>0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000480)='%pI4   \x00'}, 0x20)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r2=>r1, {0x13f}}, '.\x00'})
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
bind$802154_dgram(r3, &(0x7f0000000400)={0x24, @none={0x0, 0x2}}, 0x14)
accept4$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10, 0x0)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000000000000000000020004008500000097000000b7080000000000007b8af8ff000000ffb7080000ffffffff7b8af0ff00000000bfa100004000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x4}, 0x94)
syz_emit_ethernet(0x5e, &(0x7f0000000400)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x4c, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xe, 0x1, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "263292fb99d5157ac6a6ec526f6518c7"}, @md5sig={0x13, 0x12, "a7e8ec95aa6295ea40a52b32e98fdeef"}]}}}}}}}, 0x0)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d491009b3426c8928f3d97cb", 0x10)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
connect$inet6(r5, &(0x7f0000000080)={0xa, 0x3, 0x0, @empty, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000003c0), 0x3)
getsockopt$bt_hci(r5, 0x11a, 0x1, 0x0, 0x0)
r6 = accept4(r4, 0x0, 0x0, 0x0)
sendmsg$IPVS_CMD_SET_SERVICE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x83}, 0x8010)
read$alg(r6, &(0x7f0000000000)=""/35, 0x23)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

10.794529972s ago: executing program 7 (id=1580):
memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2<Y\xa1\xdeP\b\xf1kM\x02\x00\x00\x03\x00eA\xb5#>\xa0D-N\xf9\xba!L]h;F[\xe2\x1c<L\xaa\x87A\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xad\t\x15\xdb|\x87\xf1\xc4\xb8\xb2\x9a\xd2A\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x88&}\xd1\x00\x00\x00\xe6\xaf\t\x9f\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\xe9\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc\xc6\x7f\x93eE1xp\xa3\xdc\xd7K9J<\xeb\xd2!\xf4\x19\xbd#\xb8\x83\x858\n\xdc\x12Z\x1a\x12\xfa\xcc\x04\r\xf3\xf4;\v\x15b^\xea\xa2\x04 \xe8\x99\xb3\x97\x9e\r\xb0\x05\xbb(f\xd0\x85\xc5\x15\xae#\x12Q\xacF\xfb\xc8\xbd\xcc#\v\x00\x00\x00\x00\x00\x00\x8f\x9b\x00\x03\xc8}\x11\xbc\x01\x8fi\xf5\x7f\xaf\x11\xfb\x16\x95\xdfc\xc9\x8a/&\x81w\x06]ao\\\x88\xf7\xce\xbd\xb0\xa6J~\x8d\xf1\xe9\x1c\xcfo\xb3\xdc\x04Y\x8e\r\xf5\xa0\xeft\x06G0\xe3D\xd6\xa3L\xedN\x0e\xdc@7\xd8^\xae\xea\x92\xbe\x9c\xf9~c\xc1|\xca\x8d\x93R\xe5\xceU\xa5\x0f\xbf\xd8l\x96`\x05\x00e\x8aR{\x17Y\x15m>\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0)
r0 = semget$private(0x0, 0x207, 0x0)
semtimedop(r0, 0x0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$inet6_sctp(0xa, 0x1, 0x84)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
r3 = dup(r2)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xfffffffe, @loopback, 0x5}], 0x1c)
sendmsg$inet6(r2, 0x0, 0x48043)
setsockopt$sock_attach_bpf(r1, 0x1, 0x25, 0x0, 0x31)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}, 0x1, 0x0, 0x0, 0x24044000}, 0x40080)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c)
pipe2$9p(0x0, 0x0)
write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a)
splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x317e, 0x4)
socket$inet_mptcp(0x2, 0x1, 0x106)
accept4$inet(r3, &(0x7f0000000680)={0x2, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, 0x0)
read$msr(r5, &(0x7f0000000740)=""/1, 0x1)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="120100020000004025057a120001010200010902200001010080320904000002000000000705810240000007050202"], 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x802, 0x0)
write$binfmt_misc(r6, &(0x7f00000003c0)="e7998f", 0x3)

10.608994774s ago: executing program 2 (id=1581):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', <r3=>0x0})
ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, 0x1, 0x5, 0x0, 0x100, 0x4, 0x540200, r3})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1c, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x1ac81b, 0x0, 0x0, 0x0, 0x1000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0x0, 0x1010000}, @initr0, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2}, 0x94)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="440f20c0350b000000440f22c0360f09c4217d700c9d0000000028b8010000000f01c166b82e000f00d80f20d835080000000f22d82e0f019885000000b9b1060000b86f8d0000ba0000000066b8b5008ec036363ef3420f51a600000000b9e30b0000b8f233278fba000000000f30", 0x6f}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$TIPC_NL_MEDIA_GET(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000100)={0x3c, r5, 0x1, 0x170bd2b, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x28, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'xfrm0\x00'}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}]}]}]}, 0x3c}}, 0x8804)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/mpls/platform_labels\x00', 0x1, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000900000008"], 0x50)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r6, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df33c98e16a6009e62476f000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50)

10.217111982s ago: executing program 2 (id=1582):
r0 = socket$l2tp6(0xa, 0x2, 0x73)
bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x7, @empty, 0xe229, 0x1}, 0x20)
bind$l2tp6(r0, &(0x7f0000000040)={0xa, 0x7, 0x0, @dev={0xfe, 0x80, '\x00', 0x20}, 0x8, 0x400000}, 0x20)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x6, 0x0, 0x10, 0x7fff7ff9}, {0x9, 0x4, 0xa, 0x2}]})
gettid()
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xffffffffffffffff)
fcntl$setsig(r1, 0xa, 0x12)
ppoll(&(0x7f0000000100)=[{r2, 0x8440}], 0x1, 0x0, &(0x7f00000001c0)={[0x8001a0ffffffff]}, 0x8)
dup2(r1, r2)
r3 = socket$igmp(0x2, 0x3, 0x2)
mkdir(&(0x7f0000000540)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./trace\x00', &(0x7f0000000600)='tracefs\x00', 0x0, 0x0)
syz_usb_connect$midi(0x0, 0x39, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x582, 0x14, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x27, 0x1, 0x1, 0x3, 0x60, 0x5, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x30, 0x28, [@midi_in_jack={0x6, 0x24, 0x2, 0x0, 0x5, 0x3}], [{{0x9, 0x5, 0x9, 0x2, 0x10, 0x80, 0xd1, 0x7, {0x6, 0x25, 0x1, 0x2, "6d11"}}}]}}}}}]}}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0})
r4 = openat(0xffffff9c, &(0x7f0000000640)='./trace/events/mac80211/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='1', 0x1)
setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4)
setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r6 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10)
setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8)
syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @broadcast, @val={@void, {0x8100, 0x0, 0x0, 0x3}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1, 0x38, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0x7ff, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @local}, "695a31130fbfeaee"}}}}}, 0x0)
setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@remote, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0x800b2, 0xfffffff7, 0x4, 0x40000006}, 0x3c)
r7 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00')
pread64(r7, &(0x7f0000000100)=""/253, 0xfd, 0x1)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e00)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4, 0x21}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x48}}, 0x8000000)

9.372714548s ago: executing program 6 (id=1584):
openat$iommufd(0xffffffffffffff9c, &(0x7f00000015c0), 0x20200, 0x0)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
syz_open_dev$video(0x0, 0x8, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRESOCT=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x4000001)
sendmsg$NLBL_UNLABEL_C_STATICADD(r2, 0x0, 0x0)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
syz_open_dev$MSR(0x0, 0x2, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x4)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x70bd25, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x80, 0x3c, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x802000000000000, 0x9}, {}, 0x5}}, 0xb8}}, 0x0)
sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x188}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r0, 0x3b87, &(0x7f0000001600)={0x18, 0x0, 0x0, 0x0, 0x0, 0xd})

8.349616933s ago: executing program 6 (id=1586):
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$can_bcm(0x1d, 0x2, 0x2)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00'})
connect$can_bcm(r1, 0x0, 0x0)
mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0)
socket$kcm(0x29, 0x0, 0x0)
rmdir(0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
unshare(0x60000600)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000080)={0x2, 0x800, @loopback}, 0x10)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)="6f6f6d5f73638f33952a8fbf3318c5f56f6df3ae4bec1d6e0cc9e7961db414a8914f6df033df38d627d906f474a6aed40310ef326e2d98a5d1ba7ac41ffd68ab3ad8dd0c808f64e3f4bc5b", 0x4b)
sendmsg$can_bcm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="010000ff00"/16, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000f700"], 0x48}, 0x1, 0x0, 0x0, 0x24000041}, 0x8000)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2800000043000701fefffffffcdbdf255dd3106ef4027c00000c004580080009000000000000004d60e3430bff0022cee34b56a96406a7381fbc32ce9cf1382d09f722490b3eb2498945567ff811c33a4510e3afeeefa38a519cfeb49b65971d01a7e015f4a4b32b9efe1f0777a54bfdde7808c07e4e5060e75b62819d1aa9665cc2d3c74eb2acc901ba7e860aeb8c15a0b915c34cdafaf7c190e143052f25d06f8f273bf9f3e79ec9b53a0f601f25a4bfcfe5421a51ef7576da9fd626a9baad69868d0f9a61d32a695e11780eea642bafca109861bb79d5c4b49664a1fd6bc19525042aca423147a8957f56f95c6bfabed3be2fc7f5c8d97712af7540d0eea88d9516ce1de58a40b52876db37b268a5986750e5b09132842842fea47fde5b2eacf7a329c655e0cb5122fbb5459b7122d50a416b86f7063a69379f3c731b44d4046013db2ff92e3b3b031a6342d7f5f9", @ANYRES32=r0, @ANYBLOB="0800018004001c80"], 0x28}}, 0x2004c000)
mlockall(0x2)
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = syz_usb_connect(0x0, 0x48, &(0x7f0000000a40)=ANY=[@ANYBLOB="1201000022546940fa0ae803d0990102030109023600010000000009047500038cbb2a0009050a00100001000009058803"], 0x0)
syz_usb_control_io(r4, 0x0, &(0x7f0000002740)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="40098e00000006"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r5 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newtaction={0x64, 0x30, 0x1, 0x2, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x80, 0x0, 0x3}, 0x5}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0)
shmat(r5, &(0x7f0000ffc000/0x3000)=nil, 0x4000)
shmctl$IPC_RMID(r5, 0x0)
remap_file_pages(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0)
syz_usb_control_io$uac3(r4, 0x0, &(0x7f0000000480)={0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="00030300000015"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r7 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0)
ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000140)=0xa)

7.612709967s ago: executing program 7 (id=1587):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7fc}], 0x2c)
sendto$inet6(r1, &(0x7f0000000040)="e4", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
readv(r1, &(0x7f0000000d00)=[{&(0x7f0000000780)=""/155, 0x9b}, {0x0}], 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000012c0)='./file0\x00', 0x81)
rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='./file0/file0\x00')
setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4)
sched_setscheduler(0x0, 0x2, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40)
r3 = getpid()
r4 = syz_pidfd_open(r3, 0x0)
setns(r4, 0x24020000)
mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xb, 0x0, 0x100000}, 0x20)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280))
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x5fae, 0x4)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000080)
syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x5885, 0x4000, 0x0, 0x1d}, &(0x7f0000000340), &(0x7f0000000600), &(0x7f0000001700))
io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f0000000040)={0x0, 0x0, 0xf}, 0x1)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x48850, 0x1}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x24040051}, 0x4000000)
shutdown(r0, 0x0)

6.797108998s ago: executing program 4 (id=1590):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000004c0)={{r0, <r1=>0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000480)='%pI4   \x00'}, 0x20)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r2=>r1, {0x13f}}, '.\x00'})
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
bind$802154_dgram(r3, &(0x7f0000000400)={0x24, @none={0x0, 0x2}}, 0x14)
accept4$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10, 0x0)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000000000000000000020004008500000097000000b7080000000000007b8af8ff000000ffb7080000ffffffff7b8af0ff00000000bfa100004000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x4}, 0x94)
syz_emit_ethernet(0x5e, &(0x7f0000000400)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x4c, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xe, 0x1, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "263292fb99d5157ac6a6ec526f6518c7"}, @md5sig={0x13, 0x12, "a7e8ec95aa6295ea40a52b32e98fdeef"}]}}}}}}}, 0x0)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d491009b3426c8928f3d97cb", 0x10)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
connect$inet6(r5, &(0x7f0000000080)={0xa, 0x3, 0x0, @empty, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000003c0), 0x3)
getsockopt$bt_hci(r5, 0x11a, 0x1, 0x0, 0x0)
r6 = accept4(r4, 0x0, 0x0, 0x0)
read$alg(r6, &(0x7f0000000000)=""/35, 0x23)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r7=>0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r7, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

5.809840449s ago: executing program 4 (id=1592):
bpf$BPF_PROG_DETACH(0x9, 0x0, 0x10)
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0)
setsockopt$packet_fanout_data(r0, 0x107, 0x16, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1)
socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, 0x0, &(0x7f0000000000))
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
r2 = inotify_init()
r3 = socket(0xa, 0x3, 0x3a)
setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x100]}}, 0x5c)
setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x4, 0x9, @loopback, 0x2}, {0xa, 0x4e24, 0x8000000, @mcast2}, 0x1, {[0x9, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x390]}}, 0x5c)
close_range(r2, 0xffffffffffffffff, 0x0)

4.841249431s ago: executing program 1 (id=1593):
syz_open_dev$video4linux(&(0x7f0000000100), 0x5, 0x8000)
sched_setaffinity(0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r2, 0x1, 0x70bd25, 0x0, {{0x2}, {@val={0x8, 0x3, r1}, @void}}, [@chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x97b}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wlan0\x00'})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000900)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x50, r4, 0x400, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x17}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x40040c0}, 0x8000)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8)
r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r6, 0x80044dfd, &(0x7f00000000c0))
r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0)
ioctl$PTP_SYS_OFFSET_EXTENDED(r7, 0xc4c03d09, &(0x7f0000000340)={0x2})
r8 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2)
ftruncate(r8, 0x80079a3)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
getpid()

4.145992408s ago: executing program 7 (id=1594):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x5, [@var={0x4, 0x0, 0x0, 0xe, 0x4}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x2d}, 0x28)
eventfd(0x5f0)
ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x40a0ae49, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
socket(0x22, 0x3, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0)
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0)
sendfile(r4, r5, 0x0, 0x106f)
ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10)
sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000840)
ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6})
r6 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)

4.135085723s ago: executing program 4 (id=1595):
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0)
mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x1cce1000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r1 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r1, &(0x7f0000000080), 0x10)
sendmsg$can_bcm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0)
sendmsg$can_bcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x3, 0x2}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/mpls/platform_labels\x00', 0x1, 0x0)
write(r2, &(0x7f0000000100)='1000\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/mpls/conf/lo/input\x00', 0x1, 0x0)
r4 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e79"], 0x0)
syz_usb_control_io$cdc_ncm(r4, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="400104"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
write(r3, &(0x7f0000000180)='1\n', 0x2)
close(r3)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@mpls_newroute={0x2c, 0x18, 0x405, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x1}, [@RTA_DST={0x8, 0x1, {0x18, 0x0, 0x1}}, @RTA_OIF={0x8, 0x4, 0x1}]}, 0x2c}}, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@mpls_getroute={0x1c, 0x1a, 0x301}, 0x1c}}, 0x0)
r6 = syz_open_dev$video4linux(&(0x7f0000000040), 0x5, 0x0)
ioctl$VIDIOC_SUBDEV_S_SELECTION(r6, 0xc040563e, &(0x7f0000002680)={0x1, 0x0, 0x100, 0x7, {0x1, 0x4, 0xfffffff7, 0x4}})
prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x0, &(0x7f0000000040))

4.129384685s ago: executing program 2 (id=1596):
syz_open_dev$sndpcmc(&(0x7f0000004240), 0x4000000000000000, 0x0)
r0 = syz_open_dev$video(&(0x7f00000004c0), 0x81, 0xa082)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

3.990502996s ago: executing program 1 (id=1597):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x200008, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x6)
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0)
cachestat(r1, 0x0, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000000240)=@abs={0x1, 0x0, 0x4e22}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$kcm(0x10, 0x7, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="364000001a0500000000000000c5a05f0aa757154fc0889c44ab9d438ddeaa85b1d47be03efbad418ee2a240fdef126487473cbf68ebdbc7b0e9c861297f18bb526d7db4dd8dbe20d6004e77dde6d0ed66780bca99977ca3ac5d5419e0ff59c2328a98e9a9d4a1e9cb0d9ffa9794f45f27777e55af39878c99708f9fae8e074bd6d9fd42861ef3d13ad976f915916083915e1e0a05816cfb824e87d890da8aabca905d660f28d67156f1d2b7ee95b357b9ce7fffcdc5e2d45442072d2bc10a6e"], 0xfe33)
openat$tun(0xffffffffffffff9c, 0x0, 0x541401, 0x0)
openat$drirender128(0xffffffffffffff9c, &(0x7f0000000140), 0x200, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)
openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x80200, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet(0x2, 0x1, 0x6)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x2, 0x4000000, 0xffffffff}, 0x10)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001600010029bd7000800001000a000000", @ANYRES32=0x0, @ANYBLOB="62917c64db9ab9f7"], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x800)
prctl$PR_SET_SECUREBITS(0x1c, 0x4)
setresuid(0x0, 0xee00, 0xee01)
fcntl$setlease(0xffffffffffffffff, 0x400, 0x2)
acct(&(0x7f0000000040)='./file0\x00')
fcntl$setlease(0xffffffffffffffff, 0x400, 0x2)
ioctl$VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, 0x0)

3.920982444s ago: executing program 2 (id=1598):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7fc}], 0x2c)
sendto$inet6(r1, &(0x7f0000000040)="e4", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
readv(r1, &(0x7f0000000d00)=[{&(0x7f0000000780)=""/155, 0x9b}, {0x0}], 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000012c0)='./file0\x00', 0x81)
rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='./file0/file0\x00')
setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4)
sched_setscheduler(0x0, 0x2, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40)
r3 = getpid()
r4 = syz_pidfd_open(r3, 0x0)
setns(r4, 0x24020000)
mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xb, 0x0, 0x100000}, 0x20)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280))
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x5fae, 0x4)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000080)
syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x5885, 0x4000, 0x0, 0x1d}, &(0x7f0000000340), &(0x7f0000000600), &(0x7f0000001700))
io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f0000000040)={0x0, 0x0, 0xf}, 0x1)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x48850, 0x1}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x24040051}, 0x4000000)
shutdown(r0, 0x0)

3.019729214s ago: executing program 7 (id=1599):
memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2<Y\xa1\xdeP\b\xf1kM\x02\x00\x00\x03\x00eA\xb5#>\xa0D-N\xf9\xba!L]h;F[\xe2\x1c<L\xaa\x87A\xcdN#\xfb\xb0\xf2\x1e\x0e#J\xd0hB<\xc0\x82A0)p\xe7&J\x82\x83\x83\xd14\x01\xcf\x1b\xa9\x1d\x1ef\x0f\x86(1\xd6l\xd2\x8f\xb0\xad\t\x15\xdb|\x87\xf1\xc4\xb8\xb2\x9a\xd2A\x80\xbf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x80\x00\x00\x00\x00\x00\x00\x00\x88&}\xd1\x00\x00\x00\xe6\xaf\t\x9f\x96\rN\xc9\x90\xbe\xed\x1ad\x14\xe7\x84\t\'\x8b\x00\xdd\xc9\x0f\x14v\xb6\x04\xf2U\xb4\xf6\xbe\xddT\xcb\x00\x00\x00\x00\x00\x00\xe9\x00\x00\x00\x00\x00\x00o:}\xa7jmH\xedn\x11\xfe\xe2\x0fT\x00\x94\xbc\xc6\x7f\x93eE1xp\xa3\xdc\xd7K9J<\xeb\xd2!\xf4\x19\xbd#\xb8\x83\x858\n\xdc\x12Z\x1a\x12\xfa\xcc\x04\r\xf3\xf4;\v\x15b^\xea\xa2\x04 \xe8\x99\xb3\x97\x9e\r\xb0\x05\xbb(f\xd0\x85\xc5\x15\xae#\x12Q\xacF\xfb\xc8\xbd\xcc#\v\x00\x00\x00\x00\x00\x00\x8f\x9b\x00\x03\xc8}\x11\xbc\x01\x8fi\xf5\x7f\xaf\x11\xfb\x16\x95\xdfc\xc9\x8a/&\x81w\x06]ao\\\x88\xf7\xce\xbd\xb0\xa6J~\x8d\xf1\xe9\x1c\xcfo\xb3\xdc\x04Y\x8e\r\xf5\xa0\xeft\x06G0\xe3D\xd6\xa3L\xedN\x0e\xdc@7\xd8^\xae\xea\x92\xbe\x9c\xf9~c\xc1|\xca\x8d\x93R\xe5\xceU\xa5\x0f\xbf\xd8l\x96`\x05\x00e\x8aR{\x17Y\x15m>\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0)
r0 = semget$private(0x0, 0x207, 0x0)
semtimedop(r0, 0x0, 0x0, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
socket$inet6_sctp(0xa, 0x1, 0x84)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
r3 = dup(r2)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xfffffffe, @loopback, 0x5}], 0x1c)
sendmsg$inet6(r2, 0x0, 0x48043)
setsockopt$sock_attach_bpf(r1, 0x1, 0x25, 0x0, 0x31)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}, 0x1, 0x0, 0x0, 0x24044000}, 0x40080)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c)
pipe2$9p(0x0, 0x0)
write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a)
splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x317e, 0x4)
socket$inet_mptcp(0x2, 0x1, 0x106)
accept4$inet(r3, &(0x7f0000000680)={0x2, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, 0x0)
read$msr(r5, &(0x7f0000000740)=""/1, 0x1)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="120100020000004025057a120001010200010902200001010080320904000002000000000705810240000007050202"], 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x802, 0x0)
write$binfmt_misc(r6, &(0x7f00000003c0)="e7998f", 0x3)

1.92347887s ago: executing program 1 (id=1600):
fcntl$setlease(0xffffffffffffffff, 0x400, 0x2)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0)
r2 = userfaultfd(0x801)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1})
syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000b80), r3)
sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r4, 0xdf132058c1cd5891, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x300000000}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x48050)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000000)
ioctl$OCFS2_IOC_MOVE_EXT(r0, 0x40406f06, &(0x7f0000000000)={0x4, 0x5, 0x7, 0x4, 0x2})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'})
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00'], 0x28}, 0x1, 0x0, 0x0, 0x44801}, 0x840)

1.545876429s ago: executing program 1 (id=1601):
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000040)={<r1=>0x0, 0xf4, "5545da47156c6911dd84d1586ec5465e020328c64c3b242f6b0f89e5162698b57ac6a5524b9b0c88791800b0a39f1643fc03c4a79732e63917f3ae375f4fcb0a38798c427bef4cccb1f056aabaaa8e7a68f85aadaf3b0d091e6779fc98cca9356a2b08859dae692a8910d2b3938e9b9bf4dff6fb76492afde2ff42248734940ec52254bc647fe53f01a05012c3970cfc465fa641f64ea499b86b6d0f2156b30f42d1fa4ca28f139ca5862f8fa80e45d30f64683482e1d208671f558a50a11bca5d8b0d634c1404500e6afa555716be5d404ace402d2815af69af05c38efd8ad540e48e65498e3eb74d05d50c01e1f32d11536c68"}, &(0x7f0000000140)=0xfc)
sendmsg$inet_sctp(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@sndinfo={0x20, 0x84, 0x2, {0x31, 0x208, 0x2, 0xd5, r1}}], 0x20, 0x20000004}, 0x0)

1.498047977s ago: executing program 4 (id=1602):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000004c0)={{r0, <r1=>0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000480)='%pI4   \x00'}, 0x20)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r2=>r1, {0x13f}}, '.\x00'})
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
bind$802154_dgram(r3, &(0x7f0000000400)={0x24, @none={0x0, 0x2}}, 0x14)
accept4$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10, 0x0)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000000000000000000020004008500000097000000b7080000000000007b8af8ff000000ffb7080000ffffffff7b8af0ff00000000bfa100004000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x4}, 0x94)
syz_emit_ethernet(0x5e, &(0x7f0000000400)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x4c, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xe, 0x1, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "263292fb99d5157ac6a6ec526f6518c7"}, @md5sig={0x13, 0x12, "a7e8ec95aa6295ea40a52b32e98fdeef"}]}}}}}}}, 0x0)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d491009b3426c8928f3d97cb", 0x10)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4)
connect$inet6(r5, &(0x7f0000000080)={0xa, 0x3, 0x0, @empty, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000003c0), 0x3)
getsockopt$bt_hci(r5, 0x11a, 0x1, 0x0, 0x0)
r6 = accept4(r4, 0x0, 0x0, 0x0)
read$alg(r6, &(0x7f0000000000)=""/35, 0x23)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r7=>0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r7, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

1.398172552s ago: executing program 2 (id=1603):
openat$iommufd(0xffffffffffffff9c, &(0x7f00000015c0), 0x20200, 0x0)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8)
r1 = getpid()
syz_open_dev$video(0x0, 0x8, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRESOCT=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x4000001)
sendmsg$NLBL_UNLABEL_C_STATICADD(r2, 0x0, 0x0)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
syz_open_dev$MSR(0x0, 0x2, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x4)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x70bd25, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x80, 0x3c, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x802000000000000, 0x9}, {}, 0x5}}, 0xb8}}, 0x0)
sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100"], 0x188}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r0, 0x3b87, &(0x7f0000001600)={0x18, 0x0, 0x0, 0x0, 0x0, 0xd})

1.349445311s ago: executing program 1 (id=1604):
bpf$BPF_PROG_DETACH(0x9, 0x0, 0x10)
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0)
setsockopt$packet_fanout_data(r0, 0x107, 0x16, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1)
socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, 0x0, &(0x7f0000000000))
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
r2 = inotify_init()
r3 = socket(0xa, 0x3, 0x3a)
setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x100]}}, 0x5c)
setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x4, 0x9, @loopback, 0x2}, {0xa, 0x4e24, 0x8000000, @mcast2}, 0x1, {[0x9, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x390]}}, 0x5c)
close_range(r2, 0xffffffffffffffff, 0x0)

356.580935ms ago: executing program 2 (id=1605):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7fc}], 0x2c)
sendto$inet6(r1, &(0x7f0000000040)="e4", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c)
readv(r1, &(0x7f0000000d00)=[{&(0x7f0000000780)=""/155, 0x9b}, {0x0}], 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f00000012c0)='./file0\x00', 0x81)
rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='./file0/file0\x00')
setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4)
sched_setscheduler(0x0, 0x2, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40)
r3 = getpid()
r4 = syz_pidfd_open(r3, 0x0)
setns(r4, 0x24020000)
mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xb, 0x0, 0x100000}, 0x20)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280))
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x5fae, 0x4)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000080)
syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x5885, 0x4000, 0x0, 0x1d}, &(0x7f0000000340), &(0x7f0000000600), &(0x7f0000001700))
io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f0000000040)={0x0, 0x0, 0xf}, 0x1)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x48850, 0x1}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x24040051}, 0x4000000)
shutdown(r0, 0x0)

268.413827ms ago: executing program 6 (id=1606):
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0)
ioctl$FBIOPUTCMAP(r0, 0x4605, &(0x7f0000000100)={0x0, 0x6366, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000480)=[0x6366], &(0x7f0000000440)=[0x0, 0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0]})

249.124289ms ago: executing program 4 (id=1607):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r1=>0x0})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x2c, r2, 0x1, 0x70bd25, 0x0, {{0x2}, {@val={0x8, 0x3, r1}, @void}}, [@chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x97b}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wlan0\x00'})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000900)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x50, r4, 0x400, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x17}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x40040c0}, 0x8000)
r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8)
r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r6, 0x80044dfd, &(0x7f00000000c0))
r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0)
ioctl$PTP_SYS_OFFSET_EXTENDED(r7, 0xc4c03d09, &(0x7f0000000340)={0x2})
r8 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2)
ftruncate(r8, 0x80079a3)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
getpid()

133.588195ms ago: executing program 6 (id=1608):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
r3 = bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r3}, 0x0, &(0x7f0000000640)}, 0x20)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000240), &(0x7f0000000280)='%pS    \x00'}, 0x20)
r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
io_uring_setup(0x1028, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='sysfs\x00', 0x1214040, 0x0)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000640)='./file0\x00')
syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0)
r5 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2)
ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0205648, 0x0)
close(0xffffffffffffffff)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x115)
getdents64(r6, &(0x7f0000000f80)=""/4096, 0x1000)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@loopback, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in6=@loopback}, 0x0, @in=@local}}, &(0x7f0000000540)=0xe8)
quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000202, r7, &(0x7f00000006c0)='./file0\x00')
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f00000002c0)=0x40b, 0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, '\x00', 0x34}, 0xd}, 0x1c)

132.507684ms ago: executing program 1 (id=1609):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x5, [@var={0x4, 0x0, 0x0, 0xe, 0x4}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x2d}, 0x28)
r0 = eventfd(0x5f0)
ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0x0, 0x0, r0})
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1)
socket(0x22, 0x3, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0)
r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0)
sendfile(r5, r6, 0x0, 0x106f)
ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10)
sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000840)
ioctl$TIOCSWINSZ(r4, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6})
r7 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)

0s ago: executing program 4 (id=1610):
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x169140, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x80000100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x8, 0x8, 0x4, 0x0, 0x8000], 0x8080000, 0x3c5200})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000040)="640f0177f6802c05f30f1a5feb6626650f236c660f38811c6736673685e167d736660f3825a20000f30f1eef0f01df", 0x2f}], 0x1, 0x57, 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000100)=@attr_other={0x0, 0x1, 0x1, &(0x7f0000000200)=0xffffffffffffffff})
ioctl$KVM_RUN(r0, 0xae80, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = syz_clone3(0x0, 0x0)
r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0)
r3 = msgget$private(0x0, 0x20)
read$FUSE(0xffffffffffffffff, &(0x7f0000000c80)={0x2020, 0x0, 0x0, <r4=>0x0}, 0x2020)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002cc0)={0x0, 0x0, <r5=>0x0}, &(0x7f0000002d00)=0xc)
lstat(&(0x7f0000002d40)='./file0\x00', &(0x7f0000002d80)={0x0, 0x0, 0x0, 0x0, <r6=>0x0})
lstat(&(0x7f0000002e00)='./file0\x00', &(0x7f0000002e40)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
msgctl$IPC_SET(r3, 0x1, &(0x7f0000002ec0)={{0x1, r4, r5, r6, r7, 0x10, 0x800}, 0x0, 0x0, 0x0, 0x93, 0x1, 0x2, 0x2, 0x2000, 0x5, 0x5, r1, r1})
ioctl$VHOST_RESET_OWNER(0xffffffffffffffff, 0xaf02, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102376, 0x18fe8)
r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0)
ioctl$UI_ABS_SETUP(r8, 0x401c5504, 0x0)
write$uinput_user_dev(r8, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x1, [0x0, 0x0, 0x0, 0x9, 0x7, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb8, 0x0, 0x0, 0xfffffffe, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x9, 0x8, 0x5, 0x0, 0x2, 0x0, 0xfffffffd, 0x7, 0x3, 0x0, 0x9, 0xfffffffe, 0x0, 0x8, 0x401, 0x0, 0x6, 0x0, 0x0, 0x296, 0x3, 0x20000, 0x0, 0x0, 0x200, 0x0, 0xfffffffc, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x40006, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x7ff, 0x2, 0x0, 0x7f, 0x0, 0x2, 0x0, 0x0, 0x1a, 0x0, 0x6, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x764, 0x0, 0x7, 0x2, 0xfffffffc, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x3, 0xfffffffe, 0xfd, 0x0, 0x200, 0x0, 0x2, 0x1, 0x3, 0x5, 0x5, 0x1, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x2007, 0x0, 0x7, 0x0, 0x0, 0x0, 0x10000], [0x9, 0xfc, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x50, 0x0, 0x200, 0x0, 0x28, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x7fff, 0x100000, 0x0, 0x921, 0x0, 0xfffffffc, 0x2, 0xfffffffe, 0x6, 0x0, 0x0, 0xbda3, 0x0, 0x8, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x40, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x9], [0x40000003, 0x0, 0x2635, 0x0, 0x7fffffd, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x9, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x2, 0x4, 0x100, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1f73, 0x3, 0x9, 0x0, 0x0, 0x0, 0x80000000, 0x400, 0xfffffffa, 0x10006, 0x166400, 0x5, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c)
ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x3)
ioctl$UI_DEV_CREATE(r8, 0x5501)
ioctl$UI_DEV_DESTROY(r8, 0x5502)

kernel console output (not intermixed with test programs):

1] usb 2-1: USB disconnect, device number 66
[  543.834203][ T5781] usblp0: removed
[  543.915326][T12727] 9pnet_fd: Insufficient options for proto=fd
[  544.490139][   T30] audit: type=1400 audit(1785315999.440:1242): avc:  denied  { listen } for  pid=12738 comm="syz.2.1367" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1
[  544.576051][   T30] audit: type=1400 audit(1785315999.490:1243): avc:  denied  { prog_load } for  pid=12740 comm="syz.1.1368" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  544.692392][   T30] audit: type=1400 audit(1785315999.650:1244): avc:  denied  { write } for  pid=12720 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  544.763720][   T30] audit: type=1400 audit(1785315999.720:1245): avc:  denied  { write } for  pid=12753 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  544.776696][ T5838] usb 3-1: new full-speed USB device number 13 using dummy_hcd
[  544.818564][ T5781] usb 7-1: new high-speed USB device number 44 using dummy_hcd
[  544.888600][T12758] Unsupported ieee802154 address type: 0
[  544.906782][ T5778] usb 2-1: new high-speed USB device number 67 using dummy_hcd
[  544.972859][ T5838] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x7 has invalid maxpacket 46011, setting to 64
[  544.988235][ T5781] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  544.988755][ T5838] usb 3-1: config 0 interface 0 has no altsetting 0
[  545.007929][ T5838] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[  545.014500][ T5781] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  545.017903][ T5838] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[  545.032641][ T5781] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121
[  545.042890][ T5838] usb 3-1: Product: syz
[  545.052338][ T5838] usb 3-1: Manufacturer: syz
[  545.074719][ T5781] usb 7-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  545.084627][ T5838] usb 3-1: SerialNumber: syz
[  545.090706][ T5778] usb 2-1: config 1 has an invalid interface number: 7 but max is 0
[  545.106983][ T5778] usb 2-1: config 1 has no interface number 0
[  545.112338][ T5838] usb 3-1: config 0 descriptor??
[  545.113653][ T5781] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  545.130969][ T5778] usb 2-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B
[  545.138491][T12739] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  545.151143][ T5781] usb 7-1: Product: syz
[  545.158752][ T5778] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024
[  545.168972][ T5838] usb 3-1: selecting invalid altsetting 0
[  545.172537][ T5781] usb 7-1: Manufacturer: syz
[  545.188148][ T5781] usb 7-1: SerialNumber: syz
[  545.194492][ T5778] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 7
[  545.232464][ T5778] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00
[  545.244950][ T5778] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  545.255232][ T5781] usb 7-1: config 0 descriptor??
[  545.270341][T12746] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22
[  545.278036][T12746] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22
[  545.285433][ T5778] usb 2-1: Product: syz
[  545.293743][ T5778] usb 2-1: Manufacturer: syz
[  545.298958][ T5778] usb 2-1: SerialNumber: syz
[  545.351429][ T5781] usb 7-1: ucan: probing device on interface #0
[  545.358473][T12750] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[  545.433547][T12739] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled
[  545.448777][T12739] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled
[  545.454310][   T30] kauditd_printk_skb: 2 callbacks suppressed
[  545.454324][   T30] audit: type=1400 audit(1785316000.410:1248): avc:  denied  { write } for  pid=12759 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  545.463704][T12739] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled
[  545.509480][ T5781] usb 7-1: ucan: device protocol version 0 is not supported
[  545.533799][ T5781] usb 7-1: ucan: probe failed; try to update the device firmware
[  545.555474][T12739] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled
[  545.558018][ T5838] usb 3-1: USB disconnect, device number 13
[  545.615561][   T30] audit: type=1400 audit(1785316000.570:1249): avc:  denied  { prog_run } for  pid=12749 comm="syz.1.1370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1
[  545.676056][   T30] audit: type=1400 audit(1785316000.610:1250): avc:  denied  { write } for  pid=12771 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  545.750238][T12750] binder: 12749:12750 ioctl ae01 2e returned -22
[  545.756794][ T5842] udevd[5842]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  545.769449][ T5730] usb 7-1: USB disconnect, device number 44
[  545.840792][T12750] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[  545.875679][ T5778] usb 2-1: No status endpoint found
[  546.334853][ T5778] usb 2-1: USB disconnect, device number 67
[  546.378766][T12791] FAULT_INJECTION: forcing a failure.
[  546.378766][T12791] name failslab, interval 1, probability 0, space 0, times 0
[  546.391563][   T30] audit: type=1400 audit(1785316001.340:1251): avc:  denied  { write } for  pid=12774 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  546.426504][T12791] CPU: 1 UID: 0 PID: 12791 Comm: syz.6.1373 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  546.426534][T12791] Tainted: [L]=SOFTLOCKUP
[  546.426540][T12791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  546.426549][T12791] Call Trace:
[  546.426555][T12791]  <TASK>
[  546.426562][T12791]  dump_stack_lvl+0x100/0x190
[  546.426591][T12791]  should_fail_ex.cold+0x5/0xa
[  546.426614][T12791]  should_failslab+0xc2/0x120
[  546.426637][T12791]  __kmalloc_node_track_caller_noprof+0xf9/0x830
[  546.426660][T12791]  ? kasprintf+0xc7/0x100
[  546.426690][T12791]  kvasprintf+0xbc/0x150
[  546.426713][T12791]  ? __pfx_kvasprintf+0x10/0x10
[  546.426746][T12791]  kasprintf+0xc7/0x100
[  546.426768][T12791]  ? __pfx_kasprintf+0x10/0x10
[  546.426790][T12791]  ? kasan_save_track+0x14/0x30
[  546.426813][T12791]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  546.426839][T12791]  ? __might_fault+0xc5/0x140
[  546.426858][T12791]  ? alloc_bprm+0x145/0x9d0
[  546.426885][T12791]  alloc_bprm+0x5c6/0x9d0
[  546.426911][T12791]  do_execveat_common.isra.0+0x19c/0x580
[  546.426936][T12791]  ? do_getname+0x191/0x390
[  546.426959][T12791]  __x64_sys_execveat+0xdf/0x130
[  546.426986][T12791]  do_syscall_64+0x115/0x870
[  546.427005][T12791]  ? clear_bhb_loop+0x40/0x90
[  546.427024][T12791]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  546.427042][T12791] RIP: 0033:0x7f7aa359de99
[  546.427057][T12791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  546.427073][T12791] RSP: 002b:00007f7aa4423028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142
[  546.427091][T12791] RAX: ffffffffffffffda RBX: 00007f7aa3825fa0 RCX: 00007f7aa359de99
[  546.427102][T12791] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004
[  546.427112][T12791] RBP: 00007f7aa4423090 R08: 0000000000001000 R09: 0000000000000000
[  546.427122][T12791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  546.427132][T12791] R13: 00007f7aa3826038 R14: 00007f7aa3825fa0 R15: 00007fff40f734d8
[  546.427155][T12791]  </TASK>
[  546.688650][   T30] audit: type=1400 audit(1785316001.650:1252): avc:  denied  { write } for  pid=12793 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  547.047424][   T30] audit: type=1400 audit(1785316001.960:1253): avc:  denied  { read append } for  pid=12799 comm="syz.6.1375" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1
[  547.098526][T12804] bond5: option lacp_rate: invalid value (159)
[  547.151516][T12804] bond5 (unregistering): Released all slaves
[  547.304837][   T30] audit: type=1400 audit(1785316001.960:1254): avc:  denied  { open } for  pid=12799 comm="syz.6.1375" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1
[  547.582206][   T30] audit: type=1400 audit(1785316001.970:1255): avc:  denied  { ioctl } for  pid=12799 comm="syz.6.1375" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1
[  547.936500][T12812] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (pcl818)
[  548.088539][ T5730] IPVS: starting estimator thread 0...
[  548.108186][T12812] IPVS: lc: FWM 3 0x00000003 - no destination available
[  548.187186][T12810] IPVS: using max 76 ests per chain, 182400 per kthread
[  549.297322][ T5730] usb 2-1: new high-speed USB device number 68 using dummy_hcd
[  549.362791][   T30] audit: type=1400 audit(1785316004.320:1256): avc:  denied  { write } for  pid=12795 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  549.476237][ T5730] usb 2-1: Using ep0 maxpacket: 16
[  549.487300][ T5730] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  549.508549][ T5730] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  549.530250][ T5730] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  549.554895][ T5730] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  549.574522][ T5730] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  549.653179][   T30] audit: type=1400 audit(1785316004.610:1257): avc:  denied  { write } for  pid=12832 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  550.232611][ T5730] usb 2-1: config 0 descriptor??
[  550.637511][T12814] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  550.644468][T12814] Bluetooth: hci1: Error when powering off device on rfkill (-4)
[  550.870044][T12814] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  550.918744][T12814] Bluetooth: hci2: Error when powering off device on rfkill (-4)
[  551.164157][T12814] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  551.200071][T12814] Bluetooth: hci3: Error when powering off device on rfkill (-4)
[  551.210372][   T30] audit: type=1400 audit(1785316006.170:1258): avc:  denied  { write } for  pid=12838 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  551.667282][   T30] audit: type=1400 audit(1785316006.620:1259): avc:  denied  { write } for  pid=12859 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  551.729538][ T5730] usbhid 2-1:0.0: can't add hid device: -71
[  551.738579][ T5730] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  551.758182][ T5730] usb 2-1: USB disconnect, device number 68
[  551.930390][T12870] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1386'.
[  554.035427][   T30] audit: type=1400 audit(1785316008.990:1260): avc:  denied  { write } for  pid=12869 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  554.154040][   T30] audit: type=1400 audit(1785316009.110:1261): avc:  denied  { write } for  pid=12896 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  555.131965][   T30] audit: type=1400 audit(1785316010.090:1262): avc:  denied  { write } for  pid=12903 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  555.292482][   T30] audit: type=1400 audit(1785316010.250:1263): avc:  denied  { write } for  pid=12923 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  555.636041][T12936] x_tables: duplicate underflow at hook 1
[  556.528212][   T30] audit: type=1400 audit(1785316011.490:1264): avc:  denied  { write } for  pid=12929 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  556.980517][   T30] audit: type=1400 audit(1785316011.860:1265): avc:  denied  { write } for  pid=12944 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  557.064689][T12948] IPVS: set_ctl: invalid protocol: 255 10.1.1.0:20000
[  558.418288][   T30] audit: type=1400 audit(1785316012.170:1266): avc:  denied  { wake_alarm } for  pid=12949 comm="syz.2.1398" capability=35  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  558.881640][T12959] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[  558.917899][T12959] Cannot find add_set index 0 as target
[  559.050015][ T5612] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  559.070780][ T5612] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  559.083328][ T5612] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  559.098688][ T5612] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  559.108197][ T5612] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  559.135173][   T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  559.147065][   T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  559.155867][   T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  559.167661][   T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  559.175457][   T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  559.305374][T12968] tipc: Enabling of bearer <eth:xfrm0> rejected, already enabled
[  559.480645][   T30] audit: type=1400 audit(1785316014.430:1267): avc:  denied  { write } for  pid=12956 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  559.706734][   T30] audit: type=1400 audit(1785316014.510:1268): avc:  denied  { bind } for  pid=12983 comm="syz.1.1403" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1
[  560.304741][   T30] audit: type=1400 audit(1785316014.510:1269): avc:  denied  { setopt } for  pid=12983 comm="syz.1.1403" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1
[  560.458363][   T30] audit: type=1400 audit(1785316014.630:1270): avc:  denied  { write } for  pid=12986 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  560.609794][T13000] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1404'.
[  560.734900][T13000] 8021q: adding VLAN 0 to HW filter on device bond2
[  560.765000][   T29] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0
[  560.894778][   T29] hid-generic 0000:0000:0000.0009: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  561.033700][   T30] audit: type=1400 audit(1785316015.990:1271): avc:  denied  { write } for  pid=12993 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  561.265682][   T30] audit: type=1400 audit(1785316016.220:1272): avc:  denied  { write } for  pid=13021 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  561.289424][   T50] Bluetooth: hci4: command tx timeout
[  561.599202][T12962] bridge0: port 1(bridge_slave_0) entered blocking state
[  561.656195][T12962] bridge0: port 1(bridge_slave_0) entered disabled state
[  561.689998][T12962] bridge_slave_0: entered allmulticast mode
[  561.716705][T12962] bridge_slave_0: entered promiscuous mode
[  561.742350][T13037] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  561.775490][T12962] bridge0: port 2(bridge_slave_1) entered blocking state
[  561.807563][T12962] bridge0: port 2(bridge_slave_1) entered disabled state
[  561.838694][T12962] bridge_slave_1: entered allmulticast mode
[  561.853042][T12962] bridge_slave_1: entered promiscuous mode
[  561.890205][ T5612] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  561.905626][ T5612] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  561.919222][ T5612] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  561.934499][ T5612] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  561.945541][ T5612] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  562.047703][T12962] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  562.111602][T12962] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  562.155893][   T30] audit: type=1400 audit(1785316017.110:1273): avc:  denied  { write } for  pid=13025 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  562.249554][T12962] team0: Port device team_slave_0 added
[  562.257148][   T29] usb 2-1: new high-speed USB device number 69 using dummy_hcd
[  562.284530][T12962] team0: Port device team_slave_1 added
[  562.362178][T12962] batman_adv: batadv0: Adding interface: batadv_slave_0
[  562.383623][T12962] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  562.440571][   T29] usb 2-1: Using ep0 maxpacket: 16
[  562.454413][   T30] audit: type=1400 audit(1785316017.410:1274): avc:  denied  { write } for  pid=13052 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  562.488931][T12962] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  562.492597][   T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  562.514820][T12962] batman_adv: batadv0: Adding interface: batadv_slave_1
[  562.526956][T12962] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  562.555935][T12962] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  562.559713][ T1312] ieee802154 phy0 wpan0: encryption failed: -22
[  562.586196][ T1312] ieee802154 phy1 wpan1: encryption failed: -22
[  562.597149][   T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  562.608461][   T29] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  562.622387][   T29] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00
[  562.631728][   T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  562.652282][   T29] usb 2-1: config 0 descriptor??
[  562.785803][T12962] hsr_slave_0: entered promiscuous mode
[  562.819643][T12962] hsr_slave_1: entered promiscuous mode
[  562.873321][T12962] debugfs: 'hsr0' already exists in 'hsr'
[  562.896690][ T5838] usb 7-1: new high-speed USB device number 45 using dummy_hcd
[  562.905697][T12962] Cannot create hsr debugfs directory
[  562.982209][   T30] audit: type=1400 audit(1785316017.940:1275): avc:  denied  { write } for  pid=13060 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  563.048701][ T5838] usb 7-1: Using ep0 maxpacket: 8
[  563.060329][ T5838] usb 7-1: unable to get BOS descriptor or descriptor too short
[  563.071801][   T29] shield 0003:0955:7214.000A: unknown main item tag 0x0
[  563.084714][ T5838] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 16
[  563.096697][   T29] shield 0003:0955:7214.000A: unknown main item tag 0x0
[  563.104109][   T29] shield 0003:0955:7214.000A: unknown main item tag 0x0
[  563.112197][   T29] shield 0003:0955:7214.000A: unknown main item tag 0x0
[  563.120131][ T5838] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice= 0.40
[  563.129725][ T5838] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  563.139409][ T5838] usb 7-1: Product: syz
[  563.143641][   T29] shield 0003:0955:7214.000A: unknown main item tag 0x0
[  563.151309][ T5838] usb 7-1: Manufacturer: syz
[  563.156750][ T5838] usb 7-1: SerialNumber: syz
[  563.164781][   T29] input: HID 0955:7214 Haptics as /devices/virtual/input/input39
[  563.180049][T13058] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22
[  563.336682][ T5612] Bluetooth: hci4: command tx timeout
[  563.354744][   T30] audit: type=1400 audit(1785316018.310:1276): avc:  denied  { write } for  pid=13074 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  563.384723][   T29] shield 0003:0955:7214.000A: Registered Thunderstrike controller
[  563.398831][   T29] shield 0003:0955:7214.000A: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0
[  563.665220][T13075] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1409'.
[  563.739734][T13081] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1409'.
[  563.772814][   T30] audit: type=1400 audit(1785316018.730:1277): avc:  denied  { create } for  pid=13082 comm="syz.2.1411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1
[  563.812715][   T30] audit: type=1400 audit(1785316018.760:1278): avc:  denied  { write } for  pid=13082 comm="syz.2.1411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1
[  563.985635][   T30] audit: type=1400 audit(1785316018.940:1279): avc:  denied  { write } for  pid=13077 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  564.056972][ T5612] Bluetooth: hci5: command tx timeout
[  564.066697][ T5730] usb 3-1: new high-speed USB device number 14 using dummy_hcd
[  564.114938][   T30] audit: type=1400 audit(1785316019.070:1280): avc:  denied  { write } for  pid=13091 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  564.255156][ T5730] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[  564.273563][ T5730] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  564.298666][ T5730] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[  564.326638][ T5730] usb 3-1: config 1 has no interface number 1
[  564.332849][ T5730] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[  564.376532][ T5730] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  564.392498][ T5730] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  564.411670][ T5730] usb 3-1: Product: syz
[  564.421414][ T5730] usb 3-1: Manufacturer: syz
[  564.434832][ T5730] usb 3-1: SerialNumber: syz
[  564.469364][ T5716] shield 0003:0955:7214.000A: Failed to output Thunderstrike HOSTCMD request HID report due to -ESHUTDOWN
[  564.499202][ T5716] shield 0003:0955:7214.000A: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO
[  564.531273][ T5716] shield 0003:0955:7214.000A: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO
[  564.560171][ T5716] shield 0003:0955:7214.000A: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO
[  564.665416][ T5730] usb 3-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0
[  564.673312][   T29] usb 2-1: reset high-speed USB device number 69 using dummy_hcd
[  564.681574][   T30] audit: type=1400 audit(1785316019.640:1281): avc:  denied  { write } for  pid=13094 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  564.696720][ T5730] usb 3-1: MIDIStreaming interface descriptor not found
[  564.780117][T12962] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  564.793911][ T5730] usb 3-1: USB disconnect, device number 14
[  564.804903][T12962] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  564.856742][   T29] usb 2-1: device descriptor read/64, error -32
[  564.875901][   T30] audit: type=1400 audit(1785316019.830:1282): avc:  denied  { write } for  pid=13112 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  564.909855][ T5624] udevd[5624]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  564.925159][T13040] bridge0: port 1(bridge_slave_0) entered blocking state
[  564.939157][T13040] bridge0: port 1(bridge_slave_0) entered disabled state
[  564.963145][T13040] bridge_slave_0: entered allmulticast mode
[  564.979826][T13040] bridge_slave_0: entered promiscuous mode
[  564.997914][T12962] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  565.020088][T12962] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  565.028131][T13040] bridge0: port 2(bridge_slave_1) entered blocking state
[  565.035750][T13040] bridge0: port 2(bridge_slave_1) entered disabled state
[  565.045147][T13040] bridge_slave_1: entered allmulticast mode
[  565.052764][T13040] bridge_slave_1: entered promiscuous mode
[  565.072035][T12962] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  565.081487][T12962] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  565.091288][T12962] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  565.101249][T12962] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  565.124420][T13040] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  565.137438][   T29] usb 2-1: reset high-speed USB device number 69 using dummy_hcd
[  565.166857][T13040] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  565.231576][T13040] team0: Port device team_slave_0 added
[  565.240413][T13040] team0: Port device team_slave_1 added
[  565.286811][   T29] usb 2-1: device descriptor read/64, error -32
[  565.288304][T13040] batman_adv: batadv0: Adding interface: batadv_slave_0
[  565.328965][T13040] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  565.381372][T13040] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  565.411992][T13040] batman_adv: batadv0: Adding interface: batadv_slave_1
[  565.426923][ T5612] Bluetooth: hci4: command tx timeout
[  565.429792][T13040] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  565.491462][T13040] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  565.927497][ T5838] usb 7-1: Quirk or no altset; falling back to MIDI 1.0
[  565.938126][T13040] hsr_slave_0: entered promiscuous mode
[  565.955903][ T5838] usb 7-1: invalid MIDI in EP 0
[  565.963113][T13040] hsr_slave_1: entered promiscuous mode
[  565.982608][T13040] debugfs: 'hsr0' already exists in 'hsr'
[  566.000872][T13142] overlayfs: overlapping lowerdir path
[  566.007694][T13040] Cannot create hsr debugfs directory
[  566.146811][ T5612] Bluetooth: hci5: command tx timeout
[  566.237037][T13145] siw: device registration error -23
[  566.682958][ T5716] usb 2-1: USB disconnect, device number 69
[  566.717875][ T5838] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22
[  566.760895][ T5838] usb 7-1: USB disconnect, device number 45
[  566.907349][T13148] FAULT_INJECTION: forcing a failure.
[  566.907349][T13148] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  566.936778][T13148] CPU: 1 UID: 0 PID: 13148 Comm: syz.6.1416 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  566.936809][T13148] Tainted: [L]=SOFTLOCKUP
[  566.936815][T13148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  566.936823][T13148] Call Trace:
[  566.936829][T13148]  <TASK>
[  566.936835][T13148]  dump_stack_lvl+0x100/0x190
[  566.936862][T13148]  should_fail_ex.cold+0x5/0xa
[  566.936884][T13148]  _copy_to_user+0x32/0xd0
[  566.936909][T13148]  drm_ioctl+0x608/0xc60
[  566.936933][T13148]  ? __pfx_drm_mode_getproperty_ioctl+0x10/0x10
[  566.936954][T13148]  ? __pfx_drm_ioctl+0x10/0x10
[  566.936982][T13148]  ? selinux_file_ioctl+0x13b/0x290
[  566.937007][T13148]  ? selinux_file_ioctl+0xb6/0x290
[  566.937034][T13148]  ? __pfx_drm_ioctl+0x10/0x10
[  566.937053][T13148]  __x64_sys_ioctl+0x18e/0x210
[  566.937086][T13148]  do_syscall_64+0x115/0x870
[  566.937107][T13148]  ? clear_bhb_loop+0x40/0x90
[  566.937129][T13148]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  566.937146][T13148] RIP: 0033:0x7f7aa359de99
[  566.937160][T13148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  566.937176][T13148] RSP: 002b:00007f7aa4423028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  566.937193][T13148] RAX: ffffffffffffffda RBX: 00007f7aa3825fa0 RCX: 00007f7aa359de99
[  566.937205][T13148] RDX: 0000200000000700 RSI: 00000000c04064aa RDI: 0000000000000003
[  566.937216][T13148] RBP: 00007f7aa4423090 R08: 0000000000000000 R09: 0000000000000000
[  566.937228][T13148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  566.937239][T13148] R13: 00007f7aa3826038 R14: 00007f7aa3825fa0 R15: 00007fff40f734d8
[  566.937263][T13148]  </TASK>
[  566.982823][T12962] 8021q: adding VLAN 0 to HW filter on device bond0
[  567.269223][ T5842] udevd[5842]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  567.496824][ T5612] Bluetooth: hci4: command tx timeout
[  567.840893][T12962] 8021q: adding VLAN 0 to HW filter on device team0
[  567.940336][   T30] kauditd_printk_skb: 2 callbacks suppressed
[  567.940348][   T30] audit: type=1400 audit(1785316022.890:1285): avc:  denied  { write } for  pid=13158 comm="syz.2.1418" name="functions" dev="configfs" ino=21548 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  568.024968][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[  568.032199][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[  568.138611][T13162] ucma_write: process 90 (syz.2.1418) changed security contexts after opening file descriptor, this is not allowed.
[  568.216752][ T5612] Bluetooth: hci5: command tx timeout
[  568.334995][ T1339] bridge0: port 2(bridge_slave_1) entered blocking state
[  568.342184][ T1339] bridge0: port 2(bridge_slave_1) entered forwarding state
[  569.089007][   T30] audit: type=1400 audit(1785316024.050:1286): avc:  denied  { write } for  pid=13153 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  569.332795][   T30] audit: type=1400 audit(1785316024.290:1287): avc:  denied  { write } for  pid=13181 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  570.301467][ T5612] Bluetooth: hci5: command tx timeout
[  570.560869][   T30] audit: type=1400 audit(1785316025.510:1288): avc:  denied  { write } for  pid=13185 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  571.137469][   T30] audit: type=1400 audit(1785316026.090:1289): avc:  denied  { write } for  pid=13222 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  572.106253][   T30] audit: type=1400 audit(1785316027.060:1290): avc:  denied  { ioctl } for  pid=13231 comm="syz.6.1428" path="/237/file0" dev="tmpfs" ino=1278 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1
[  572.188635][T12962] 8021q: adding VLAN 0 to HW filter on device batadv0
[  572.266061][T13040] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  572.283583][T13040] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  572.301329][T13040] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  572.315969][T13040] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  572.333332][T13040] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  572.360183][T13040] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  572.387249][T13040] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  572.537565][T13040] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  572.545773][T12962] veth0_vlan: entered promiscuous mode
[  572.578157][T12962] veth1_vlan: entered promiscuous mode
[  572.927027][ T5716] usb 3-1: new high-speed USB device number 15 using dummy_hcd
[  573.181331][ T5716] usb 3-1: Using ep0 maxpacket: 16
[  573.188234][T12962] veth0_macvtap: entered promiscuous mode
[  573.211252][ T5716] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40
[  573.230131][T12962] veth1_macvtap: entered promiscuous mode
[  573.236248][ T5716] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  573.269714][ T5716] usb 3-1: Product: syz
[  573.286396][ T5716] usb 3-1: Manufacturer: syz
[  573.297048][T12962] batman_adv: batadv0: Interface activated: batadv_slave_0
[  573.305441][ T5716] usb 3-1: SerialNumber: syz
[  573.345050][T12962] batman_adv: batadv0: Interface activated: batadv_slave_1
[  573.400383][T13040] 8021q: adding VLAN 0 to HW filter on device bond0
[  573.430432][ T6781] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  573.447939][ T6781] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  573.469616][ T6781] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  573.486761][ T5781] usb 2-1: new high-speed USB device number 70 using dummy_hcd
[  573.486915][ T6781] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  573.571313][T13040] 8021q: adding VLAN 0 to HW filter on device team0
[  573.616319][ T6776] bridge0: port 1(bridge_slave_0) entered blocking state
[  573.623636][ T6776] bridge0: port 1(bridge_slave_0) entered forwarding state
[  573.678416][ T5781] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  573.708882][ T6776] bridge0: port 2(bridge_slave_1) entered blocking state
[  573.716067][ T6776] bridge0: port 2(bridge_slave_1) entered forwarding state
[  573.734220][ T5781] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  573.763634][ T5781] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121
[  573.792322][ T5781] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  573.810595][ T5781] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  573.842992][ T5781] usb 2-1: Product: syz
[  573.852120][   T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  573.862267][   T30] audit: type=1400 audit(1785316028.810:1291): avc:  denied  { write } for  pid=13254 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  573.864191][ T5781] usb 2-1: Manufacturer: syz
[  573.897440][   T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  573.898853][ T5781] usb 2-1: SerialNumber: syz
[  573.912882][ T5781] usb 2-1: config 0 descriptor??
[  573.919453][T13253] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  573.949528][T13253] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  573.978538][ T1007] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  574.011422][ T5781] usb 2-1: ucan: probing device on interface #0
[  574.018413][ T1007] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  574.094489][   T30] audit: type=1400 audit(1785316029.050:1292): avc:  denied  { write } for  pid=13265 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  574.182985][T13270] CUSE: unknown device info ""
[  574.208029][T13270] CUSE: unknown device info "Ö"
[  574.214828][ T5781] usb 2-1: ucan: device protocol version 0 is not supported
[  574.232977][T13270] CUSE: unknown device info "ÚË"
[  574.239889][ T5781] usb 2-1: ucan: probe failed; try to update the device firmware
[  574.253722][T13270] CUSE: unknown device info ""
[  574.290225][T13270] CUSE: unknown device info ""
[  574.361948][T13270] CUSE: unknown device info ""
[  574.368851][T13270] CUSE: unknown device info "þ"
[  574.373773][T13270] CUSE: unknown device info ""
[  574.417413][T13270] CUSE: unknown device info "@"
[  574.439505][ T7121] usb 2-1: USB disconnect, device number 70
[  574.445924][T13270] CUSE: unknown device info "ÿ
"
[  574.506326][T13270] CUSE: unknown device info ""
[  574.570749][T13270] CUSE: unknown device info "#Û"
[  574.843745][T13270] CUSE: unknown device info "ÿÿÿÿ"
[  574.912331][T13270] CUSE: unknown device info ""
[  574.960355][T13270] CUSE: unknown device info "€"
[  574.975291][T13270] CUSE: DEVNAME unspecified
[  575.224716][T13296] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  575.687557][   T30] audit: type=1400 audit(1785316030.640:1293): avc:  denied  { write } for  pid=13272 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  576.339166][ T5716] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71
[  576.392304][T13040] 8021q: adding VLAN 0 to HW filter on device batadv0
[  576.414081][ T5716] usb 3-1: USB disconnect, device number 15
[  576.495116][   T30] audit: type=1400 audit(1785316031.450:1294): avc:  denied  { write } for  pid=13311 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  576.534535][T13316] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (pcl818)
[  576.868226][ T5781] usb 4-1: new high-speed USB device number 8 using dummy_hcd
[  577.377385][ T5781] usb 4-1: Using ep0 maxpacket: 32
[  577.383256][ T5781] usb 4-1: too many configurations: 40, using maximum allowed: 8
[  577.392842][ T5781] usb 4-1: unable to read config index 0 descriptor/start: -61
[  577.412610][ T5781] usb 4-1: can't read configurations, error -61
[  577.497973][T13040] veth0_vlan: entered promiscuous mode
[  577.539245][T13040] veth1_vlan: entered promiscuous mode
[  577.590963][ T5781] usb 4-1: new high-speed USB device number 9 using dummy_hcd
[  577.628557][T13040] veth0_macvtap: entered promiscuous mode
[  577.654288][T13040] veth1_macvtap: entered promiscuous mode
[  577.867581][ T5781] usb 4-1: Using ep0 maxpacket: 32
[  577.957451][ T5781] usb 4-1: too many configurations: 40, using maximum allowed: 8
[  577.976036][ T5781] usb 4-1: unable to read config index 0 descriptor/start: -61
[  578.003714][ T5781] usb 4-1: can't read configurations, error -61
[  578.033037][ T5781] usb usb4-port1: attempt power cycle
[  578.042373][T13040] batman_adv: batadv0: Interface activated: batadv_slave_0
[  578.096859][T13040] batman_adv: batadv0: Interface activated: batadv_slave_1
[  578.577830][ T5781] usb 4-1: new high-speed USB device number 10 using dummy_hcd
[  578.679870][ T5781] usb 4-1: Using ep0 maxpacket: 32
[  578.722444][ T5781] usb 4-1: too many configurations: 40, using maximum allowed: 8
[  578.812342][ T5781] usb 4-1: unable to read config index 0 descriptor/start: -61
[  578.866468][T13360] netlink: 116 bytes leftover after parsing attributes in process `syz.6.1446'.
[  578.883005][ T5781] usb 4-1: can't read configurations, error -61
[  578.918716][   T30] audit: type=1400 audit(1785316033.880:1295): avc:  denied  { write } for  pid=13326 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  579.036708][ T5781] usb 4-1: new high-speed USB device number 11 using dummy_hcd
[  579.067683][   T57] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  579.097261][ T5781] usb 4-1: Using ep0 maxpacket: 32
[  579.105940][ T5781] usb 4-1: too many configurations: 40, using maximum allowed: 8
[  579.118949][ T5781] usb 4-1: unable to read config index 0 descriptor/start: -61
[  579.127485][ T5781] usb 4-1: can't read configurations, error -61
[  579.141665][ T5781] usb usb4-port1: unable to enumerate USB device
[  579.500825][   T57] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  579.509750][   T57] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  579.519184][ T1007] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  579.622354][T13373] syzkaller0: entered promiscuous mode
[  579.628196][T13373] syzkaller0: entered allmulticast mode
[  579.641065][T13373] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1447'.
[  579.788754][   T30] audit: type=1400 audit(1785316034.750:1296): avc:  denied  { write } for  pid=13371 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  579.969796][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  579.981160][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  580.123905][   T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  580.127150][   T30] audit: type=1400 audit(1785316035.060:1297): avc:  denied  { write } for  pid=13377 comm="syz.3.1450" name="functions" dev="configfs" ino=21548 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  580.269921][   T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  580.690483][T13376] FAULT_INJECTION: forcing a failure.
[  580.690483][T13376] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  580.715358][T13376] CPU: 0 UID: 0 PID: 13376 Comm: syz.6.1448 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  580.715379][T13376] Tainted: [L]=SOFTLOCKUP
[  580.715383][T13376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  580.715390][T13376] Call Trace:
[  580.715396][T13376]  <TASK>
[  580.715403][T13376]  dump_stack_lvl+0x100/0x190
[  580.715429][T13376]  should_fail_ex.cold+0x5/0xa
[  580.715452][T13376]  core_sys_select+0x938/0xbb0
[  580.715467][T13376]  ? __pfx_core_sys_select+0x10/0x10
[  580.715478][T13376]  ? find_held_lock+0x2b/0x80
[  580.715496][T13376]  ? get_pid_task+0xfc/0x250
[  580.715529][T13376]  ? __pfx_set_user_sigmask+0x10/0x10
[  580.715543][T13376]  ? __mutex_unlock_slowpath+0x35d/0x930
[  580.715560][T13376]  do_pselect.constprop.0+0x238/0x270
[  580.715574][T13376]  ? __pfx_do_pselect.constprop.0+0x10/0x10
[  580.715588][T13376]  ? ksys_write+0x1ac/0x250
[  580.715608][T13376]  __x64_sys_pselect6+0x149/0x1c0
[  580.715622][T13376]  do_syscall_64+0x115/0x870
[  580.715634][T13376]  ? clear_bhb_loop+0x40/0x90
[  580.715648][T13376]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  580.715660][T13376] RIP: 0033:0x7f7aa359de99
[  580.715670][T13376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  580.715681][T13376] RSP: 002b:00007f7aa4423028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
[  580.715692][T13376] RAX: ffffffffffffffda RBX: 00007f7aa3825fa0 RCX: 00007f7aa359de99
[  580.715700][T13376] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000040
[  580.715706][T13376] RBP: 00007f7aa4423090 R08: 0000000000000000 R09: 0000000000000000
[  580.715713][T13376] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001
[  580.715720][T13376] R13: 00007f7aa3826038 R14: 00007f7aa3825fa0 R15: 00007fff40f734d8
[  580.715733][T13376]  </TASK>
[  581.250982][T13399] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1454'.
[  581.294931][T13399] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1454'.
[  581.344160][   T30] audit: type=1400 audit(1785316036.240:1298): avc:  denied  { write } for  pid=13377 comm="syz.3.1450" name="extensions" dev="configfs" ino=48443 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[  581.436958][ T5716] usb 5-1: new high-speed USB device number 11 using dummy_hcd
[  581.694176][   T30] audit: type=1400 audit(1785316036.650:1299): avc:  denied  { write } for  pid=13383 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  581.778314][ T5716] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[  581.792123][T13409] FAULT_INJECTION: forcing a failure.
[  581.792123][T13409] name failslab, interval 1, probability 0, space 0, times 0
[  581.822301][ T5716] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 12683, setting to 1024
[  581.823759][   T30] audit: type=1400 audit(1785316036.780:1300): avc:  denied  { write } for  pid=13410 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  581.865862][T13409] CPU: 0 UID: 0 PID: 13409 Comm: syz.1.1455 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  581.865891][T13409] Tainted: [L]=SOFTLOCKUP
[  581.865898][T13409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  581.865907][T13409] Call Trace:
[  581.865913][T13409]  <TASK>
[  581.865921][T13409]  dump_stack_lvl+0x100/0x190
[  581.865947][T13409]  should_fail_ex.cold+0x5/0xa
[  581.865968][T13409]  should_failslab+0xc2/0x120
[  581.865988][T13409]  __kmalloc_noprof+0xfc/0x820
[  581.866006][T13409]  ? genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0
[  581.866035][T13409]  genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0
[  581.866062][T13409]  genl_family_rcv_msg_doit+0xc7/0x300
[  581.866084][T13409]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  581.866112][T13409]  ? bpf_lsm_capable+0x9/0x10
[  581.866128][T13409]  ? security_capable+0x80/0x260
[  581.866152][T13409]  ? ns_capable+0xd2/0xf0
[  581.866174][T13409]  genl_rcv_msg+0x560/0x800
[  581.866197][T13409]  ? __pfx_genl_rcv_msg+0x10/0x10
[  581.866216][T13409]  ? __pfx_hwsim_set_edge_lqi+0x10/0x10
[  581.866238][T13409]  ? __lock_acquire+0x49f/0x1a40
[  581.866263][T13409]  netlink_rcv_skb+0x159/0x420
[  581.866281][T13409]  ? __pfx_genl_rcv_msg+0x10/0x10
[  581.866300][T13409]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  581.866326][T13409]  ? netlink_deliver_tap+0x1ae/0xcc0
[  581.866356][T13409]  genl_rcv+0x28/0x40
[  581.866373][T13409]  netlink_unicast+0x585/0x850
[  581.866395][T13409]  ? __pfx_netlink_unicast+0x10/0x10
[  581.866421][T13409]  netlink_sendmsg+0x8b0/0xda0
[  581.866444][T13409]  ? __pfx_netlink_sendmsg+0x10/0x10
[  581.866480][T13409]  ? selinux_socket_sendmsg+0x198/0x2f0
[  581.866512][T13409]  ____sys_sendmsg+0xa4d/0xbe0
[  581.866536][T13409]  ? __pfx_netlink_sendmsg+0x10/0x10
[  581.866556][T13409]  ? __pfx_____sys_sendmsg+0x10/0x10
[  581.866594][T13409]  ___sys_sendmsg+0x190/0x1e0
[  581.866623][T13409]  ? __pfx____sys_sendmsg+0x10/0x10
[  581.866647][T13409]  ? __lock_acquire+0x49f/0x1a40
[  581.866669][T13409]  ? get_pid_task+0x106/0x250
[  581.866723][T13409]  __sys_sendmsg+0x160/0x210
[  581.866745][T13409]  ? __pfx___sys_sendmsg+0x10/0x10
[  581.866780][T13409]  do_syscall_64+0x115/0x870
[  581.866799][T13409]  ? clear_bhb_loop+0x40/0x90
[  581.866822][T13409]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  581.866840][T13409] RIP: 0033:0x7fa1f719de99
[  581.866855][T13409] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  581.866871][T13409] RSP: 002b:00007fa1f7f9a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  581.866889][T13409] RAX: ffffffffffffffda RBX: 00007fa1f7425fa0 RCX: 00007fa1f719de99
[  581.866900][T13409] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004
[  581.866911][T13409] RBP: 00007fa1f7f9a090 R08: 0000000000000000 R09: 0000000000000000
[  581.866921][T13409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  581.866931][T13409] R13: 00007fa1f7426038 R14: 00007fa1f7425fa0 R15: 00007ffcbebaf138
[  581.866955][T13409]  </TASK>
[  581.876179][ T5716] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024
[  582.128842][   T30] audit: type=1400 audit(1785316037.090:1301): avc:  denied  { setopt } for  pid=13420 comm="syz.6.1459" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1
[  582.227773][ T5716] usb 5-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00
[  582.245001][ T5716] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  582.339361][ T5716] usb 5-1: Product: syz
[  582.397772][ T5716] usb 5-1: Manufacturer: syz
[  582.656143][T13394] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  582.665700][T13394] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  582.745091][   T30] audit: type=1400 audit(1785316037.110:1302): avc:  denied  { checkpoint_restore } for  pid=13415 comm="syz.1.1458" capability=40  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1
[  582.748670][ T5716] usb_debug 5-1:1.0: debug converter detected
[  582.909506][ T5716] usb 5-1: debug converter now attached to ttyUSB0
[  582.917632][T13433] syzkaller0: entered promiscuous mode
[  582.950837][T13433] syzkaller0: entered allmulticast mode
[  583.470299][T13429] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1457'.
[  584.111453][    C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71
[  584.131916][ T7221] usb 5-1: USB disconnect, device number 11
[  584.185910][ T7221] debug ttyUSB0: debug converter now disconnected from ttyUSB0
[  584.212023][ T7221] usb_debug 5-1:1.0: device disconnected
[  584.226872][   T30] audit: type=1400 audit(1785316039.170:1303): avc:  denied  { write } for  pid=13414 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  584.372823][T13460] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2569 sclass=netlink_route_socket pid=13460 comm=syz.3.1465
[  584.385642][T13460] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2572 sclass=netlink_route_socket pid=13460 comm=syz.3.1465
[  584.407099][T13460] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1465'.
[  584.416096][T13460] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1465'.
[  584.416639][ T5778] usb 7-1: new high-speed USB device number 46 using dummy_hcd
[  584.461705][T13461] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1465'.
[  584.471107][T13461] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1465'.
[  584.536669][   T36] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  584.566890][   T36] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  584.588847][   T30] audit: type=1400 audit(1785316039.550:1304): avc:  denied  { write } for  pid=13462 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  584.596391][   T36] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  584.641525][   T36] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  584.700248][ T5778] usb 7-1: Using ep0 maxpacket: 16
[  584.727411][ T5778] usb 7-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85
[  584.736753][ T5778] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  584.752129][ T5778] usb 7-1: Product: syz
[  584.759960][ T5778] usb 7-1: Manufacturer: syz
[  584.766241][ T5778] usb 7-1: SerialNumber: syz
[  584.841093][ T6816] syz_tun (unregistering): left allmulticast mode
[  586.360989][ T5778] usb 7-1: config 0 descriptor??
[  586.377319][ T5778] usb 7-1: selecting invalid altsetting 1
[  586.384241][ T5778] technisat-usb2: could not set alternate setting to 0
[  586.567774][ T5778] technisat-usb2: firmware version: 0.0
[  586.575964][ T5778] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state.
[  586.623298][ T5778] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  586.671632][ T5778] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2))
[  586.718291][   T30] audit: type=1400 audit(1785316041.680:1305): avc:  denied  { write } for  pid=13464 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  586.721270][ T5778] usb 7-1: media controller created
[  586.776378][ T5778] technisat-usb2: i2c-error: out failed 53 = -22
[  586.828248][ T5778] dvb-usb: MAC address reading failed.
[  586.844565][   T30] audit: type=1400 audit(1785316041.800:1306): avc:  denied  { write } for  pid=13484 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  586.893068][ T5778] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  587.015760][   T30] audit: type=1400 audit(1785316041.970:1307): avc:  denied  { mounton } for  pid=13492 comm="syz.6.1473" path="/250/rpc_pipefs" dev="rpc_pipefs" ino=49249 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=dir permissive=1
[  587.184659][T13493] kAFS: unable to lookup cell 'syz1'
[  587.240224][ T5778] DVB: Unable to find symbol stv090x_attach()
[  587.263021][ T5778] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)'
[  587.302944][   T50] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  587.313637][T13504] syzkaller0: entered promiscuous mode
[  587.331615][   T50] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  587.345330][   T50] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  587.353174][   T50] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  587.360744][   T50] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  587.361332][T13504] syzkaller0: entered allmulticast mode
[  587.445719][T13508] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1475'.
[  587.499778][ T5778] rc_core: IR keymap rc-technisat-usb2 not found
[  587.519446][ T5778] Registered IR keymap rc-empty
[  587.551987][ T5778] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.6/usb7/7-1/rc/rc0
[  587.566867][ T7121] usb 3-1: new high-speed USB device number 16 using dummy_hcd
[  587.596126][ T5778] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.6/usb7/7-1/rc/rc0/input40
[  587.633149][ T5778] dvb-usb: schedule remote query interval to 100 msecs.
[  587.658472][ T5778] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected.
[  587.703977][ T5778] usb 7-1: USB disconnect, device number 46
[  587.739683][ T7121] usb 3-1: Using ep0 maxpacket: 8
[  587.772454][ T7121] usb 3-1: unable to get BOS descriptor or descriptor too short
[  587.799496][ T7121] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 16
[  587.830228][ T5778] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected.
[  587.852103][ T7121] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice= 0.40
[  587.877702][ T7121] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  587.905540][   T30] audit: type=1400 audit(1785316042.860:1308): avc:  denied  { write } for  pid=13497 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  587.908558][ T7121] usb 3-1: Product: syz
[  587.939554][T13529] SELinux: syz.3.1476 (13529) wrote to user. This is no longer supported.
[  587.974317][ T7121] usb 3-1: Manufacturer: syz
[  587.983147][T13532] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1476'.
[  587.984421][ T7121] usb 3-1: SerialNumber: syz
[  588.035635][T13507] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  588.082857][   T30] audit: type=1400 audit(1785316043.030:1309): avc:  denied  { write } for  pid=13533 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  588.263973][T13507] syz_tun: entered allmulticast mode
[  588.447457][ T7221] usb 7-1: new high-speed USB device number 47 using dummy_hcd
[  588.498497][ T5778] usb 4-1: new high-speed USB device number 12 using dummy_hcd
[  588.557301][   T30] audit: type=1400 audit(1785316043.510:1310): avc:  denied  { write } for  pid=13537 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  588.616849][ T7221] usb 7-1: Using ep0 maxpacket: 32
[  588.633089][ T7221] usb 7-1: config 7 has an invalid interface number: 94 but max is 3
[  588.644490][ T7221] usb 7-1: config 7 has an invalid interface number: 172 but max is 3
[  588.653625][ T7221] usb 7-1: config 7 has an invalid interface number: 10 but max is 3
[  588.661998][ T7221] usb 7-1: config 7 has an invalid interface number: 233 but max is 3
[  588.670977][ T7221] usb 7-1: config 7 contains an unexpected descriptor of type 0x1, skipping
[  588.679926][ T7221] usb 7-1: config 7 has an invalid interface number: 252 but max is 3
[  588.695692][ T5778] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[  588.703063][   T30] audit: type=1400 audit(1785316043.650:1311): avc:  denied  { write } for  pid=13551 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  588.705513][ T7221] usb 7-1: config 7 has 5 interfaces, different from the descriptor's value: 4
[  588.736512][ T5778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  588.745351][ T5778] usb 4-1: Product: syz
[  588.749985][ T5778] usb 4-1: Manufacturer: syz
[  588.758432][ T5778] usb 4-1: SerialNumber: syz
[  588.791216][ T7221] usb 7-1: config 7 has no interface number 0
[  588.830620][ T7221] usb 7-1: config 7 has no interface number 1
[  588.854216][ T7221] usb 7-1: config 7 has no interface number 2
[  588.872858][ T7221] usb 7-1: config 7 has no interface number 3
[  588.879836][ T7221] usb 7-1: config 7 has no interface number 4
[  588.905297][ T7221] usb 7-1: config 7 interface 172 altsetting 247 has an invalid descriptor for endpoint zero, skipping
[  588.921452][   T30] audit: type=1400 audit(1785316043.880:1312): avc:  denied  { firmware_load } for  pid=187 comm="kworker/0:2" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1
[  588.928602][ T7221] usb 7-1: config 7 interface 172 altsetting 247 has an invalid descriptor for endpoint zero, skipping
[  588.964221][ T7221] usb 7-1: config 7 interface 172 altsetting 247 endpoint 0x1 has invalid maxpacket 1024, setting to 64
[  588.984762][  T187] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[  589.009198][ T7221] usb 7-1: config 7 interface 172 altsetting 247 has an invalid descriptor for endpoint zero, skipping
[  589.046745][ T7221] usb 7-1: config 7 interface 10 altsetting 6 endpoint 0xA has invalid maxpacket 512, setting to 64
[  589.057780][ T5781] usb 5-1: new low-speed USB device number 12 using dummy_hcd
[  589.078862][ T7221] usb 7-1: config 7 interface 10 altsetting 6 has a duplicate endpoint with address 0xA, skipping
[  589.101839][ T7221] usb 7-1: config 7 interface 10 altsetting 6 has a duplicate endpoint with address 0x4, skipping
[  589.143172][ T7221] usb 7-1: config 7 interface 10 altsetting 6 has an endpoint descriptor with address 0x16, changing to 0x6
[  589.174500][ T7221] usb 7-1: config 7 interface 10 altsetting 6 endpoint 0x6 has invalid wMaxPacketSize 0
[  589.195662][T13505] bridge0: port 1(bridge_slave_0) entered blocking state
[  589.219970][T13505] bridge0: port 1(bridge_slave_0) entered disabled state
[  589.227992][ T7221] usb 7-1: config 7 interface 10 altsetting 6 endpoint 0x5 has invalid maxpacket 1023, setting to 64
[  589.242612][ T5781] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  589.261141][   T30] kauditd_printk_skb: 1 callbacks suppressed
[  589.261155][   T30] audit: type=1400 audit(1785316044.220:1314): avc:  denied  { write } for  pid=13573 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  589.265463][T13505] bridge_slave_0: entered allmulticast mode
[  589.300010][ T5781] usb 5-1: New USB device found, idVendor=1163, idProduct=0200, bcdDevice=e1.32
[  589.309591][ T7221] usb 7-1: config 7 interface 10 altsetting 6 endpoint 0x8 has invalid maxpacket 1024, setting to 64
[  589.322200][ T5781] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  589.331592][ T7221] usb 7-1: config 7 interface 10 altsetting 6 has a duplicate endpoint with address 0x6, skipping
[  589.343824][ T7221] usb 7-1: config 7 interface 10 altsetting 6 has a duplicate endpoint with address 0x6, skipping
[  589.355927][ T5781] usb 5-1: config 0 descriptor??
[  589.368551][T13505] bridge_slave_0: entered promiscuous mode
[  589.376036][ T7221] usb 7-1: config 7 interface 10 altsetting 6 has a duplicate endpoint with address 0x9, skipping
[  589.388365][T13505] bridge0: port 2(bridge_slave_1) entered blocking state
[  589.395497][T13505] bridge0: port 2(bridge_slave_1) entered disabled state
[  589.402972][ T7221] usb 7-1: config 7 interface 10 altsetting 6 has 13 endpoint descriptors, different from the interface descriptor's value: 12
[  589.417808][T13505] bridge_slave_1: entered allmulticast mode
[  589.424107][   T50] Bluetooth: hci6: command tx timeout
[  589.435256][T13505] bridge_slave_1: entered promiscuous mode
[  589.441774][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has a duplicate endpoint with address 0xF, skipping
[  589.466844][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has a duplicate endpoint with address 0x1, skipping
[  589.489570][T13505] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  589.514955][ T7967] usb 4-1: USB disconnect, device number 12
[  589.532736][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has a duplicate endpoint with address 0xB, skipping
[  589.556637][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has an invalid descriptor for endpoint zero, skipping
[  589.570727][T13505] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  589.581580][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has an invalid descriptor for endpoint zero, skipping
[  589.606674][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has an invalid descriptor for endpoint zero, skipping
[  589.630209][T13505] team0: Port device team_slave_0 added
[  589.636655][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has a duplicate endpoint with address 0xC, skipping
[  589.647789][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has a duplicate endpoint with address 0x5, skipping
[  589.666923][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has an endpoint descriptor with address 0xE4, changing to 0x84
[  589.696207][ T7221] usb 7-1: config 7 interface 233 altsetting 192 endpoint 0x84 has invalid maxpacket 47778, setting to 1024
[  589.710019][T13505] team0: Port device team_slave_1 added
[  589.730099][ T7221] usb 7-1: config 7 interface 233 altsetting 192 bulk endpoint 0x84 has invalid maxpacket 1024
[  589.732607][T13557] mac80211_hwsim hwsim35 wlan0: entered promiscuous mode
[  589.743946][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has a duplicate endpoint with address 0x9, skipping
[  589.758887][T13557] mac80211_hwsim hwsim35 wlan0: entered allmulticast mode
[  589.784713][ T5781] usb 5-1: string descriptor 0 read error: -71
[  589.800300][ T5781] cypress_m8 5-1:0.0: DeLorme Earthmate USB converter detected
[  589.809344][ T5781] earthmate ttyUSB0: required endpoint is missing
[  589.818167][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has an invalid descriptor for endpoint zero, skipping
[  589.832536][T13505] batman_adv: batadv0: Adding interface: batadv_slave_0
[  589.839144][ T5781] usb 5-1: USB disconnect, device number 12
[  589.851474][T13505] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  589.856641][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has a duplicate endpoint with address 0x5, skipping
[  589.882468][T13505] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  589.891983][ T5781] cypress_m8 5-1:0.0: device disconnected
[  589.906431][T13505] batman_adv: batadv0: Adding interface: batadv_slave_1
[  589.914517][T13505] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  589.927430][ T7221] usb 7-1: config 7 interface 233 altsetting 192 has 13 endpoint descriptors, different from the interface descriptor's value: 14
[  589.961491][ T7221] usb 7-1: too many endpoints for config 7 interface 252 altsetting 237: 131, using maximum allowed: 30
[  589.964849][   T30] audit: type=1400 audit(1785316044.920:1315): avc:  denied  { write } for  pid=13575 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  589.978729][ T7221] usb 7-1: config 7 interface 252 altsetting 237 has a duplicate endpoint with address 0x1, skipping
[  590.004646][T13505] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  590.027147][ T7221] usb 7-1: config 7 interface 252 altsetting 237 has a duplicate endpoint with address 0x5, skipping
[  590.049207][ T7221] usb 7-1: config 7 interface 252 altsetting 237 has 2 endpoint descriptors, different from the interface descriptor's value: 131
[  590.054458][T13505] hsr_slave_0: entered promiscuous mode
[  590.062950][  T187] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive
[  590.063163][  T187] ath9k_htc: Failed to initialize the device
[  590.071431][T13505] hsr_slave_1: entered promiscuous mode
[  590.082704][ T7221] usb 7-1: config 7 interface 94 has no altsetting 0
[  590.095259][T13505] debugfs: 'hsr0' already exists in 'hsr'
[  590.101968][ T7967] usb 4-1: ath9k_htc: USB layer deinitialized
[  590.117319][T13505] Cannot create hsr debugfs directory
[  590.142447][ T7221] usb 7-1: config 7 interface 172 has no altsetting 0
[  590.170421][ T7221] usb 7-1: config 7 interface 10 has no altsetting 0
[  590.177789][ T7221] usb 7-1: config 7 interface 233 has no altsetting 0
[  590.184639][ T7221] usb 7-1: config 7 interface 252 has no altsetting 0
[  590.200202][   T30] audit: type=1400 audit(1785316045.160:1316): avc:  denied  { write } for  pid=13587 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  590.202147][ T7121] usb 3-1: Quirk or no altset; falling back to MIDI 1.0
[  590.261514][ T7221] usb 7-1: New USB device found, idVendor=413c, idProduct=81d2, bcdDevice=fa.0c
[  590.271716][ T7221] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  590.280817][ T7121] usb 3-1: invalid MIDI in EP 0
[  590.285756][ T7221] usb 7-1: Product: 柗消�࠷剅〶⪯㷼ㄞ㽬稫ౡ︿�ꉇⴉ팾뚋館裪ᖘ掂껉︩�눑抨ゔ廚ಮ쀊仚橗∑�꼯䕄蘛㈘駮⊇ﳰѿ纨﹇苔ꥎᔎ�躬祛똰噻㠵댞쓞豣�浗귱擱�啩㡡⚳㉷掠⼄媄�꣜�곌处呣븲ᖳᾊ�㙜险㑌岓曃虩迎᪬燦㠩䟷�鱸愮䅺䤡ꥯ햋✫慻�囬
[  590.327593][ T7221] usb 7-1: Manufacturer: ሮ
[  590.336496][ T7221] usb 7-1: SerialNumber: syz
[  590.432347][ T7121] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22
[  590.472567][ T7121] usb 3-1: USB disconnect, device number 16
[  591.181599][ T5842] udevd[5842]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  591.227852][ T7221] usb 7-1: USB disconnect, device number 47
[  591.374422][T13603] kAFS: unable to lookup cell 'ÿ'
[  591.496808][   T50] Bluetooth: hci6: command tx timeout
[  592.710868][   T30] audit: type=1400 audit(1785316047.660:1317): avc:  denied  { write } for  pid=13595 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  592.747528][T13628] netlink: 'syz.2.1481': attribute type 10 has an invalid length.
[  592.764751][T13630] syzkaller0: entered promiscuous mode
[  592.910053][T13630] syzkaller0: entered allmulticast mode
[  593.197369][   T30] audit: type=1400 audit(1785316048.030:1318): avc:  denied  { write } for  pid=13642 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  593.228683][T13634] netlink: 116 bytes leftover after parsing attributes in process `syz.6.1487'.
[  593.295829][T13646] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1489'.
[  593.363668][T13628] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  593.446827][T13628] team0: Port device netdevsim1 added
[  593.578606][   T50] Bluetooth: hci6: command tx timeout
[  593.815337][   T30] audit: type=1400 audit(1785316048.770:1319): avc:  denied  { write } for  pid=13644 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  593.997336][T13661] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  594.067446][   T30] audit: type=1400 audit(1785316049.020:1320): avc:  denied  { write } for  pid=13659 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  594.603206][T13505] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  594.638306][T13505] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  594.661063][T13505] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  594.701643][T13505] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  594.708990][ T5781] usb 3-1: new high-speed USB device number 17 using dummy_hcd
[  594.738540][T13505] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  594.803078][T13505] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  594.817485][T13505] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  594.833944][   T30] audit: type=1400 audit(1785316049.790:1321): avc:  denied  { write } for  pid=13666 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  594.860134][T13505] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  594.886876][ T5781] usb 3-1: Using ep0 maxpacket: 8
[  594.900998][ T5781] usb 3-1: unable to get BOS descriptor or descriptor too short
[  594.916174][ T5781] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 16
[  594.937195][ T5781] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice= 0.40
[  594.952375][ T5781] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  594.975915][ T5781] usb 3-1: Product: syz
[  594.988480][ T5781] usb 3-1: Manufacturer: syz
[  595.005953][ T5781] usb 3-1: SerialNumber: syz
[  595.036247][T13668] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  595.053971][   T30] audit: type=1400 audit(1785316050.010:1322): avc:  denied  { write } for  pid=13691 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  595.085302][T13505] 8021q: adding VLAN 0 to HW filter on device bond0
[  595.113410][T13505] 8021q: adding VLAN 0 to HW filter on device team0
[  595.117691][  T804] usb 5-1: new high-speed USB device number 13 using dummy_hcd
[  595.132579][ T6781] bridge0: port 1(bridge_slave_0) entered blocking state
[  595.139767][ T6781] bridge0: port 1(bridge_slave_0) entered forwarding state
[  595.168754][ T6781] bridge0: port 2(bridge_slave_1) entered blocking state
[  595.175899][ T6781] bridge0: port 2(bridge_slave_1) entered forwarding state
[  595.308169][  T804] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  595.344778][  T804] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  595.381382][  T804] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80
[  595.422598][  T804] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  595.474181][  T804] usb 5-1: config 0 descriptor??
[  595.657087][   T50] Bluetooth: hci6: command tx timeout
[  595.796546][   T30] audit: type=1400 audit(1785316050.750:1323): avc:  denied  { write } for  pid=13693 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  595.914461][   T30] audit: type=1400 audit(1785316050.870:1324): avc:  denied  { write } for  pid=13714 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  595.942803][  T804] cp2112 0003:10C4:EA90.000B: unknown global tag 0xd
[  595.959831][T13505] 8021q: adding VLAN 0 to HW filter on device batadv0
[  595.965007][  T804] cp2112 0003:10C4:EA90.000B: item 0 0 1 13 parsing failed
[  595.975874][  T804] cp2112 0003:10C4:EA90.000B: parse failed
[  595.984526][  T804] cp2112 0003:10C4:EA90.000B: probe with driver cp2112 failed with error -22
[  596.037047][   T30] audit: type=1400 audit(1785316051.000:1325): avc:  denied  { create } for  pid=13715 comm="syz.6.1495" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1
[  596.091635][T13505] veth0_vlan: entered promiscuous mode
[  596.115584][T13505] veth1_vlan: entered promiscuous mode
[  596.486481][ T7221] usb 5-1: USB disconnect, device number 13
[  596.533617][T13505] veth0_macvtap: entered promiscuous mode
[  596.563323][T13505] veth1_macvtap: entered promiscuous mode
[  596.600586][T13505] batman_adv: batadv0: Interface activated: batadv_slave_0
[  596.619836][T13505] batman_adv: batadv0: Interface activated: batadv_slave_1
[  596.642813][ T1007] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  596.671658][ T1007] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  596.684694][   T30] audit: type=1400 audit(1785316051.640:1326): avc:  denied  { write } for  pid=13720 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  596.706699][ T1007] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  596.733818][ T1007] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  596.842968][   T30] audit: type=1400 audit(1785316051.800:1327): avc:  denied  { write } for  pid=13733 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  596.867166][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  596.881439][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  596.929665][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  596.941530][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  597.292081][T13746] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1468'.
[  597.569531][ T5781] usb 3-1: Quirk or no altset; falling back to MIDI 1.0
[  597.602515][ T5781] usb 3-1: invalid MIDI in EP 0
[  598.043973][T13755] syzkaller0: entered promiscuous mode
[  598.061641][T13754] mmap: syz.2.1499 (13754): VmData 37593088 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data.
[  598.074293][T13755] syzkaller0: entered allmulticast mode
[  598.118650][T13755] netlink: 116 bytes leftover after parsing attributes in process `syz.4.1500'.
[  598.148767][ T5781] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22
[  598.173759][   T30] audit: type=1400 audit(1785316053.130:1328): avc:  denied  { write } for  pid=13735 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  598.198801][ T5781] usb 3-1: USB disconnect, device number 17
[  598.277676][ T5842] udevd[5842]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  598.402487][   T30] audit: type=1400 audit(1785316053.360:1329): avc:  denied  { write } for  pid=13770 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  598.606631][ T7221] usb 2-1: new high-speed USB device number 71 using dummy_hcd
[  598.687265][T13781] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  598.777200][   T29] usb 7-1: new high-speed USB device number 48 using dummy_hcd
[  598.796880][ T7221] usb 2-1: config 0 has an invalid interface number: 50 but max is 0
[  598.823809][ T7221] usb 2-1: config 0 has no interface number 0
[  598.846022][ T7221] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  598.865561][ T7221] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  598.891783][ T7221] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc
[  598.910475][ T7221] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  598.936911][   T29] usb 7-1: Using ep0 maxpacket: 32
[  598.940753][ T7221] usb 2-1: Product: syz
[  598.946317][ T7221] usb 2-1: Manufacturer: syz
[  598.956477][ T7221] usb 2-1: SerialNumber: syz
[  598.973772][ T7221] usb 2-1: config 0 descriptor??
[  598.977969][   T29] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0
[  599.002776][   T29] usb 7-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0
[  599.012278][ T7221] yurex 2-1:0.50: Could not submitting URB
[  599.037203][ T7221] yurex 2-1:0.50: probe with driver yurex failed with error -5
[  599.039040][   T29] usb 7-1: config 0 interface 0 has no altsetting 0
[  599.080937][   T29] usb 7-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e
[  599.090952][   T29] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  599.112495][   T29] usb 7-1: Product: syz
[  599.117113][   T29] usb 7-1: Manufacturer: syz
[  599.121805][   T29] usb 7-1: SerialNumber: syz
[  599.129568][   T30] audit: type=1400 audit(1785316054.090:1330): avc:  denied  { write } for  pid=13775 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  599.160025][   T29] usb 7-1: config 0 descriptor??
[  599.592429][   T29] gs_usb 7-1:0.0: Configuring for 1 interfaces
[  599.806715][ T7221] usb 3-1: new high-speed USB device number 18 using dummy_hcd
[  599.996631][ T7221] usb 3-1: Using ep0 maxpacket: 8
[  600.011497][ T7221] usb 3-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77
[  600.029309][ T7221] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239
[  600.042429][ T7221] usb 3-1: Product: syz
[  600.051264][ T7221] usb 3-1: Manufacturer: syz
[  600.061453][ T7221] usb 3-1: SerialNumber: syz
[  600.077822][ T7221] usb 3-1: config 0 descriptor??
[  600.096100][ T7221] gspca_main: sq905-2.14.0 probing 2770:9120
[  600.300945][T13824] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1504'.
[  600.795701][   T30] kauditd_printk_skb: 3 callbacks suppressed
[  600.795716][   T30] audit: type=1400 audit(1785316055.750:1334): avc:  denied  { write } for  pid=13827 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  600.943781][   T30] audit: type=1400 audit(1785316055.900:1335): avc:  denied  { write } for  pid=13838 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  601.151034][   T30] audit: type=1400 audit(1785316056.110:1336): avc:  denied  { write } for  pid=13842 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  601.234087][   T30] audit: type=1400 audit(1785316056.190:1337): avc:  denied  { write } for  pid=13855 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  601.256895][   T29] usb 5-1: new high-speed USB device number 14 using dummy_hcd
[  601.270998][ T7221] gspca_sq905: sq905_read_data: usb_control_msg failed (-71)
[  601.281216][ T7221] sq905 3-1:0.0: probe with driver sq905 failed with error -71
[  601.307537][ T7221] usb 3-1: USB disconnect, device number 18
[  601.335918][  T804] usb 2-1: USB disconnect, device number 71
[  601.427245][   T29] usb 5-1: Using ep0 maxpacket: 8
[  601.444685][   T29] usb 5-1: unable to get BOS descriptor or descriptor too short
[  601.522893][   T29] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 16
[  601.606673][   T29] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice= 0.40
[  601.693609][   T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  601.748602][   T29] usb 5-1: Product: syz
[  601.753109][   T29] usb 5-1: Manufacturer: syz
[  601.760414][   T29] usb 5-1: SerialNumber: syz
[  601.798170][T13844] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22
[  601.889376][T13868] binder: BINDER_SET_CONTEXT_MGR already set
[  601.896058][T13868] binder: 13866:13868 ioctl 4018620d 200000004a80 returned -16
[  602.019580][T13844] syz_tun: entered allmulticast mode
[  602.078957][   T30] audit: type=1400 audit(1785316057.040:1338): avc:  denied  { write } for  pid=13873 comm="syz.6.1514" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1
[  602.205060][T13878] syzkaller0: entered promiscuous mode
[  602.215358][T13878] syzkaller0: entered allmulticast mode
[  602.234385][T13878] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1515'.
[  602.248608][   T30] audit: type=1400 audit(1785316057.200:1339): avc:  denied  { write } for  pid=13859 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  602.269660][T13885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  602.291609][T13885] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  602.377280][ T5781] usb 2-1: new high-speed USB device number 72 using dummy_hcd
[  602.387976][   T30] audit: type=1400 audit(1785316057.350:1340): avc:  denied  { write } for  pid=13887 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  602.548130][ T5781] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[  602.565852][ T5781] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 12683, setting to 1024
[  602.581853][ T5781] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024
[  602.611564][ T5781] usb 2-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00
[  602.628618][ T5781] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  602.644845][ T5781] usb 2-1: Product: syz
[  602.658090][ T5781] usb 2-1: Manufacturer: syz
[  602.676952][T13874] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  602.684357][T13874] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  602.700947][ T5781] usb_debug 2-1:1.0: debug converter detected
[  602.711093][ T5781] usb 2-1: debug converter now attached to ttyUSB0
[  602.776936][ T5716] usb 3-1: new high-speed USB device number 19 using dummy_hcd
[  602.940591][    C0] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71
[  602.943337][ T5716] usb 3-1: config 0 has an invalid interface number: 117 but max is 0
[  602.953978][ T5781] usb 2-1: USB disconnect, device number 72
[  602.962024][ T5716] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  602.982497][ T5781] debug ttyUSB0: debug converter now disconnected from ttyUSB0
[  602.994893][ T5781] usb_debug 2-1:1.0: device disconnected
[  602.998273][ T5716] usb 3-1: config 0 has no interface number 0
[  603.007832][ T5716] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7
[  603.023695][ T5716] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0
[  603.039126][ T5716] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  603.061247][ T5716] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0
[  603.073488][ T5716] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  603.082546][ T5716] usb 3-1: Product: syz
[  603.088705][ T5716] usb 3-1: Manufacturer: syz
[  603.093378][ T5716] usb 3-1: SerialNumber: syz
[  603.124950][ T5716] usb 3-1: config 0 descriptor??
[  603.495890][T13902] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  603.856665][ T5716] usb 2-1: new high-speed USB device number 73 using dummy_hcd
[  604.019176][ T5716] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  604.036695][ T5716] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  604.048290][ T5716] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121
[  604.061722][ T5716] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  604.073263][ T5716] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  604.083294][ T5716] usb 2-1: Product: syz
[  604.087564][ T5716] usb 2-1: Manufacturer: syz
[  604.093121][ T5716] usb 2-1: SerialNumber: syz
[  604.102000][ T5716] usb 2-1: config 0 descriptor??
[  604.108254][T13904] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  604.115502][T13904] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  604.125038][ T5716] usb 2-1: ucan: probing device on interface #0
[  604.326730][ T5716] usb 2-1: ucan: device protocol version 0 is not supported
[  604.334227][ T5716] usb 2-1: ucan: probe failed; try to update the device firmware
[  604.559092][ T5716] usb 2-1: USB disconnect, device number 73
[  606.863055][   T29] usb 5-1: Quirk or no altset; falling back to MIDI 1.0
[  606.870843][   T29] usb 5-1: invalid MIDI in EP 0
[  606.907734][   T29] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22
[  606.952488][ T5899] udevd[5899]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  607.751397][   T29] usb 5-1: USB disconnect, device number 14
[  608.797128][T13943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  608.817063][   T29] usb 2-1: new high-speed USB device number 74 using dummy_hcd
[  608.819846][T13943] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  608.856472][ T5612] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1
[  608.872474][ T5612] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9
[  608.899131][ T5612] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9
[  608.916983][ T5612] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4
[  608.929491][ T5612] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2
[  609.044022][   T29] usb 2-1: unable to get BOS descriptor or descriptor too short
[  609.064904][   T29] usb 2-1: config 5 has an invalid interface number: 88 but max is 0
[  609.102712][   T29] usb 2-1: config 5 has no interface number 0
[  609.124994][   T29] usb 2-1: config 5 interface 88 has no altsetting 0
[  609.154999][   T29] usb 2-1: New USB device found, idVendor=0867, idProduct=9812, bcdDevice=b0.82
[  609.159245][   T30] audit: type=1400 audit(1785316064.110:1341): avc:  denied  { write } for  pid=13932 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  609.193635][   T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  609.221599][   T29] usb 2-1: Product: syz
[  609.234721][   T29] usb 2-1: Manufacturer: syz
[  609.255413][   T29] usb 2-1: SerialNumber: syz
[  609.277332][  T804] usb 5-1: new high-speed USB device number 15 using dummy_hcd
[  609.390474][   T30] audit: type=1400 audit(1785316064.350:1342): avc:  denied  { write } for  pid=13959 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  609.438911][  T804] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[  609.467284][  T804] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 12683, setting to 1024
[  609.497732][  T804] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024
[  609.502649][ T5272] gs_usb 7-1:0.0 can0: bit-timing not yet defined
[  609.535328][  T804] usb 5-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00
[  609.568385][  T804] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  609.574851][  T187] usb 3-1: USB disconnect, device number 19
[  609.598125][  T804] usb 5-1: Product: syz
[  609.612845][  T804] usb 5-1: Manufacturer: syz
[  609.644576][T13949] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22
[  609.652181][T13949] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22
[  609.664672][  T804] usb_debug 5-1:1.0: debug converter detected
[  609.759021][  T804] usb 5-1: debug converter now attached to ttyUSB0
[  611.017460][ T5612] Bluetooth: hci9: command tx timeout
[  611.225495][T13974] overlayfs: overlapping lowerdir path
[  611.465119][    C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71
[  611.581391][  T187] usb 5-1: USB disconnect, device number 15
[  611.654794][   T29] comedi comedi5: Wrong number of endpoints
[  611.688775][   T29] dt9812 2-1:5.88: driver 'dt9812' failed to auto-configure device.
[  611.732799][  T187] debug ttyUSB0: debug converter now disconnected from ttyUSB0
[  611.733912][   T29] usb 2-1: USB disconnect, device number 74
[  611.777929][  T187] usb_debug 5-1:1.0: device disconnected
[  613.098552][ T5612] Bluetooth: hci9: command tx timeout
[  613.146789][ T5709] usb 5-1: new high-speed USB device number 16 using dummy_hcd
[  613.315192][   T30] audit: type=1400 audit(1785316068.270:1343): avc:  denied  { create } for  pid=14000 comm="syz.6.1538" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1
[  613.374735][ T5709] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  613.447307][ T5709] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  613.468147][   T30] audit: type=1400 audit(1785316068.280:1344): avc:  denied  { bind } for  pid=14000 comm="syz.6.1538" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1
[  613.474313][ T5709] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121
[  613.488230][   T30] audit: type=1400 audit(1785316068.280:1345): avc:  denied  { write } for  pid=14000 comm="syz.6.1538" name="usbmon8" dev="devtmpfs" ino=744 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1
[  613.589972][ T5709] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  613.604444][ T5709] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  613.614611][ T5709] usb 5-1: Product: syz
[  613.642473][  T187] usb 2-1: new high-speed USB device number 75 using dummy_hcd
[  613.644253][T14005] macsec0: entered promiscuous mode
[  613.656911][ T5709] usb 5-1: Manufacturer: syz
[  613.669926][ T5709] usb 5-1: SerialNumber: syz
[  613.674777][T14005] macsec0: entered allmulticast mode
[  613.718316][T14007] veth1_macvtap: entered allmulticast mode
[  613.745588][ T5709] usb 5-1: config 0 descriptor??
[  613.763643][T13985] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  613.788317][T13985] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  613.819507][T14007] macsec0: left promiscuous mode
[  613.831793][ T5709] usb 5-1: ucan: probing device on interface #0
[  613.854301][  T187] usb 2-1: config 0 has an invalid interface number: 117 but max is 0
[  613.858078][T14007] macsec0: left allmulticast mode
[  613.876776][  T187] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  613.886907][T14007] veth1_macvtap: left allmulticast mode
[  613.901952][  T187] usb 2-1: config 0 has no interface number 0
[  613.909102][  T187] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7
[  613.920442][  T187] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0
[  613.931013][  T187] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  613.947572][  T187] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0
[  613.957158][  T187] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  613.965214][  T187] usb 2-1: Product: syz
[  613.969734][  T187] usb 2-1: Manufacturer: syz
[  613.974371][  T187] usb 2-1: SerialNumber: syz
[  613.985443][  T187] usb 2-1: config 0 descriptor??
[  614.011396][ T5709] usb 5-1: ucan: device protocol version 0 is not supported
[  614.042563][ T5709] usb 5-1: ucan: probe failed; try to update the device firmware
[  614.057839][T13944] bridge0: port 1(bridge_slave_0) entered blocking state
[  614.065256][T13944] bridge0: port 1(bridge_slave_0) entered disabled state
[  614.072646][T13944] bridge_slave_0: entered allmulticast mode
[  614.081404][T13944] bridge_slave_0: entered promiscuous mode
[  614.091392][T13944] bridge0: port 2(bridge_slave_1) entered blocking state
[  614.098735][T13944] bridge0: port 2(bridge_slave_1) entered disabled state
[  614.106244][T13944] bridge_slave_1: entered allmulticast mode
[  614.115345][T13944] bridge_slave_1: entered promiscuous mode
[  614.169309][T13944] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  614.191246][T13944] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  614.223228][ T5781] usb 5-1: USB disconnect, device number 16
[  614.367147][T13944] team0: Port device team_slave_0 added
[  614.375477][T13944] team0: Port device team_slave_1 added
[  614.823412][T13944] batman_adv: batadv0: Adding interface: batadv_slave_0
[  614.830450][T13944] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  614.892520][T13944] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  614.911058][T13944] batman_adv: batadv0: Adding interface: batadv_slave_1
[  614.920207][T13944] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  614.963379][T13944] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  615.176787][ T5612] Bluetooth: hci9: command tx timeout
[  615.286889][   T29] usb 3-1: new high-speed USB device number 20 using dummy_hcd
[  615.331150][T14026] bridge0: port 2(bridge_slave_1) entered disabled state
[  615.338484][T14026] bridge0: port 1(bridge_slave_0) entered disabled state
[  615.393501][T14026] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  615.405529][T14026] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  615.450498][   T29] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[  615.463197][   T29] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 12683, setting to 1024
[  615.476135][   T29] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024
[  615.489350][   T29] usb 3-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00
[  615.499299][   T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  615.508508][   T29] usb 3-1: Product: syz
[  615.512958][   T29] usb 3-1: Manufacturer: syz
[  615.519978][T14024] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  615.530625][T14024] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  615.539844][   T29] usb_debug 3-1:1.0: debug converter detected
[  615.549165][   T29] usb 3-1: debug converter now attached to ttyUSB0
[  615.620340][T13944] hsr_slave_0: entered promiscuous mode
[  615.628205][T13944] hsr_slave_1: entered promiscuous mode
[  615.646738][T13944] debugfs: 'hsr0' already exists in 'hsr'
[  615.656511][T13944] Cannot create hsr debugfs directory
[  615.680005][   T13] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  615.716845][   T13] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  615.725994][ T5709] usb 2-1: USB disconnect, device number 75
[  615.739942][   T13] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  615.767616][T14033] netlink: 'syz.4.1545': attribute type 13 has an invalid length.
[  615.776370][   T13] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  615.782566][    C1] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71
[  615.803759][ T5716] usb 3-1: USB disconnect, device number 20
[  615.813571][ T5716] debug ttyUSB0: debug converter now disconnected from ttyUSB0
[  615.830548][ T5716] usb_debug 3-1:1.0: device disconnected
[  616.319647][   T30] audit: type=1400 audit(1785316071.270:1346): avc:  denied  { write } for  pid=14036 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  616.474350][T14050] binder: BINDER_SET_CONTEXT_MGR already set
[  616.495902][T14050] binder: 14049:14050 ioctl 4018620d 200000004a80 returned -16
[  617.250421][   T30] audit: type=1400 audit(1785316071.770:1347): avc:  denied  { mmap_zero } for  pid=14053 comm="syz.1.1548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1
[  617.426856][ T5612] Bluetooth: hci9: command tx timeout
[  617.702425][   T30] audit: type=1400 audit(1785316072.660:1348): avc:  denied  { write } for  pid=14051 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  617.762329][T14061] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (pcl818)
[  617.861970][T14061] loop6: detected capacity change from 0 to 2640
[  617.869077][T14068] FAULT_INJECTION: forcing a failure.
[  617.869077][T14068] name failslab, interval 1, probability 0, space 0, times 0
[  617.944895][ T5616] buffer_io_error: 6 callbacks suppressed
[  617.944910][ T5616] Buffer I/O error on dev loop6, logical block 0, async page read
[  617.948388][T14064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  617.954170][T14068] CPU: 0 UID: 0 PID: 14068 Comm: syz.2.1552 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  617.954196][T14068] Tainted: [L]=SOFTLOCKUP
[  617.954201][T14068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  617.954210][T14068] Call Trace:
[  617.954216][T14068]  <TASK>
[  617.954222][T14068]  dump_stack_lvl+0x100/0x190
[  617.954247][T14068]  should_fail_ex.cold+0x5/0xa
[  617.954268][T14068]  should_failslab+0xc2/0x120
[  617.954289][T14068]  __kmalloc_noprof+0xfc/0x820
[  617.954308][T14068]  ? do_sys_poll+0x273/0xe90
[  617.954328][T14068]  do_sys_poll+0x273/0xe90
[  617.954343][T14068]  ? bpf_ksym_find+0x128/0x1c0
[  617.954367][T14068]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  617.954385][T14068]  ? is_bpf_text_address+0x94/0x1a0
[  617.954409][T14068]  ? __pfx_do_sys_poll+0x10/0x10
[  617.954424][T14068]  ? arch_stack_walk+0xa6/0xf0
[  617.954509][T14068]  ? __mutex_unlock_slowpath+0x35d/0x930
[  617.954527][T14068]  ? set_user_sigmask+0x1e1/0x270
[  617.954546][T14068]  ? __pfx_set_user_sigmask+0x10/0x10
[  617.954565][T14068]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  617.954588][T14068]  __x64_sys_ppoll+0x2b5/0x350
[  617.954607][T14068]  ? __pfx___x64_sys_ppoll+0x10/0x10
[  617.954622][T14068]  ? ksys_write+0x1ac/0x250
[  617.954645][T14068]  ? __pfx_ksys_write+0x10/0x10
[  617.954675][T14068]  do_syscall_64+0x115/0x870
[  617.954692][T14068]  ? clear_bhb_loop+0x40/0x90
[  617.954712][T14068]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  617.954728][T14068] RIP: 0033:0x7f008ab9de99
[  617.954742][T14068] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  617.954757][T14068] RSP: 002b:00007f008ba90028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f
[  617.954773][T14068] RAX: ffffffffffffffda RBX: 00007f008ae25fa0 RCX: 00007f008ab9de99
[  617.954783][T14068] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0
[  617.954793][T14068] RBP: 00007f008ba90090 R08: 0000000000000000 R09: 0000000000000000
[  617.954803][T14068] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  617.954812][T14068] R13: 00007f008ae26038 R14: 00007f008ae25fa0 R15: 00007ffc7bab6438
[  617.954833][T14068]  </TASK>
[  617.966295][ T5616] Buffer I/O error on dev loop6, logical block 0, async page read
[  618.141633][T14064] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  618.156973][ T5616] Buffer I/O error on dev loop6, logical block 0, async page read
[  618.261225][ T5616] Buffer I/O error on dev loop6, logical block 0, async page read
[  618.270210][ T5616] Buffer I/O error on dev loop6, logical block 0, async page read
[  618.418864][T14078] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1554'.
[  618.524304][T14064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  618.614911][ T5716] usb 5-1: new high-speed USB device number 17 using dummy_hcd
[  618.691193][T14064] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  618.782649][ T5716] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  618.800292][ T5716] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  619.392432][ T5716] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121
[  619.422422][   T30] audit: type=1400 audit(1785316074.380:1349): avc:  denied  { write } for  pid=14072 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  619.424084][ T5716] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  619.506815][ T5716] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  619.568990][ T5716] usb 5-1: Product: syz
[  619.612387][ T5716] usb 5-1: Manufacturer: syz
[  619.650381][ T5716] usb 5-1: SerialNumber: syz
[  619.801234][ T5716] usb 5-1: config 0 descriptor??
[  619.811924][T14076] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  619.813616][T14090] syz_tun: refused to change device tx_queue_len
[  619.819764][T14076] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  619.844021][ T5716] usb 5-1: ucan: probing device on interface #0
[  619.889989][   T30] audit: type=1400 audit(1785316074.850:1350): avc:  denied  { write } for  pid=14102 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  619.900867][T13944] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  619.980143][T13944] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  619.988623][T13944] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  620.001544][T13944] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  620.009442][T14104] tipc: Started in network mode
[  620.035412][T14104] tipc: Node identity 42fcf1d05081, cluster identity 4711
[  620.051355][ T5716] usb 5-1: ucan: device protocol version 0 is not supported
[  620.057550][T14104] tipc: Enabled bearer <eth:xfrm0>, priority 12
[  620.069300][ T5716] usb 5-1: ucan: probe failed; try to update the device firmware
[  620.090599][T13944] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  620.124172][T13944] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  620.147752][T13944] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  620.165192][T13944] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  620.546295][ T7967] usb 5-1: USB disconnect, device number 17
[  620.585061][T14124] tipc: Failed to remove unknown binding: 66,0,0/0:1920390591/1920390593
[  620.612789][T14124] tipc: Failed to remove unknown binding: 66,0,0/0:1920390591/1920390592
[  620.691654][T14124] tipc: Failed to remove unknown binding: 66,0,0/0:1920390591/1920390593
[  620.718962][T13944] 8021q: adding VLAN 0 to HW filter on device bond0
[  620.728730][T14124] tipc: Failed to remove unknown binding: 66,0,0/0:1920390591/1920390592
[  620.738869][T14130] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  620.765075][T14130] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  620.781354][T13944] 8021q: adding VLAN 0 to HW filter on device team0
[  620.819991][   T48] bridge0: port 1(bridge_slave_0) entered blocking state
[  620.827162][   T48] bridge0: port 1(bridge_slave_0) entered forwarding state
[  620.867733][   T48] bridge0: port 2(bridge_slave_1) entered blocking state
[  620.874889][   T48] bridge0: port 2(bridge_slave_1) entered forwarding state
[  621.060926][ T5781] tipc: Node number set to 310243792
[  621.137314][ T5709] usb 2-1: new high-speed USB device number 76 using dummy_hcd
[  621.146900][   T30] audit: type=1400 audit(1785316076.020:1351): avc:  denied  { write } for  pid=14108 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  621.336755][ T5709] usb 2-1: Using ep0 maxpacket: 8
[  621.436798][ T5709] usb 2-1: unable to get BOS descriptor or descriptor too short
[  621.452194][ T5709] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 16
[  621.488545][ T5709] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice= 0.40
[  621.505548][ T5709] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  621.522482][T14150] ªªªªªª: renamed from vlan0
[  621.533207][ T5709] usb 2-1: Product: syz
[  621.545291][ T5709] usb 2-1: Manufacturer: syz
[  621.563100][ T5709] usb 2-1: SerialNumber: syz
[  621.594086][   T30] audit: type=1400 audit(1785316076.550:1352): avc:  denied  { write } for  pid=14148 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  621.629637][T14134] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[  622.175952][   T30] audit: type=1326 audit(1785316077.120:1353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14160 comm="syz.4.1568" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc35fb9de99 code=0x0
[  622.199284][T14134] syz_tun: entered allmulticast mode
[  622.671340][T14175] tipc: Started in network mode
[  622.680711][T14175] tipc: Node identity 8aa49afe1c3, cluster identity 4711
[  622.705817][T14175] tipc: Enabled bearer <eth:xfrm0>, priority 12
[  622.897577][T13944] 8021q: adding VLAN 0 to HW filter on device batadv0
[  622.901410][T14187] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  623.079571][   T30] audit: type=1400 audit(1785316078.040:1354): avc:  denied  { write } for  pid=14157 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  623.266644][  T187] usb 5-1: new high-speed USB device number 18 using dummy_hcd
[  623.341703][   T30] audit: type=1400 audit(1785316078.300:1355): avc:  denied  { write } for  pid=14197 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  623.477941][  T187] usb 5-1: config 0 has an invalid interface number: 117 but max is 0
[  623.489141][  T187] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  623.504527][  T187] usb 5-1: config 0 has no interface number 0
[  623.511194][  T187] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7
[  623.536173][  T187] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0
[  623.553886][  T187] usb 5-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  623.590737][  T187] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0
[  623.603304][  T187] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  623.663832][T13944] veth0_vlan: entered promiscuous mode
[  623.713497][  T187] usb 5-1: Product: syz
[  623.721501][T13944] veth1_vlan: entered promiscuous mode
[  623.744616][  T187] usb 5-1: Manufacturer: syz
[  623.777622][  T187] usb 5-1: SerialNumber: syz
[  623.819310][  T187] usb 5-1: config 0 descriptor??
[  623.837835][ T5716] tipc: Node number set to 2526321406
[  623.935217][T14210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  623.975764][ T5709] usb 2-1: Quirk or no altset; falling back to MIDI 1.0
[  623.984367][T14210] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  624.002412][ T1312] ieee802154 phy0 wpan0: encryption failed: -22
[  624.010515][ T1312] ieee802154 phy1 wpan1: encryption failed: -22
[  624.039849][ T5709] usb 2-1: invalid MIDI in EP 0
[  624.057364][T13944] veth0_macvtap: entered promiscuous mode
[  624.129416][T13944] veth1_macvtap: entered promiscuous mode
[  624.177665][   T30] audit: type=1400 audit(1785316079.140:1356): avc:  denied  { write } for  pid=14202 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  624.375756][   T30] audit: type=1400 audit(1785316079.330:1357): avc:  denied  { write } for  pid=14219 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  624.427702][T13944] batman_adv: batadv0: Interface activated: batadv_slave_0
[  624.496160][   T29] usb 5-1: USB disconnect, device number 18
[  624.972675][T13944] batman_adv: batadv0: Interface activated: batadv_slave_1
[  625.082661][   T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  625.118693][   T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  625.252448][   T36] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  625.290110][   T36] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  625.318283][ T5709] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22
[  625.364083][   T36] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  625.395093][   T36] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  625.398764][ T5709] usb 2-1: USB disconnect, device number 76
[  625.404014][  T173] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  625.451064][  T173] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  625.521822][ T5899] udevd[5899]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  625.576228][   T30] audit: type=1400 audit(1785316080.530:1358): avc:  denied  { mounton } for  pid=13944 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1
[  625.783622][   T30] audit: type=1400 audit(1785316080.740:1359): avc:  denied  { read } for  pid=14237 comm="syz.7.1526" dev="nsfs" ino=4026532985 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[  625.794371][T14238] Unsupported ieee802154 address type: 0
[  625.835634][ T5709] usb 2-1: new high-speed USB device number 77 using dummy_hcd
[  625.862180][   T30] audit: type=1400 audit(1785316080.750:1360): avc:  denied  { open } for  pid=14237 comm="syz.7.1526" path="net:[4026532985]" dev="nsfs" ino=4026532985 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[  626.611066][ T5709] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  626.620669][   T30] audit: type=1400 audit(1785316080.860:1361): avc:  denied  { nlmsg_write } for  pid=14235 comm="syz.4.1576" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1
[  626.633916][ T5709] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  626.729403][ T5709] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121
[  626.755198][   T30] audit: type=1400 audit(1785316080.960:1362): avc:  denied  { write } for  pid=14224 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  626.848229][ T5709] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  626.889282][   T30] audit: type=1400 audit(1785316081.840:1363): avc:  denied  { write } for  pid=14249 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  626.889404][ T5709] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  627.069595][ T5709] usb 2-1: Product: syz
[  627.085948][ T5709] usb 2-1: Manufacturer: syz
[  627.106370][ T5709] usb 2-1: SerialNumber: syz
[  627.140272][ T5709] usb 2-1: config 0 descriptor??
[  627.165616][T14229] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[  627.203487][T14260] tipc: Enabling of bearer <eth:xfrm0> rejected, already enabled
[  627.238186][T14229] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22
[  627.294816][ T5709] usb 2-1: ucan: probing device on interface #0
[  627.480280][ T5709] usb 2-1: ucan: device protocol version 0 is not supported
[  627.503875][ T5709] usb 2-1: ucan: probe failed; try to update the device firmware
[  627.744869][ T7967] usb 2-1: USB disconnect, device number 77
[  627.828068][ T5716] usb 3-1: new high-speed USB device number 21 using dummy_hcd
[  628.006969][ T5716] usb 3-1: Using ep0 maxpacket: 8
[  628.025672][ T5716] usb 3-1: unable to get BOS descriptor or descriptor too short
[  628.054964][ T5716] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 16
[  628.099441][ T5716] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice= 0.40
[  628.128390][ T5716] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  628.141482][   T30] audit: type=1400 audit(1785316083.100:1364): avc:  denied  { write } for  pid=14262 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  628.153758][ T5716] usb 3-1: Product: syz
[  628.212948][ T5716] usb 3-1: Manufacturer: syz
[  628.239930][ T5716] usb 3-1: SerialNumber: syz
[  628.280536][T14268] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22
[  628.954055][   T30] audit: type=1400 audit(1785316083.910:1365): avc:  denied  { write } for  pid=14279 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  629.298298][   T30] audit: type=1400 audit(1785316084.250:1366): avc:  denied  { allowed } for  pid=14284 comm="syz.1.1585" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1
[  629.366203][T14291] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  629.506301][T14294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  629.526595][   T30] audit: type=1400 audit(1785316084.480:1367): avc:  denied  { read write } for  pid=14284 comm="syz.1.1585" name="radio0" dev="devtmpfs" ino=958 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1
[  629.609251][T14294] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  629.631325][   T30] audit: type=1400 audit(1785316084.540:1368): avc:  denied  { open } for  pid=14284 comm="syz.1.1585" path="/dev/radio0" dev="devtmpfs" ino=958 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1
[  629.716273][   T30] audit: type=1400 audit(1785316084.540:1369): avc:  denied  { ioctl } for  pid=14284 comm="syz.1.1585" path="/dev/radio0" dev="devtmpfs" ino=958 ioctlcmd=0x5648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1
[  630.324605][   T30] audit: type=1400 audit(1785316085.280:1370): avc:  denied  { write } for  pid=14289 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  630.693547][T14309] bridge0: port 2(bridge_slave_1) entered disabled state
[  630.700925][T14309] bridge0: port 1(bridge_slave_0) entered disabled state
[  630.884175][T14323] Unsupported ieee802154 address type: 0
[  631.416076][T14309] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  631.470668][T14309] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  632.075684][T14348] netlink: 173 bytes leftover after parsing attributes in process `syz.1.1591'.
[  633.015850][   T30] kauditd_printk_skb: 3 callbacks suppressed
[  633.015863][   T30] audit: type=1400 audit(1785316087.970:1374): avc:  denied  { write } for  pid=14334 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  633.106933][ T6782] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  633.110002][ T5716] usb 3-1: Quirk or no altset; falling back to MIDI 1.0
[  633.181550][ T5716] usb 3-1: invalid MIDI in EP 0
[  633.433524][ T6782] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  633.558677][ T6782] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  633.572978][ T7221] kernel read not supported for file /video9 (pid: 7221 comm: kworker/0:8)
[  633.628286][   T30] audit: type=1400 audit(1785316088.590:1375): avc:  denied  { write } for  pid=14356 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  633.773154][ T6782] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  633.967803][ T5716] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22
[  634.112363][ T5716] usb 3-1: USB disconnect, device number 21
[  634.229794][ T7221] usb 5-1: new high-speed USB device number 19 using dummy_hcd
[  634.483562][ T5899] udevd[5899]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  634.552393][ T7221] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  634.600473][ T7221] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  634.675196][ T7221] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121
[  634.745082][ T7221] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  634.784241][ T7221] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  634.822026][ T7221] usb 5-1: Product: syz
[  634.845055][ T7221] usb 5-1: Manufacturer: syz
[  634.866084][ T7221] usb 5-1: SerialNumber: syz
[  634.943141][ T7221] usb 5-1: config 0 descriptor??
[  634.973023][T14364] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  635.026789][T14364] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22
[  635.055386][ T7221] usb 5-1: ucan: probing device on interface #0
[  635.063175][T14367] bridge0: port 2(bridge_slave_1) entered disabled state
[  635.070661][T14367] bridge0: port 1(bridge_slave_0) entered disabled state
[  635.215146][   T30] audit: type=1400 audit(1785316090.170:1376): avc:  denied  { write } for  pid=14373 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  635.281557][ T7221] usb 5-1: ucan: device protocol version 0 is not supported
[  635.290725][ T7221] usb 5-1: ucan: probe failed; try to update the device firmware
[  635.354762][   T30] audit: type=1400 audit(1785316090.310:1377): avc:  denied  { write } for  pid=14387 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  635.516415][ T7221] usb 5-1: USB disconnect, device number 19
[  635.540450][T14367] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  635.571546][T14367] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  635.630683][T14367] tipc: Resetting bearer <eth:xfrm0>
[  635.742796][   T30] audit: type=1400 audit(1785316090.700:1378): avc:  denied  { write } for  pid=14389 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  635.832195][   T30] audit: type=1400 audit(1785316090.790:1379): avc:  denied  { write } for  pid=14403 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  635.931967][T14402] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14402 comm=syz.1.1600
[  636.168629][   T48] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  636.177719][   T48] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  636.202447][T14415] Unsupported ieee802154 address type: 0
[  636.228076][   T48] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  636.261511][   T48] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  636.632139][T14426] netlink: 173 bytes leftover after parsing attributes in process `syz.2.1603'.
[  637.293240][   T30] audit: type=1400 audit(1785316092.250:1380): avc:  denied  { write } for  pid=14406 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  637.422334][   T30] audit: type=1400 audit(1785316092.380:1381): avc:  denied  { write } for  pid=14431 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  637.773003][T14447] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  638.057300][   T31] INFO: task syz.9.1245:11748 blocked for more than 143 seconds.
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  638.262180][   T30] audit: type=1400 audit(1785316093.090:1382): avc:  denied  { write } for  pid=5594 comm="syz-executor" path="pipe:[5400]" dev="pipefs" ino=5400 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[  638.289918][T14453] uinput: write device info first
[  638.400178][   T31]       Tainted: G             L      syzkaller #0
[  638.455456][   T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  638.515924][   T31] task:syz.9.1245      state:D stack:28776 pid:11748 tgid:11742 ppid:6810   task_flags:0x400040 flags:0x00080002
[  638.562056][   T31] Call Trace:
[  638.595789][   T31]  <TASK>
[  638.604731][   T31]  __schedule+0x125c/0x6730
[  638.616654][   T31]  ? __pfx___schedule+0x10/0x10
[  638.647618][   T31]  ? find_held_lock+0x2b/0x80
[  638.654270][   T31]  ? schedule+0x225/0x2c0
[  638.661707][   T31]  schedule+0xdd/0x2c0
[  638.670173][   T31]  schedule_preempt_disabled+0x13/0x30
[  638.682934][   T31]  __mutex_lock+0xccc/0x1bd0
[  638.690767][   T31]  ? write_threads+0x278/0x570
[  638.700893][   T31]  ? __pfx___mutex_lock+0x10/0x10
[  638.706640][ T7121] usb 7-1: USB disconnect, device number 48
[  638.707443][   T31]  ? simple_strntoull+0xdf/0x170
[  638.718394][   T31]  ? __lock_acquire+0x49f/0x1a40
[  638.723339][   T31]  ? write_threads+0x278/0x570
[  638.728300][   T31]  write_threads+0x278/0x570
[  638.733068][   T31]  ? __pfx_write_threads+0x10/0x10
[  638.746624][   T31]  ? __might_fault+0xc5/0x140
[  638.752783][   T31]  ? _copy_from_user+0x59/0xd0
[  638.766810][   T31]  ? __pfx_write_threads+0x10/0x10
[  638.773211][   T31]  nfsctl_transaction_write+0x106/0x1a0
[  638.786610][   T31]  vfs_write+0x2aa/0x1050
[  638.796611][   T31]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  638.806611][   T31]  ? __pfx_vfs_write+0x10/0x10
[  638.816664][   T31]  ? __fget_files+0x215/0x3d0
[  638.826623][   T31]  ? __fget_files+0x21f/0x3d0
[  638.836614][   T31]  ksys_write+0x12a/0x250
[  638.846616][   T31]  ? __pfx_ksys_write+0x10/0x10
[  638.856660][   T31]  do_syscall_64+0x115/0x870
[  638.867189][   T31]  ? clear_bhb_loop+0x40/0x90
[  638.873301][   T31]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  638.886724][   T31] RIP: 0033:0x7fa35e59de99
[  638.896639][   T31] RSP: 002b:00007fa35f441028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  638.912394][   T31] RAX: ffffffffffffffda RBX: 00007fa35e826180 RCX: 00007fa35e59de99
[  638.929040][   T31] RDX: 0000000000000002 RSI: 0000200000000100 RDI: 0000000000000009
[  638.946617][   T31] RBP: 00007fa35e633eaf R08: 0000000000000000 R09: 0000000000000000
[  638.966590][   T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  638.978070][   T31] R13: 00007fa35e826218 R14: 00007fa35e826180 R15: 00007ffea8b889c8
[  638.996730][   T31]  </TASK>
[  638.999818][   T31] 
[  638.999818][   T31] Showing all locks held in the system:
[  639.024483][   T31] 1 lock held by khungtaskd/31:
[  639.046677][   T31]  #0: ffffffff8ebe8180 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184
[  639.091918][   T31] 1 lock held by dhcpcd/5272:
[  639.109836][   T31]  #0: ffff8880b843b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140
[  639.178516][   T31] 2 locks held by getty/5370:
[  639.189472][   T31]  #0: ffff888037b190a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80
[  639.229391][   T31]  #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0
[  639.256803][   T31] 2 locks held by kworker/1:5/5709:
[  639.274759][   T31]  #0: ffff88801bc0f140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940
[  639.289582][   T31]  #1: ffffc9000439fd08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x988/0x1940
[  639.300073][   T31] 6 locks held by kworker/0:7/7121:
[  639.316583][   T31]  #0: ffff888020ea6d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940
[  639.341021][   T31]  #1: ffffc90004237d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940
[  639.359737][   T31]  #2: ffff88802b4ad1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4a60
[  639.375103][   T31]  #3: ffff88802a7fc1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0
[  639.384508][   T31]  #4: ffff8880371f41a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620
[  639.398387][   T31]  #5: ffffffff90a9f940 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x146/0x360
[  639.416922][   T31] 3 locks held by syz.9.1245/11743:
[  639.423875][   T31]  #0: ffff88807ab2a0f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380
[  639.446612][   T31]  #1: ffff88803183c450 (sb_writers#23){.+.+}-{0:0}, at: ksys_write+0x12a/0x250
[  639.463725][   T31]  #2: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0
[  639.478910][   T31] 3 locks held by syz.9.1245/11748:
[  639.484154][   T31]  #0: ffff88803238d0b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380
[  639.495165][   T31]  #1: ffff88803183c450 (sb_writers#23){.+.+}-{0:0}, at: ksys_write+0x12a/0x250
[  639.510839][   T31]  #2: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x278/0x570
[  639.520890][   T31] 2 locks held by syz.8.1264/11887:
[  639.526884][   T31]  #0: ffffffff90b4e628 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  639.535134][   T31]  #1: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_cache_flush_doit+0xd9/0x230
[  639.549115][   T31] 1 lock held by syz-executor/12199:
[  639.554420][   T31]  #0: ffff888056470ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0
[  639.561619][   T30] audit: type=1400 audit(1785316094.520:1383): avc:  denied  { write } for  pid=14458 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  639.565387][   T31] 2 locks held by syz.0.1364/12729:
[  639.594325][   T31]  #0: ffffffff90b4e628 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  639.603245][   T31]  #1: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_cache_flush_doit+0xd9/0x230
[  639.613288][   T31] 2 locks held by syz.5.1372/12782:
[  639.618505][   T31]  #0: ffffffff90b4e628 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  639.628155][   T31]  #1: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_cache_flush_doit+0xd9/0x230
[  639.639283][   T31] 1 lock held by syz-executor/13505:
[  639.644571][   T31]  #0: ffff88802cf88ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0
[  639.654925][   T31] 2 locks held by syz.3.1488/13633:
[  639.660363][   T31]  #0: ffffffff90b4e628 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  639.663205][   T30] audit: type=1400 audit(1785316094.620:1384): avc:  denied  { write } for  pid=14469 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  639.668695][   T31]  #1: ffffffff8f0727a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_cache_flush_doit+0xd9/0x230
[  639.702349][   T31] 1 lock held by syz-executor/13944:
[  639.707986][   T31]  #0: ffffffff8ebf3c28 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0
[  639.718124][   T31] 1 lock held by syz.6.1608/14441:
[  639.723228][   T31]  #0: ffffffff8ebf3c28 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0
[  639.734465][   T31] 1 lock held by dhcpcd/14448:
[  639.740247][   T31]  #0: ffff888059cf7b00 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260
[  639.751120][   T31] 1 lock held by syz.4.1610/14454:
[  639.756222][   T31]  #0: ffff888075450ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0
[  639.766283][   T31] 1 lock held by dhcpcd/14456:
[  639.771053][   T31]  #0: ffff888059fcc740 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260
[  639.787537][   T31] 
[  639.789889][   T31] =============================================
[  639.789889][   T31] 
[  639.798835][   T31] NMI backtrace for cpu 0
[  639.798853][   T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  639.798878][   T31] Tainted: [L]=SOFTLOCKUP
[  639.798883][   T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  639.798894][   T31] Call Trace:
[  639.798900][   T31]  <TASK>
[  639.798907][   T31]  dump_stack_lvl+0x100/0x190
[  639.798935][   T31]  nmi_cpu_backtrace.cold+0x12d/0x151
[  639.798959][   T31]  ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
[  639.798985][   T31]  nmi_trigger_cpumask_backtrace+0x21c/0x2a0
[  639.799016][   T31]  sys_info+0x141/0x190
[  639.799038][   T31]  watchdog+0xcb1/0x1030
[  639.799064][   T31]  ? _raw_spin_unlock_irqrestore+0x52/0x80
[  639.799083][   T31]  ? __pfx_watchdog+0x10/0x10
[  639.799104][   T31]  ? __kthread_parkme+0x18c/0x230
[  639.799132][   T31]  ? kthread+0x13a/0x450
[  639.799148][   T31]  ? __pfx_watchdog+0x10/0x10
[  639.799167][   T31]  kthread+0x370/0x450
[  639.799183][   T31]  ? __pfx_kthread+0x10/0x10
[  639.799202][   T31]  ret_from_fork+0x72b/0xd50
[  639.799227][   T31]  ? __pfx_ret_from_fork+0x10/0x10
[  639.799253][   T31]  ? __switch_to+0x800/0x10f0
[  639.799271][   T31]  ? __pfx_kthread+0x10/0x10
[  639.799290][   T31]  ret_from_fork_asm+0x1a/0x30
[  639.799327][   T31]  </TASK>
[  639.799334][   T31] Sending NMI from CPU 0 to CPUs 1:
[  639.930391][    C1] NMI backtrace for cpu 1
[  639.930407][    C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  639.930426][    C1] Tainted: [L]=SOFTLOCKUP
[  639.930431][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  639.930439][    C1] RIP: 0010:pv_native_safe_halt+0xf/0x20
[  639.930458][    C1] Code: d6 8b 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d c3 7e 10 00 fb f4 <e9> 3c 4a 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
[  639.930472][    C1] RSP: 0018:ffffc90000197e00 EFLAGS: 00000242
[  639.930484][    C1] RAX: 000000000334bed5 RBX: ffff88801eac2540 RCX: ffffffff8bbb22d5
[  639.930493][    C1] RDX: 0000000000000000 RSI: ffffffff8e1a5f23 RDI: ffffffff8c401680
[  639.930502][    C1] RBP: ffffed1003d584a8 R08: 0000000000000001 R09: ffffed10170a678d
[  639.930511][    C1] R10: ffff8880b8533c6b R11: 0000000000000000 R12: 0000000000000000
[  639.930519][    C1] R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000
[  639.930529][    C1] FS:  0000000000000000(0000) GS:ffff888123edc000(0000) knlGS:0000000000000000
[  639.930543][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  639.930553][    C1] CR2: 0000560e03f71660 CR3: 0000000075d2c000 CR4: 00000000003526f0
[  639.930562][    C1] Call Trace:
[  639.930568][    C1]  <TASK>
[  639.930573][    C1]  default_idle+0x9/0x10
[  639.930590][    C1]  default_idle_call+0x6c/0xb0
[  639.930605][    C1]  do_idle+0x3a7/0x5b0
[  639.930625][    C1]  ? __pfx_do_idle+0x10/0x10
[  639.930642][    C1]  ? finish_task_switch.isra.0+0x14c/0x10c0
[  639.930663][    C1]  cpu_startup_entry+0x4f/0x60
[  639.930681][    C1]  start_secondary+0x21d/0x2d0
[  639.930698][    C1]  ? __pfx_start_secondary+0x10/0x10
[  639.930717][    C1]  common_startup_64+0x13e/0x158
[  639.930741][    C1]  </TASK>
[  640.310575][   T31] Kernel panic - not syncing: hung_task: blocked tasks
[  640.317474][   T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  640.328139][   T31] Tainted: [L]=SOFTLOCKUP
[  640.332434][   T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  640.342467][   T31] Call Trace:
[  640.345721][   T31]  <TASK>
[  640.348642][   T31]  dump_stack_lvl+0x100/0x190
[  640.353297][   T31]  vpanic+0x552/0x970
[  640.357279][   T31]  ? __pfx_vpanic+0x10/0x10
[  640.361772][   T31]  ? nmi_trigger_cpumask_backtrace+0x1c7/0x2a0
[  640.367921][   T31]  panic+0xd1/0xe0
[  640.371631][   T31]  ? __pfx_panic+0x10/0x10
[  640.376023][   T31]  ? nmi_trigger_cpumask_backtrace+0x1fa/0x2a0
[  640.382158][   T31]  ? nmi_trigger_cpumask_backtrace+0x260/0x2a0
[  640.388301][   T31]  ? nmi_trigger_cpumask_backtrace+0x26a/0x2a0
[  640.394432][   T31]  ? watchdog.cold+0x1ec/0x234
[  640.399171][   T31]  ? watchdog+0xcc1/0x1030
[  640.403567][   T31]  watchdog.cold+0x1fd/0x234
[  640.408134][   T31]  ? _raw_spin_unlock_irqrestore+0x52/0x80
[  640.413919][   T31]  ? __pfx_watchdog+0x10/0x10
[  640.418573][   T31]  ? __kthread_parkme+0x18c/0x230
[  640.423578][   T31]  ? kthread+0x13a/0x450
[  640.427803][   T31]  ? __pfx_watchdog+0x10/0x10
[  640.432453][   T31]  kthread+0x370/0x450
[  640.436495][   T31]  ? __pfx_kthread+0x10/0x10
[  640.441062][   T31]  ret_from_fork+0x72b/0xd50
[  640.445634][   T31]  ? __pfx_ret_from_fork+0x10/0x10
[  640.450725][   T31]  ? __switch_to+0x800/0x10f0
[  640.455388][   T31]  ? __pfx_kthread+0x10/0x10
[  640.459968][   T31]  ret_from_fork_asm+0x1a/0x30
[  640.464719][   T31]  </TASK>
[  640.467916][   T31] Kernel Offset: disabled
[  640.472217][   T31] Rebooting in 86400 seconds..